@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-schedule-event.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAE7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,gBAAgB,GACtB,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAOrC"}

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-event.js

@@ -0,0 +1,22 @@
+import { samEventRuleResources } from "./sim-cfn-sam-event-rule.js";
+/**
+ * Expand one `Schedule` event into the rule that fires the function on a
+ * timer.
+ *
+ * The event's `Schedule` is the rule's `ScheduleExpression`, which is the
+ * whole of what a `Schedule` event says beyond what every rule event says. A
+ * rate or cron expression the rule refuses is refused by the rule, naming
+ * itself, rather than being read here.
+ *
+ * An event stating no `Schedule` expands into a rule with nothing to fire it,
+ * which the rule then refuses. A schedule guessed for an event that named none
+ * would be a function firing on a timer nobody asked for.
+ */
+export function samScheduleEventResources(event) {
+    const expression = event.properties["Schedule"];
+    return samEventRuleResources({
+        event,
+        trigger: expression === undefined ? {} : { ScheduleExpression: expression },
+    });
+}
+//# sourceMappingURL=sim-cfn-sam-schedule-event.js.map

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-schedule-event.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAuB;IAEvB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEhD,OAAO,qBAAqB,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-v2-event.d.ts

@@ -0,0 +1,15 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamFunctionEvent } from "./sim-cfn-sam-function-events.js";
+/**
+ * Expand one `ScheduleV2` event into the EventBridge Scheduler schedule that
+ * invokes the function.
+ *
+ * This is the other way to put a function on a timer, and it expands into an
+ * `AWS::Scheduler::Schedule` rather than a rule. The difference that shows is
+ * how the invocation is authorized. A schedule assumes an execution role and
+ * invokes as that role, where a rule arrives as a service principal and the
+ * function's resource policy decides. So this expands a Role rather than a
+ * permission, unless the event named a `RoleArn` of its own to run as.
+ */
+export declare function samScheduleV2EventResources(event: SamFunctionEvent): Record<string, SimCfnTemplateValue>;
+//# sourceMappingURL=sim-cfn-sam-schedule-v2-event.d.ts.map

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-v2-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-schedule-v2-event.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-v2-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEpB,MAAM,mDAAmD,CAAC;AAG3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAsBzE;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gBAAgB,GACtB,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAyBrC"}

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-v2-event.js

@@ -0,0 +1,97 @@
+import { samPickedProperties } from "../../sim-cfn-sam-picked.js";
+import { samEventStateProperty } from "./sim-cfn-sam-event-state.js";
+/**
+ * The properties an event and a schedule name the same thing, so expanding
+ * them is carrying them across.
+ */
+const carriedProperties = new Set([
+    "Description",
+    "EndDate",
+    "GroupName",
+    "KmsKeyArn",
+    "Name",
+    "ScheduleExpression",
+    "ScheduleExpressionTimezone",
+    "StartDate",
+]);
+/**
+ * The time window AWS requires on a schedule, for an event stating none.
+ */
+const fixedTimeWindow = { Mode: "OFF" };
+/**
+ * Expand one `ScheduleV2` event into the EventBridge Scheduler schedule that
+ * invokes the function.
+ *
+ * This is the other way to put a function on a timer, and it expands into an
+ * `AWS::Scheduler::Schedule` rather than a rule. The difference that shows is
+ * how the invocation is authorized. A schedule assumes an execution role and
+ * invokes as that role, where a rule arrives as a service principal and the
+ * function's resource policy decides. So this expands a Role rather than a
+ * permission, unless the event named a `RoleArn` of its own to run as.
+ */
+export function samScheduleV2EventResources(event) {
+    const prefix = `${event.functionLogicalId}${event.eventName}`;
+    const roleLogicalId = `${prefix}ScheduleRole`;
+    const declaredRoleArn = event.properties["RoleArn"];
+    return {
+        [`${prefix}Schedule`]: {
+            Type: "AWS::Scheduler::Schedule",
+            ...event.condition,
+            Properties: {
+                ...samPickedProperties(event.properties, carriedProperties),
+                ...samEventStateProperty(event.properties),
+                FlexibleTimeWindow: event.properties["FlexibleTimeWindow"] ?? fixedTimeWindow,
+                Target: {
+                    Arn: { "Fn::GetAtt": [event.functionLogicalId, "Arn"] },
+                    RoleArn: declaredRoleArn ?? { "Fn::GetAtt": [roleLogicalId, "Arn"] },
+                    ...samPickedProperties(event.properties, new Set(["Input"])),
+                },
+            },
+        },
+        ...(declaredRoleArn === undefined && {
+            [roleLogicalId]: samScheduleV2RoleResource(event, prefix),
+        }),
+    };
+}
+/**
+ * The AWS::IAM::Role the schedule invokes the function as.
+ *
+ * Scheduler assumes this role for every invocation, so it trusts the Scheduler
+ * service principal and may invoke the one function the event was declared on.
+ * A role granting `lambda:InvokeFunction` on everything would be the same
+ * schedule with a wider grant than the event asked for.
+ */
+function samScheduleV2RoleResource(event, prefix) {
+    return {
+        Type: "AWS::IAM::Role",
+        ...event.condition,
+        Properties: {
+            AssumeRolePolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Principal: { Service: "scheduler.amazonaws.com" },
+                        Action: "sts:AssumeRole",
+                    },
+                ],
+            },
+            Policies: [
+                {
+                    PolicyName: `${prefix}ScheduleRolePolicy`,
+                    PolicyDocument: {
+                        Version: "2012-10-17",
+                        Statement: [
+                            {
+                                Effect: "Allow",
+                                Action: "lambda:InvokeFunction",
+                                Resource: { "Fn::GetAtt": [event.functionLogicalId, "Arn"] },
+                            },
+                        ],
+                    },
+                },
+            ],
+        },
+    };
+}
+//# sourceMappingURL=sim-cfn-sam-schedule-v2-event.js.map

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-v2-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-schedule-v2-event.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/sam/function/event/sim-cfn-sam-schedule-v2-event.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAGrE;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,aAAa;IACb,SAAS;IACT,WAAW;IACX,WAAW;IACX,MAAM;IACN,oBAAoB;IACpB,4BAA4B;IAC5B,WAAW;CACZ,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,eAAe,GAA8B,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAuB;IAEvB,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IAC9D,MAAM,aAAa,GAAG,GAAG,MAAM,cAAc,CAAC;IAC9C,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAEpD,OAAO;QACL,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE;YACrB,IAAI,EAAE,0BAA0B;YAChC,GAAG,KAAK,CAAC,SAAS;YAClB,UAAU,EAAE;gBACV,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAC3D,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC1C,kBAAkB,EAChB,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,eAAe;gBAC3D,MAAM,EAAE;oBACN,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;oBACvD,OAAO,EAAE,eAAe,IAAI,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE;oBACpE,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC7D;aACF;SACF;QACD,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI;YACnC,CAAC,aAAa,CAAC,EAAE,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC;SAC1D,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAChC,KAAuB,EACvB,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,GAAG,KAAK,CAAC,SAAS;QAClB,UAAU,EAAE;YACV,wBAAwB,EAAE;gBACxB,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,OAAO;wBACf,SAAS,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE;wBACjD,MAAM,EAAE,gBAAgB;qBACzB;iBACF;aACF;YACD,QAAQ,EAAE;gBACR;oBACE,UAAU,EAAE,GAAG,MAAM,oBAAoB;oBACzC,cAAc,EAAE;wBACd,OAAO,EAAE,YAAY;wBACrB,SAAS,EAAE;4BACT;gCACE,MAAM,EAAE,OAAO;gCACf,MAAM,EAAE,uBAAuB;gCAC/B,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;6BAC7D;yBACF;qBACF;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-sns-event.d.ts

@@ -0,0 +1,23 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamFunctionEvent } from "./sim-cfn-sam-function-events.js";
+/**
+ * Expand one `SNS` event into the subscription that delivers the topic's
+ * messages to the function.
+ *
+ * The subscription is the function itself rather than a queue in front of it,
+ * so the protocol is `lambda` and the endpoint is the function's ARN. SNS
+ * consults the function's resource policy on every delivery, so the permission
+ * admitting SNS comes with it. Without one the topic has a subscription it
+ * cannot deliver to.
+ *
+ * Everything the event states beside `Topic` goes onto the subscription under
+ * the name it already carries, which is how `FilterPolicy` and its scope
+ * arrive. `SqsSubscription`, which asks for a queue between the two, is not a
+ * subscription property and is refused by the subscription rather than
+ * silently deploying the direct delivery the event did not ask for.
+ *
+ * An event naming no topic expands into nothing, the way a mapping with no
+ * source does.
+ */
+export declare function samSnsEventResources(event: SamFunctionEvent): Record<string, SimCfnTemplateValue>;
+//# sourceMappingURL=sim-cfn-sam-sns-event.d.ts.map

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-sns-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-sns-event.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/sam/function/event/sim-cfn-sam-sns-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEpB,MAAM,mDAAmD,CAAC;AAE3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,GACtB,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAarC"}

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-sns-event.js

@@ -0,0 +1,60 @@
+import { samRecordWithout } from "../../sim-cfn-sam-record.js";
+/**
+ * Expand one `SNS` event into the subscription that delivers the topic's
+ * messages to the function.
+ *
+ * The subscription is the function itself rather than a queue in front of it,
+ * so the protocol is `lambda` and the endpoint is the function's ARN. SNS
+ * consults the function's resource policy on every delivery, so the permission
+ * admitting SNS comes with it. Without one the topic has a subscription it
+ * cannot deliver to.
+ *
+ * Everything the event states beside `Topic` goes onto the subscription under
+ * the name it already carries, which is how `FilterPolicy` and its scope
+ * arrive. `SqsSubscription`, which asks for a queue between the two, is not a
+ * subscription property and is refused by the subscription rather than
+ * silently deploying the direct delivery the event did not ask for.
+ *
+ * An event naming no topic expands into nothing, the way a mapping with no
+ * source does.
+ */
+export function samSnsEventResources(event) {
+    const topic = event.properties["Topic"];
+    if (topic === undefined) {
+        return {};
+    }
+    const prefix = `${event.functionLogicalId}${event.eventName}Sns`;
+    return {
+        [`${prefix}Subscription`]: subscriptionResource(event, topic),
+        [`${prefix}Permission`]: permissionResource(event, topic),
+    };
+}
+function subscriptionResource(event, topic) {
+    return {
+        Type: "AWS::SNS::Subscription",
+        ...event.condition,
+        Properties: {
+            ...samRecordWithout(event.properties, "Topic"),
+            TopicArn: topic,
+            Protocol: "lambda",
+            Endpoint: { "Fn::GetAtt": [event.functionLogicalId, "Arn"] },
+        },
+    };
+}
+/**
+ * The AWS::Lambda::Permission the topic invokes the function under, granted
+ * for that topic alone.
+ */
+function permissionResource(event, topic) {
+    return {
+        Type: "AWS::Lambda::Permission",
+        ...event.condition,
+        Properties: {
+            Action: "lambda:InvokeFunction",
+            FunctionName: { "Fn::GetAtt": [event.functionLogicalId, "Arn"] },
+            Principal: "sns.amazonaws.com",
+            SourceArn: topic,
+        },
+    };
+}
+//# sourceMappingURL=sim-cfn-sam-sns-event.js.map

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-sns-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-sns-event.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/sam/function/event/sim-cfn-sam-sns-event.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAuB;IAEvB,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,SAAS,KAAK,CAAC;IAEjE,OAAO;QACL,CAAC,GAAG,MAAM,cAAc,CAAC,EAAE,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC7D,CAAC,GAAG,MAAM,YAAY,CAAC,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAuB,EACvB,KAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,GAAG,KAAK,CAAC,SAAS;QAClB,UAAU,EAAE;YACV,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;YAC9C,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;SAC7D;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,KAAuB,EACvB,KAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,GAAG,KAAK,CAAC,SAAS;QAClB,UAAU,EAAE;YACV,MAAM,EAAE,uBAAuB;YAC/B,YAAY,EAAE,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;YAChE,SAAS,EAAE,mBAAmB;YAC9B,SAAS,EAAE,KAAK;SACjB;KACF,CAAC;AACJ,CAAC"}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-policies.d.ts

@@ -0,0 +1,31 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+/**
+ * The trust policy the Role carries, which lets Lambda assume it.
+ */
+export declare const lambdaAssumeRolePolicyDocument: SimCfnTemplateValueRecord;
+/**
+ * The managed policy SAM attaches to every function Role it generates.
+ */
+export declare const basicExecutionPolicyArn: SimCfnTemplateValueRecord;
+/**
+ * What the `Policies` of a SAM function say about the Role it is expanded
+ * with.
+ */
+export interface SamFunctionPolicies {
+    /** Policy documents, named the way SAM names them. */
+    readonly inlinePolicies: readonly SimCfnTemplateValueRecord[];
+    /** Managed policy ARNs the Role attaches. */
+    readonly managedPolicyArns: readonly string[];
+}
+/**
+ * Read the `Policies` of a SAM function into the two lists an AWS::IAM::Role
+ * carries.
+ *
+ * `Policies` holds one entry or a list of them, and an entry is a policy
+ * document, a managed policy ARN, or a SAM policy template naming permissions
+ * to generate. The templates are not expanded here. There are around a hundred
+ * of them, and the default `SimIamAllowAllAuth` means a Role missing their
+ * statements authorizes the same calls either way.
+ */
+export declare function samFunctionPolicies(logicalId: string, policies: SimCfnTemplateValue | undefined): SamFunctionPolicies;
+//# sourceMappingURL=sim-cfn-sam-function-policies.d.ts.map

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-function-policies.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/sam/function/sim-cfn-sam-function-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,gDAAgD,CAAC;AAGxD;;GAEG;AACH,eAAO,MAAM,8BAA8B,EAAE,yBAS5C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,yBASrC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,sDAAsD;IACtD,QAAQ,CAAC,cAAc,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC9D,6CAA6C;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,mBAAmB,CAYrB"}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-policies.js

@@ -0,0 +1,74 @@
+import { isSamTemplateRecord } from "../sim-cfn-sam-record.js";
+/**
+ * The trust policy the Role carries, which lets Lambda assume it.
+ */
+export const lambdaAssumeRolePolicyDocument = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "lambda.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};
+/**
+ * The managed policy SAM attaches to every function Role it generates.
+ */
+export const basicExecutionPolicyArn = {
+    "Fn::Join": [
+        "",
+        [
+            "arn:",
+            { Ref: "AWS::Partition" },
+            ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+        ],
+    ],
+};
+/**
+ * Read the `Policies` of a SAM function into the two lists an AWS::IAM::Role
+ * carries.
+ *
+ * `Policies` holds one entry or a list of them, and an entry is a policy
+ * document, a managed policy ARN, or a SAM policy template naming permissions
+ * to generate. The templates are not expanded here. There are around a hundred
+ * of them, and the default `SimIamAllowAllAuth` means a Role missing their
+ * statements authorizes the same calls either way.
+ */
+export function samFunctionPolicies(logicalId, policies) {
+    const entries = policyEntries(policies);
+    return {
+        inlinePolicies: entries
+            .filter((entry) => isPolicyDocument(entry))
+            .map((document, index) => ({
+            PolicyName: `${logicalId}RolePolicy${String(index)}`,
+            PolicyDocument: document,
+        })),
+        managedPolicyArns: entries.filter((entry) => isManagedPolicyArn(entry)),
+    };
+}
+/**
+ * The `Policies` property as a list, since SAM accepts a single entry in place
+ * of one.
+ */
+function policyEntries(policies) {
+    if (policies === undefined) {
+        return [];
+    }
+    return Array.isArray(policies) ? policies : [policies];
+}
+/**
+ * Whether an entry is a policy document. A policy template is an object of one
+ * key naming the template.
+ */
+function isPolicyDocument(entry) {
+    return isSamTemplateRecord(entry) && "Statement" in entry;
+}
+/**
+ * Whether an entry is a managed policy ARN. A policy template arrives as a
+ * bare name.
+ */
+function isManagedPolicyArn(entry) {
+    return typeof entry === "string" && entry.startsWith("arn:");
+}
+//# sourceMappingURL=sim-cfn-sam-function-policies.js.map

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-function-policies.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/sam/function/sim-cfn-sam-function-policies.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA8B;IACvE,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT;YACE,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;YAC9C,MAAM,EAAE,gBAAgB;SACzB;KACF;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B;IAChE,UAAU,EAAE;QACV,EAAE;QACF;YACE,MAAM;YACN,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACzB,2DAA2D;SAC5D;KACF;CACF,CAAC;AAaF;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,QAAyC;IAEzC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAExC,OAAO;QACL,cAAc,EAAE,OAAO;aACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACzB,UAAU,EAAE,GAAG,SAAS,aAAa,MAAM,CAAC,KAAK,CAAC,EAAE;YACpD,cAAc,EAAE,QAAQ;SACzB,CAAC,CAAC;QACL,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,QAAyC;IAEzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,KAA0B;IAE1B,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAA0B;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC"}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-properties.d.ts

@@ -0,0 +1,24 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+/**
+ * The `Properties` of the SAM Resource. A function taking everything it has
+ * from `Globals` can leave the section out.
+ */
+export declare function samResourceProperties(resource: SimCfnTemplateValueRecord): SimCfnTemplateValueRecord;
+/**
+ * The Resource attributes the expanded Lambda function carries.
+ */
+export declare function samCarriedAttributes(resource: SimCfnTemplateValueRecord): SimCfnTemplateValueRecord;
+/**
+ * The `Condition` attribute a Resource expanded beside the function carries.
+ *
+ * Everything the function was expanded with exists because the function does,
+ * so a function the template conditioned out leaves none of them behind for
+ * the Stack to create.
+ */
+export declare function samConditionAttribute(condition: SimCfnTemplateValue | undefined): SimCfnTemplateValueRecord;
+/**
+ * The properties the expanded Lambda function carries, from the SAM function
+ * properties the `Globals` defaults have already been merged into.
+ */
+export declare function samCarriedProperties(functionProperties: SimCfnTemplateValueRecord): SimCfnTemplateValueRecord;
+//# sourceMappingURL=sim-cfn-sam-function-properties.d.ts.map

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-function-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/sam/function/sim-cfn-sam-function-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,gDAAgD,CAAC;AAuBxD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,CAI3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,CAE3B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,mBAAmB,GAAG,SAAS,GACzC,yBAAyB,CAE3B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,kBAAkB,EAAE,yBAAyB,GAC5C,yBAAyB,CAK3B"}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-properties.js

@@ -0,0 +1,67 @@
+import { isSamTemplateRecord } from "../sim-cfn-sam-record.js";
+/**
+ * The Resource attributes the Lambda function carries over. They are the ones
+ * saying whether it is created at all and what has to exist first.
+ */
+const attributeNames = new Set(["Condition", "DependsOn"]);
+/**
+ * The properties whose names and meanings are the same on both Resource types,
+ * so expanding them is carrying them across.
+ */
+const propertyNames = new Set([
+    "Description",
+    "Environment",
+    "FunctionName",
+    "Handler",
+    "MemorySize",
+    "Runtime",
+    "Timeout",
+]);
+/**
+ * The `Properties` of the SAM Resource. A function taking everything it has
+ * from `Globals` can leave the section out.
+ */
+export function samResourceProperties(resource) {
+    const properties = resource["Properties"];
+    return isSamTemplateRecord(properties) ? properties : {};
+}
+/**
+ * The Resource attributes the expanded Lambda function carries.
+ */
+export function samCarriedAttributes(resource) {
+    return picked(resource, attributeNames);
+}
+/**
+ * The `Condition` attribute a Resource expanded beside the function carries.
+ *
+ * Everything the function was expanded with exists because the function does,
+ * so a function the template conditioned out leaves none of them behind for
+ * the Stack to create.
+ */
+export function samConditionAttribute(condition) {
+    return condition === undefined ? {} : { Condition: condition };
+}
+/**
+ * The properties the expanded Lambda function carries, from the SAM function
+ * properties the `Globals` defaults have already been merged into.
+ */
+export function samCarriedProperties(functionProperties) {
+    return {
+        ...picked(functionProperties, propertyNames),
+        ...inlineCode(functionProperties),
+    };
+}
+/**
+ * The `Code` of a function whose source the template holds inline.
+ */
+function inlineCode(functionProperties) {
+    const source = functionProperties["InlineCode"];
+    return typeof source === "string" ? { Code: { ZipFile: source } } : {};
+}
+/**
+ * The entries of a record whose keys are in the given set.
+ */
+function picked(record, names) {
+    return Object.fromEntries(Object.entries(record).filter(([name]) => names.has(name)));
+}
+//# sourceMappingURL=sim-cfn-sam-function-properties.js.map

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-function-properties.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/sam/function/sim-cfn-sam-function-properties.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,aAAa;IACb,aAAa;IACb,cAAc;IACd,SAAS;IACT,YAAY;IACZ,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAmC;IAEnC,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE1C,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmC;IAEnC,OAAO,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA0C;IAE1C,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,kBAA6C;IAE7C,OAAO;QACL,GAAG,MAAM,CAAC,kBAAkB,EAAE,aAAa,CAAC;QAC5C,GAAG,UAAU,CAAC,kBAAkB,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CACjB,kBAA6C;IAE7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAEhD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,SAAS,MAAM,CACb,MAAiC,EACjC,KAA0B;IAE1B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC"}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-role.d.ts

@@ -0,0 +1,18 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+interface SamFunctionRoleProperties {
+    readonly logicalId: string;
+    readonly functionProperties: SimCfnTemplateValueRecord;
+    readonly condition: SimCfnTemplateValue | undefined;
+}
+/**
+ * The AWS::IAM::Role Resource a SAM function is expanded with, for a function
+ * that named no Role of its own.
+ *
+ * Every SAM function gets the basic execution policy, as SAM gives one, and
+ * whatever its `Policies` said on top. The Role is conditioned the way the
+ * function is. A function the template conditioned out leaves no Role behind
+ * for the Stack to create.
+ */
+export declare function samFunctionRoleResource(properties: SamFunctionRoleProperties): SimCfnTemplateValueRecord;
+export {};
+//# sourceMappingURL=sim-cfn-sam-function-role.d.ts.map

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-function-role.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/sam/function/sim-cfn-sam-function-role.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,gDAAgD,CAAC;AAQxD,UAAU,yBAAyB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,yBAAyB,GACpC,yBAAyB,CAmB3B"}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-role.js

@@ -0,0 +1,35 @@
+import { samConditionAttribute } from "./sim-cfn-sam-function-properties.js";
+import { basicExecutionPolicyArn, lambdaAssumeRolePolicyDocument, samFunctionPolicies, } from "./sim-cfn-sam-function-policies.js";
+/**
+ * The AWS::IAM::Role Resource a SAM function is expanded with, for a function
+ * that named no Role of its own.
+ *
+ * Every SAM function gets the basic execution policy, as SAM gives one, and
+ * whatever its `Policies` said on top. The Role is conditioned the way the
+ * function is. A function the template conditioned out leaves no Role behind
+ * for the Stack to create.
+ */
+export function samFunctionRoleResource(properties) {
+    const { logicalId, functionProperties, condition } = properties;
+    const policies = samFunctionPolicies(logicalId, functionProperties["Policies"]);
+    return {
+        Type: "AWS::IAM::Role",
+        ...samConditionAttribute(condition),
+        Properties: {
+            AssumeRolePolicyDocument: lambdaAssumeRolePolicyDocument,
+            ManagedPolicyArns: [
+                basicExecutionPolicyArn,
+                ...policies.managedPolicyArns,
+            ],
+            ...inlinePolicies(policies.inlinePolicies),
+        },
+    };
+}
+/**
+ * The `Policies` property the Role carries, where the function stated policy
+ * documents to put there.
+ */
+function inlinePolicies(policies) {
+    return policies.length > 0 ? { Policies: [...policies] } : {};
+}
+//# sourceMappingURL=sim-cfn-sam-function-role.js.map

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-function-role.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/sam/function/sim-cfn-sam-function-role.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAQ5C;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAqC;IAErC,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IAChE,MAAM,QAAQ,GAAG,mBAAmB,CAClC,SAAS,EACT,kBAAkB,CAAC,UAAU,CAAC,CAC/B,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,GAAG,qBAAqB,CAAC,SAAS,CAAC;QACnC,UAAU,EAAE;YACV,wBAAwB,EAAE,8BAA8B;YACxD,iBAAiB,EAAE;gBACjB,uBAAuB;gBACvB,GAAG,QAAQ,CAAC,iBAAiB;aAC9B;YACD,GAAG,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC;SAC3C;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,QAA8C;IAE9C,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-template.factory.d.ts

@@ -0,0 +1,50 @@
+import { MappedFactory } from "@kensio/part-factory";
+import type { CfnTemplateBodyRecord } from "../../template/sim-cfn-template.js";
+import type { SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+/**
+ * What a test asks for when it wants a SAM template holding one function.
+ */
+export interface SimCfnSamFunctionTemplateInput {
+    /**
+     * What this test is about, added to the properties of a function that
+     * already runs.
+     */
+    readonly functionProperties: SimCfnTemplateValueRecord;
+    /**
+     * The `Globals.Function` defaults the template states. A test stating none
+     * gets no `Globals` section.
+     */
+    readonly globals: SimCfnTemplateValueRecord;
+    /**
+     * The `Globals.Api` defaults the template states, for a test about what an
+     * `Api` event takes from them. A test stating none gets no section.
+     */
+    readonly apiGlobals: SimCfnTemplateValueRecord;
+    /**
+     * Resources the template carries beside the function, such as the API an
+     * event names or a second function sharing one.
+     */
+    readonly resources: SimCfnTemplateValueRecord;
+}
+/**
+ * The logical ID the function carries, and so the name the Lambda function and
+ * its execution Role are expanded under.
+ */
+export declare const samFunctionTemplateLogicalId = "Rates";
+/**
+ * Builds a SAM template holding one AWS::Serverless::Function.
+ *
+ * ```typescript
+ * const stack = await simAws.cloudFormation().deployTemplate({
+ *   stackName: "rates-stack",
+ *   template: simCfnSamFunctionTemplateFactory.make({
+ *     functionProperties: { Timeout: 30 },
+ *   }),
+ * });
+ * ```
+ *
+ * The function runs as it comes, with its source inline and a handler and
+ * runtime naming it. What a test states is what the test is about.
+ */
+export declare const simCfnSamFunctionTemplateFactory: MappedFactory<SimCfnSamFunctionTemplateInput, CfnTemplateBodyRecord, undefined>;
+//# sourceMappingURL=sim-cfn-sam-function-template.factory.d.ts.map

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-template.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-sam-function-template.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/sam/function/sim-cfn-sam-function-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAIhG;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;CAC/C;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,UAAU,CAAC;AASpD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gCAAgC,iFAqB5C,CAAC"}