@kensio/yulin 1.19.1 → 1.19.3

package/dist/terraform/map/sim-tf-map-http-api-routes.d.ts

@@ -0,0 +1,10 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/**
+ * An integration. Its URI is the value a plan most often cannot resolve,
+ * because it names a function that does not exist yet.
+ */
+export declare function httpApiIntegration(context: TerraformMappingContext): TerraformMappedResource;
+/** A route, which needs the integration it targets to have been created. */
+export declare function httpApiRoute(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-http-api-routes.d.ts.map

package/dist/terraform/map/sim-tf-map-http-api-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-http-api-routes.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-http-api-routes.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAWzB;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAC1B,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAazB"}

package/dist/terraform/map/sim-tf-map-http-api-routes.js

@@ -0,0 +1,48 @@
+import { attribute, properties, renamed, } from "../sim-tf-attributes.js";
+/**
+ * An integration. Its URI is the value a plan most often cannot resolve,
+ * because it names a function that does not exist yet.
+ */
+export function httpApiIntegration(context) {
+    return {
+        Type: "AWS::ApiGatewayV2::Integration",
+        Properties: renamed(context, {
+            ApiId: "api_id",
+            IntegrationType: "integration_type",
+            IntegrationUri: "integration_uri",
+            PayloadFormatVersion: "payload_format_version",
+        }),
+        requires: ["ApiId", "IntegrationUri"],
+    };
+}
+/** A route, which needs the integration it targets to have been created. */
+export function httpApiRoute(context) {
+    return {
+        Type: "AWS::ApiGatewayV2::Route",
+        Properties: {
+            ...renamed(context, {
+                ApiId: "api_id",
+                RouteKey: "route_key",
+                AuthorizationType: "authorization_type",
+            }),
+            ...properties({ Target: routeTarget(context) }),
+        },
+        requires: ["ApiId", "Target"],
+    };
+}
+/**
+ * What the route sends a request to, as `integrations/<integration id>`.
+ *
+ * Terraform writes that string itself, and the integration ID inside it is
+ * unknown until the integration exists, which makes the whole string unknown.
+ * What survives is a reference to the integration, and a reference on its own
+ * is the ID without the prefix CloudFormation expects.
+ */
+function routeTarget(context) {
+    const target = attribute(context, "target");
+    if (target === undefined || typeof target === "string") {
+        return target;
+    }
+    return { "Fn::Join": ["", ["integrations/", target]] };
+}
+//# sourceMappingURL=sim-tf-map-http-api-routes.js.map

package/dist/terraform/map/sim-tf-map-http-api-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-http-api-routes.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-http-api-routes.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,SAAS,EACT,UAAU,EACV,OAAO,GAER,MAAM,yBAAyB,CAAC;AAGjC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,KAAK,EAAE,QAAQ;YACf,eAAe,EAAE,kBAAkB;YACnC,cAAc,EAAE,iBAAiB;YACjC,oBAAoB,EAAE,wBAAwB;SAC/C,CAAC;QACF,QAAQ,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE;gBAClB,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,WAAW;gBACrB,iBAAiB,EAAE,oBAAoB;aACxC,CAAC;YACF,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;SAChD;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,OAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE5C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/dist/terraform/map/sim-tf-map-http-api.d.ts

@@ -0,0 +1,7 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/** An HTTP API. */
+export declare function httpApi(context: TerraformMappingContext): TerraformMappedResource;
+/** A stage. */
+export declare function httpApiStage(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-http-api.d.ts.map

package/dist/terraform/map/sim-tf-map-http-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-http-api.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-http-api.ts"],"names":[],"mappings":"AAOA,OAAO,EAOL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,mBAAmB;AACnB,wBAAgB,OAAO,CACrB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAYzB;AAgBD,eAAe;AACf,wBAAgB,YAAY,CAC1B,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAUzB"}

package/dist/terraform/map/sim-tf-map-http-api.js

@@ -0,0 +1,38 @@
+import { block, field, properties, renamed, tags, templateValue, } from "../sim-tf-attributes.js";
+/** An HTTP API. */
+export function httpApi(context) {
+    return {
+        Type: "AWS::ApiGatewayV2::Api",
+        Properties: {
+            ...renamed(context, { Name: "name", ProtocolType: "protocol_type" }),
+            ...properties({
+                CorsConfiguration: cors(block(context, "cors_configuration")),
+                Tags: tags(context),
+            }),
+        },
+        requires: ["Name", "ProtocolType"],
+    };
+}
+function cors(configured) {
+    if (configured === undefined) {
+        return undefined;
+    }
+    return properties({
+        AllowOrigins: templateValue(field(configured, "allow_origins")),
+        AllowMethods: templateValue(field(configured, "allow_methods")),
+        AllowHeaders: templateValue(field(configured, "allow_headers")),
+    });
+}
+/** A stage. */
+export function httpApiStage(context) {
+    return {
+        Type: "AWS::ApiGatewayV2::Stage",
+        Properties: renamed(context, {
+            ApiId: "api_id",
+            StageName: "name",
+            AutoDeploy: "auto_deploy",
+        }),
+        requires: ["ApiId", "StageName"],
+    };
+}
+//# sourceMappingURL=sim-tf-map-http-api.js.map

package/dist/terraform/map/sim-tf-map-http-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-http-api.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-http-api.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,EACL,KAAK,EACL,UAAU,EACV,OAAO,EACP,IAAI,EACJ,aAAa,GAEd,MAAM,yBAAyB,CAAC;AAGjC,mBAAmB;AACnB,MAAM,UAAU,OAAO,CACrB,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;YACpE,GAAG,UAAU,CAAC;gBACZ,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;gBAC7D,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;aACpB,CAAC;SACH;QACD,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CACX,UAA+C;IAE/C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,CAAC;QAChB,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC/D,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC/D,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;KAChE,CAAC,CAAC;AACL,CAAC;AAED,eAAe;AACf,MAAM,UAAU,YAAY,CAC1B,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,aAAa;SAC1B,CAAC;QACF,QAAQ,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/terraform/map/sim-tf-map-iam-policy.d.ts

@@ -0,0 +1,32 @@
+import type { SimCfnTemplateValue } from "../../service/cloudformation/template/value/sim-cfn-template-value.js";
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+/**
+ * An inline policy on the role it is attached to.
+ *
+ * A document built with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, and its statements are gone with it, so a deployment can
+ * supply the document against the role's own name.
+ *
+ * With nothing supplied, the role is created holding a policy that allows
+ * everything and the attribute is recorded as lost. Simulated IAM evaluates
+ * authorization, so the alternative is a role that denies what the
+ * configuration allowed, which fails the resources that use it and takes the
+ * rest of the Stack with them. A role that is too permissive is the same
+ * answer sim CloudFormation gives a Resource type it cannot create: carry on,
+ * and say what was stepped over.
+ */
+export declare function inlinePolicy(context: TerraformMappingContext): Record<string, SimCfnTemplateValue>;
+/** The attributes this fold could not carry, which is the document or none. */
+export declare function inlinePolicyLost(context: TerraformMappingContext): readonly string[];
+/**
+ * A policy document, which Terraform carries as a JSON string and
+ * CloudFormation as an object.
+ *
+ * A document built with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, so this returns nothing rather than a partial policy. A
+ * string that will not parse answers the same way. The plan is a file on disk
+ * and one unreadable document is one attribute, and failing the whole import
+ * over it would take every other resource of the plan with it.
+ */
+export declare function jsonDocument(value: unknown): SimCfnTemplateValue | undefined;
+//# sourceMappingURL=sim-tf-map-iam-policy.d.ts.map

package/dist/terraform/map/sim-tf-map-iam-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-iam-policy.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-iam-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AACjH,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAMrC;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,SAAS,MAAM,EAAE,CAEnB;AAmDD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAQ5E"}

package/dist/terraform/map/sim-tf-map-iam-policy.js

@@ -0,0 +1,85 @@
+import { isRecord } from "../../util/type-guard/record.js";
+import { attribute, field, templateValue, } from "../sim-tf-attributes.js";
+import { terraformReferencedResource } from "../sim-tf-referenced.js";
+/**
+ * An inline policy on the role it is attached to.
+ *
+ * A document built with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, and its statements are gone with it, so a deployment can
+ * supply the document against the role's own name.
+ *
+ * With nothing supplied, the role is created holding a policy that allows
+ * everything and the attribute is recorded as lost. Simulated IAM evaluates
+ * authorization, so the alternative is a role that denies what the
+ * configuration allowed, which fails the resources that use it and takes the
+ * rest of the Stack with them. A role that is too permissive is the same
+ * answer sim CloudFormation gives a Resource type it cannot create: carry on,
+ * and say what was stepped over.
+ */
+export function inlinePolicy(context) {
+    const document = policyDocument(context) ?? unknownPolicyDocument;
+    return {
+        Policies: [{ PolicyName: policyName(context), PolicyDocument: document }],
+    };
+}
+/** The attributes this fold could not carry, which is the document or none. */
+export function inlinePolicyLost(context) {
+    return policyDocument(context) === undefined ? ["policy"] : [];
+}
+/**
+ * What this policy allows, from the plan or from the deployment.
+ *
+ * The plan comes first, so a supplied document fills a gap rather than
+ * replacing a document Terraform resolved.
+ */
+function policyDocument(context) {
+    return (jsonDocument(field(context.resource.values, "policy")) ??
+        suppliedDocument(context));
+}
+/**
+ * The document a deployment supplied for the role this policy is attached to.
+ *
+ * The `role` attribute holds a reference rather than a name, because a role
+ * created by the same plan has no ID until it exists. The role behind the
+ * reference is what carries the name an override is matched on.
+ */
+function suppliedDocument(context) {
+    const role = terraformReferencedResource(context.resource, "role", context.resolver);
+    return templateValue(context.overrides.policy(role && field(role.values, "name")));
+}
+/** What a role whose policy the plan collapsed is allowed to do. */
+const unknownPolicyDocument = {
+    Version: "2012-10-17",
+    Statement: [{ Effect: "Allow", Action: "*", Resource: "*" }],
+};
+/** The name of an inline role policy, which Terraform lets go unnamed. */
+function policyName(context) {
+    const name = attribute(context, "name");
+    return typeof name === "string" && name.length > 0 ? name : "inline";
+}
+/**
+ * A policy document, which Terraform carries as a JSON string and
+ * CloudFormation as an object.
+ *
+ * A document built with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, so this returns nothing rather than a partial policy. A
+ * string that will not parse answers the same way. The plan is a file on disk
+ * and one unreadable document is one attribute, and failing the whole import
+ * over it would take every other resource of the plan with it.
+ */
+export function jsonDocument(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const parsed = parsedDocument(value);
+    return isRecord(parsed) ? templateValue(parsed) : undefined;
+}
+function parsedDocument(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=sim-tf-map-iam-policy.js.map

package/dist/terraform/map/sim-tf-map-iam-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-iam-policy.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-iam-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAE3D,OAAO,EACL,SAAS,EACT,KAAK,EACL,aAAa,GAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAgC;IAEhC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC;IAElE,OAAO;QACL,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,OAAO,cAAc,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,OAAgC;IAEhC,OAAO,CACL,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,gBAAgB,CAAC,OAAO,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAAgC;IAEhC,MAAM,IAAI,GAAG,2BAA2B,CACtC,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,OAAO,CAAC,QAAQ,CACjB,CAAC;IAEF,OAAO,aAAa,CAClB,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,qBAAqB,GAAwB;IACjD,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;CAC7D,CAAC;AAEF,0EAA0E;AAC1E,SAAS,UAAU,CAAC,OAAgC;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAExC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAErC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/terraform/map/sim-tf-map-iam.d.ts

@@ -0,0 +1,7 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource, TerraformResourceFold } from "../sim-tf-mapping.type.js";
+/** A role. The policies on it arrive as resources of their own. */
+export declare function iamRole(context: TerraformMappingContext): TerraformMappedResource;
+/** The IAM resources that attach policy to a role declared elsewhere. */
+export declare const iamRoleFolds: ReadonlyMap<string, TerraformResourceFold>;
+//# sourceMappingURL=sim-tf-map-iam.d.ts.map

package/dist/terraform/map/sim-tf-map-iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-iam.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-iam.ts"],"names":[],"mappings":"AAOA,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAMjC,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,2BAA2B,CAAC;AAEnC,mEAAmE;AACnE,wBAAgB,OAAO,CACrB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAgBzB;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAgBlE,CAAC"}

package/dist/terraform/map/sim-tf-map-iam.js

@@ -0,0 +1,37 @@
+import { attribute, field, properties, renamed, tags, } from "../sim-tf-attributes.js";
+import { inlinePolicy, inlinePolicyLost, jsonDocument, } from "./sim-tf-map-iam-policy.js";
+/** A role. The policies on it arrive as resources of their own. */
+export function iamRole(context) {
+    const assume = jsonDocument(field(context.resource.values, "assume_role_policy"));
+    return {
+        Type: "AWS::IAM::Role",
+        Properties: {
+            ...renamed(context, { RoleName: "name" }),
+            ...properties({
+                AssumeRolePolicyDocument: assume,
+                Tags: tags(context),
+            }),
+        },
+        lost: assume === undefined ? ["assume_role_policy"] : [],
+    };
+}
+/** The IAM resources that attach policy to a role declared elsewhere. */
+export const iamRoleFolds = new Map([
+    [
+        "aws_iam_role_policy",
+        {
+            parentAttribute: "role",
+            properties: inlinePolicy,
+            lost: inlinePolicyLost,
+        },
+    ],
+    [
+        "aws_iam_role_policy_attachment",
+        { parentAttribute: "role", properties: managedPolicy },
+    ],
+]);
+function managedPolicy(context) {
+    const arn = attribute(context, "policy_arn");
+    return arn === undefined ? {} : { ManagedPolicyArns: [arn] };
+}
+//# sourceMappingURL=sim-tf-map-iam.js.map

package/dist/terraform/map/sim-tf-map-iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-iam.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-iam.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,SAAS,EACT,KAAK,EACL,UAAU,EACV,OAAO,EACP,IAAI,GAEL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,4BAA4B,CAAC;AAMpC,mEAAmE;AACnE,MAAM,UAAU,OAAO,CACrB,OAAgC;IAEhC,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC,CACrD,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACzC,GAAG,UAAU,CAAC;gBACZ,wBAAwB,EAAE,MAAM;gBAChC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;aACpB,CAAC;SACH;QACD,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE;KACzD,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAA+C,IAAI,GAAG,CAG7E;IACA;QACE,qBAAqB;QACrB;YACE,eAAe,EAAE,MAAM;YACvB,UAAU,EAAE,YAAY;YACxB,IAAI,EAAE,gBAAgB;SACvB;KACF;IACD;QACE,gCAAgC;QAChC,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE;KACvD;CACF,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,OAAgC;IAEhC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE7C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/terraform/map/sim-tf-map-kms.d.ts

@@ -0,0 +1,25 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/**
+ * A key.
+ *
+ * Terraform spells the key spec `customer_master_key_spec`, which is the name
+ * the KMS API used before AWS renamed it, and CloudFormation carries the new
+ * one. `is_enabled` is CloudFormation's `Enabled`.
+ *
+ * Rotation and tags go across as they were written. Simulated KMS records both
+ * as properties a key is created without, rather than refusing them, so a key
+ * asking for rotation deploys and says on the Resource that its material never
+ * changes.
+ */
+export declare function kmsKey(context: TerraformMappingContext): TerraformMappedResource;
+/**
+ * An alias.
+ *
+ * Both properties are required, as they are on real CloudFormation. An alias
+ * with no name names nothing and one with no target points at nothing, so an
+ * alias whose key the template does not declare is left out rather than
+ * deployed into a failure that would take the Stack with it.
+ */
+export declare function kmsAlias(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-kms.d.ts.map

package/dist/terraform/map/sim-tf-map-kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-kms.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-kms.ts"],"names":[],"mappings":"AAOA,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAiBzB;AAmCD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CASzB"}

package/dist/terraform/map/sim-tf-map-kms.js

@@ -0,0 +1,75 @@
+import { field, properties, renamed, tags, } from "../sim-tf-attributes.js";
+/**
+ * A key.
+ *
+ * Terraform spells the key spec `customer_master_key_spec`, which is the name
+ * the KMS API used before AWS renamed it, and CloudFormation carries the new
+ * one. `is_enabled` is CloudFormation's `Enabled`.
+ *
+ * Rotation and tags go across as they were written. Simulated KMS records both
+ * as properties a key is created without, rather than refusing them, so a key
+ * asking for rotation deploys and says on the Resource that its material never
+ * changes.
+ */
+export function kmsKey(context) {
+    const policy = keyPolicy(context);
+    return {
+        Type: "AWS::KMS::Key",
+        Properties: {
+            ...renamed(context, {
+                Description: "description",
+                Enabled: "is_enabled",
+                KeySpec: "customer_master_key_spec",
+                KeyUsage: "key_usage",
+                EnableKeyRotation: "enable_key_rotation",
+            }),
+            ...properties({ KeyPolicy: policy, Tags: tags(context) }),
+        },
+        lost: policy === undefined && declaredPolicy(context) ? ["policy"] : [],
+    };
+}
+/**
+ * The key policy, which Terraform carries as a JSON string.
+ *
+ * A policy written with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, and its statements are gone with it. The reference behind it
+ * resolves to the ARN rather than to a document, so there is nothing to send
+ * and the attribute is recorded instead. A key created without a policy gets
+ * the default root delegation KMS applies, which is what a key declaring no
+ * policy gets anyway, so the key still exists and still encrypts.
+ */
+function keyPolicy(context) {
+    const policy = field(context.resource.values, "policy");
+    return typeof policy === "string" ? policy : undefined;
+}
+/**
+ * Whether the configuration wrote a policy the plan could not resolve.
+ *
+ * A key declaring no policy at all is unknown in the plan too, because KMS is
+ * the one that writes the default. That one is not lost: a key created here
+ * without a policy gets the same root delegation, so only a policy the
+ * configuration stated and the plan could not build is worth recording.
+ */
+function declaredPolicy(context) {
+    return (context.resource.unknown["policy"] === true &&
+        context.resource.expressions["policy"] !== undefined);
+}
+/**
+ * An alias.
+ *
+ * Both properties are required, as they are on real CloudFormation. An alias
+ * with no name names nothing and one with no target points at nothing, so an
+ * alias whose key the template does not declare is left out rather than
+ * deployed into a failure that would take the Stack with it.
+ */
+export function kmsAlias(context) {
+    return {
+        Type: "AWS::KMS::Alias",
+        Properties: renamed(context, {
+            AliasName: "name",
+            TargetKeyId: "target_key_id",
+        }),
+        requires: ["AliasName", "TargetKeyId"],
+    };
+}
+//# sourceMappingURL=sim-tf-map-kms.js.map

package/dist/terraform/map/sim-tf-map-kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-kms.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-kms.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,EACL,UAAU,EACV,OAAO,EACP,IAAI,GAEL,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CACpB,OAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,YAAY;gBACrB,OAAO,EAAE,0BAA0B;gBACnC,QAAQ,EAAE,WAAW;gBACrB,iBAAiB,EAAE,qBAAqB;aACzC,CAAC;YACF,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;SAC1D;QACD,IAAI,EAAE,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAChB,OAAgC;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAExD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,OAAgC;IACtD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI;QAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,SAAS,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,eAAe;SAC7B,CAAC;QACF,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;KACvC,CAAC;AACJ,CAAC"}

package/dist/terraform/map/sim-tf-map-lambda-environment.d.ts

@@ -0,0 +1,20 @@
+import type { SimCfnTemplateValue } from "../../service/cloudformation/template/value/sim-cfn-template-value.js";
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+/** What a function's environment came to, and what it cost to get there. */
+export interface TerraformLambdaEnvironment {
+    /** The CloudFormation property, or nothing to leave the property out. */
+    readonly property: SimCfnTemplateValue | undefined;
+    /** `environment.variables`, where the plan lost it and nothing filled it. */
+    readonly lost: readonly string[];
+}
+/**
+ * The environment variables a simulated function runs with.
+ *
+ * A map holding one reference to a resource of the same plan is unknown in its
+ * entirety, and the variable names go with it, so a deployment can supply the
+ * map against the function name the plan carries. What the plan resolved wins
+ * over what was supplied, variable by variable, which is what makes a
+ * configuration that later resolves the map stop needing the override.
+ */
+export declare function lambdaEnvironment(context: TerraformMappingContext): TerraformLambdaEnvironment;
+//# sourceMappingURL=sim-tf-map-lambda-environment.d.ts.map

package/dist/terraform/map/sim-tf-map-lambda-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-lambda-environment.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-lambda-environment.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AACjH,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACnD,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,uBAAuB,GAC/B,0BAA0B,CAc5B"}

package/dist/terraform/map/sim-tf-map-lambda-environment.js

@@ -0,0 +1,52 @@
+/*
+ * Reading a plan means reading records whose keys come from the document
+ * rather than from this code, so the object-injection rule fires on every
+ * lookup. The records are parsed JSON with no prototype of their own.
+ */
+// oxlint-disable security/detect-object-injection
+import { isRecord } from "../../util/type-guard/record.js";
+import { block, field, } from "../sim-tf-attributes.js";
+/**
+ * The environment variables a simulated function runs with.
+ *
+ * A map holding one reference to a resource of the same plan is unknown in its
+ * entirety, and the variable names go with it, so a deployment can supply the
+ * map against the function name the plan carries. What the plan resolved wins
+ * over what was supplied, variable by variable, which is what makes a
+ * configuration that later resolves the map stop needing the override.
+ */
+export function lambdaEnvironment(context) {
+    const supplied = context.overrides.environment(field(context.resource.values, "function_name"));
+    const variables = { ...supplied, ...plannedVariables(context) };
+    if (Object.keys(variables).length > 0) {
+        return { property: { Variables: variables }, lost: [] };
+    }
+    return {
+        property: undefined,
+        lost: collapsed(context) ? ["environment.variables"] : [],
+    };
+}
+/** The variables the plan itself resolved, which is usually none of them. */
+function plannedVariables(context) {
+    const environment = block(context, "environment");
+    const variables = environment && field(environment, "variables");
+    return isRecord(variables) ? variables : {};
+}
+/**
+ * Whether Terraform marked the whole variables map unknown.
+ *
+ * A function declaring no environment at all has lost nothing. One whose map
+ * collapsed has lost names this cannot know, which is the case an override is
+ * for.
+ *
+ * The map goes whole or not at all. Terraform 1.15.8 against AWS provider
+ * 5.100.0 writes `"variables": true` for a map holding one literal and one
+ * reference to a resource of the same plan, so there is no per-variable form
+ * of this to read.
+ */
+function collapsed(context) {
+    const declared = field(context.resource.unknown, "environment");
+    const entries = Array.isArray(declared) ? declared : [];
+    return isRecord(entries[0]) && field(entries[0], "variables") === true;
+}
+//# sourceMappingURL=sim-tf-map-lambda-environment.js.map

package/dist/terraform/map/sim-tf-map-lambda-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-lambda-environment.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-lambda-environment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,kDAAkD;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAE3D,OAAO,EACL,KAAK,EACL,KAAK,GAEN,MAAM,yBAAyB,CAAC;AAUjC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAgC;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAC5C,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAChD,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,gBAAgB,CACvB,OAAgC;IAEhC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAEjE,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,SAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,OAAgC;IACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,OAAO,GAAuB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,IAAI,CAAC;AACzE,CAAC"}

package/dist/terraform/map/sim-tf-map-lambda.d.ts

@@ -0,0 +1,19 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/**
+ * A function, minus its code.
+ *
+ * Terraform points at a zip on disk, an S3 object or a container image, and
+ * none of the three is a handler Yulin can run. A simulated function takes its
+ * behaviour from a deploy binding instead, matched on the function name the
+ * template carries.
+ */
+export declare function lambdaFunction(context: TerraformMappingContext): TerraformMappedResource;
+/** One permission to invoke a function. */
+export declare function lambdaPermission(context: TerraformMappingContext): TerraformMappedResource;
+/**
+ * An event source mapping. Simulated Lambda checks the execution role is
+ * allowed to poll the source, so a role whose policy the plan lost fails here.
+ */
+export declare function lambdaEventSourceMapping(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-lambda.d.ts.map

package/dist/terraform/map/sim-tf-map-lambda.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-lambda.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-lambda.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAiCzB;AAED,2CAA2C;AAC3C,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAWzB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAWzB"}

package/dist/terraform/map/sim-tf-map-lambda.js

@@ -0,0 +1,73 @@
+import { properties, renamed, tags, } from "../sim-tf-attributes.js";
+import { lambdaEnvironment } from "./sim-tf-map-lambda-environment.js";
+/**
+ * A function, minus its code.
+ *
+ * Terraform points at a zip on disk, an S3 object or a container image, and
+ * none of the three is a handler Yulin can run. A simulated function takes its
+ * behaviour from a deploy binding instead, matched on the function name the
+ * template carries.
+ */
+export function lambdaFunction(context) {
+    const environment = lambdaEnvironment(context);
+    return {
+        Type: "AWS::Lambda::Function",
+        Properties: {
+            ...renamed(context, {
+                FunctionName: "function_name",
+                Handler: "handler",
+                Runtime: "runtime",
+                Role: "role",
+                Timeout: "timeout",
+                MemorySize: "memory_size",
+            }),
+            ...properties({
+                Environment: environment.property,
+                Tags: tags(context),
+            }),
+        },
+        /*
+         * The code is always lost, since a plan points at a zip, an S3 object or
+         * an image. The environment joins it only where the plan collapsed the
+         * variables map and no override supplied one.
+         */
+        lost: ["code", ...environment.lost],
+        /*
+         * A function whose execution role the plan does not create, such as one
+         * read out of a data source, has no role for the template to name. Sim
+         * Lambda refuses a function without one, so the function is left out and
+         * recorded rather than failing the Stack around it.
+         */
+        requires: ["Role"],
+    };
+}
+/** One permission to invoke a function. */
+export function lambdaPermission(context) {
+    return {
+        Type: "AWS::Lambda::Permission",
+        Properties: renamed(context, {
+            FunctionName: "function_name",
+            Action: "action",
+            Principal: "principal",
+            SourceArn: "source_arn",
+        }),
+        requires: ["FunctionName", "Action", "Principal"],
+    };
+}
+/**
+ * An event source mapping. Simulated Lambda checks the execution role is
+ * allowed to poll the source, so a role whose policy the plan lost fails here.
+ */
+export function lambdaEventSourceMapping(context) {
+    return {
+        Type: "AWS::Lambda::EventSourceMapping",
+        Properties: renamed(context, {
+            EventSourceArn: "event_source_arn",
+            FunctionName: "function_name",
+            BatchSize: "batch_size",
+            Enabled: "enabled",
+        }),
+        requires: ["EventSourceArn", "FunctionName"],
+    };
+}
+//# sourceMappingURL=sim-tf-map-lambda.js.map

package/dist/terraform/map/sim-tf-map-lambda.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-lambda.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-lambda.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,OAAO,EACP,IAAI,GAEL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAGvE;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAgC;IAEhC,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE;gBAClB,YAAY,EAAE,eAAe;gBAC7B,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,aAAa;aAC1B,CAAC;YACF,GAAG,UAAU,CAAC;gBACZ,WAAW,EAAE,WAAW,CAAC,QAAQ;gBACjC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;aACpB,CAAC;SACH;QACD;;;;WAIG;QACH,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QACnC;;;;;WAKG;QACH,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,YAAY,EAAE,eAAe;YAC7B,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,WAAW;YACtB,SAAS,EAAE,YAAY;SACxB,CAAC;QACF,QAAQ,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,iCAAiC;QACvC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,eAAe;YAC7B,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,SAAS;SACnB,CAAC;QACF,QAAQ,EAAE,CAAC,gBAAgB,EAAE,cAAc,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/terraform/map/sim-tf-map-logs.d.ts

@@ -0,0 +1,12 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/**
+ * A log group.
+ *
+ * Terraform spells "never expire" as a retention of zero, and simulated
+ * CloudWatch Logs refuses a `RetentionInDays` of zero the way real
+ * CloudFormation does. A group configured to keep its logs forever is one
+ * declaring no retention at all.
+ */
+export declare function logGroup(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-logs.d.ts.map

package/dist/terraform/map/sim-tf-map-logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-logs.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAYzB"}