@kensio/yulin 1.19.2 → 1.19.3

package/dist/terraform/map/sim-tf-map-lambda-environment.js

@@ -0,0 +1,52 @@
+/*
+ * Reading a plan means reading records whose keys come from the document
+ * rather than from this code, so the object-injection rule fires on every
+ * lookup. The records are parsed JSON with no prototype of their own.
+ */
+// oxlint-disable security/detect-object-injection
+import { isRecord } from "../../util/type-guard/record.js";
+import { block, field, } from "../sim-tf-attributes.js";
+/**
+ * The environment variables a simulated function runs with.
+ *
+ * A map holding one reference to a resource of the same plan is unknown in its
+ * entirety, and the variable names go with it, so a deployment can supply the
+ * map against the function name the plan carries. What the plan resolved wins
+ * over what was supplied, variable by variable, which is what makes a
+ * configuration that later resolves the map stop needing the override.
+ */
+export function lambdaEnvironment(context) {
+    const supplied = context.overrides.environment(field(context.resource.values, "function_name"));
+    const variables = { ...supplied, ...plannedVariables(context) };
+    if (Object.keys(variables).length > 0) {
+        return { property: { Variables: variables }, lost: [] };
+    }
+    return {
+        property: undefined,
+        lost: collapsed(context) ? ["environment.variables"] : [],
+    };
+}
+/** The variables the plan itself resolved, which is usually none of them. */
+function plannedVariables(context) {
+    const environment = block(context, "environment");
+    const variables = environment && field(environment, "variables");
+    return isRecord(variables) ? variables : {};
+}
+/**
+ * Whether Terraform marked the whole variables map unknown.
+ *
+ * A function declaring no environment at all has lost nothing. One whose map
+ * collapsed has lost names this cannot know, which is the case an override is
+ * for.
+ *
+ * The map goes whole or not at all. Terraform 1.15.8 against AWS provider
+ * 5.100.0 writes `"variables": true` for a map holding one literal and one
+ * reference to a resource of the same plan, so there is no per-variable form
+ * of this to read.
+ */
+function collapsed(context) {
+    const declared = field(context.resource.unknown, "environment");
+    const entries = Array.isArray(declared) ? declared : [];
+    return isRecord(entries[0]) && field(entries[0], "variables") === true;
+}
+//# sourceMappingURL=sim-tf-map-lambda-environment.js.map

package/dist/terraform/map/sim-tf-map-lambda-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-lambda-environment.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-lambda-environment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,kDAAkD;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAE3D,OAAO,EACL,KAAK,EACL,KAAK,GAEN,MAAM,yBAAyB,CAAC;AAUjC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAgC;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAC5C,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAChD,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,gBAAgB,CACvB,OAAgC;IAEhC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAEjE,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,SAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,OAAgC;IACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,OAAO,GAAuB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,IAAI,CAAC;AACzE,CAAC"}

package/dist/{service/cloudformation/terraform → terraform/map}/sim-tf-map-lambda.d.ts

@@ -1,5 +1,5 @@
-import { type TerraformMappingContext } from "./sim-tf-attributes.js";
-import type { TerraformMappedResource } from "./sim-tf-mapping.type.js";
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
 /**
  * A function, minus its code.
  *

package/dist/terraform/map/sim-tf-map-lambda.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-lambda.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-lambda.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAiCzB;AAED,2CAA2C;AAC3C,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAWzB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAWzB"}

package/dist/{service/cloudformation/terraform → terraform/map}/sim-tf-map-lambda.js

@@ -1,11 +1,5 @@
-/*
- * Reading a plan means reading records whose keys come from the document
- * rather than from this code, so the object-injection rule fires on every
- * lookup. The records are parsed JSON with no prototype of their own.
- */
-// oxlint-disable security/detect-object-injection
-import { isRecord } from "../../../util/type-guard/record.js";
-import { block, field, properties, renamed, tags, templateValue, } from "./sim-tf-attributes.js";
+import { properties, renamed, tags, } from "../sim-tf-attributes.js";
+import { lambdaEnvironment } from "./sim-tf-map-lambda-environment.js";
 /**
  * A function, minus its code.
  *
@@ -15,7 +9,7 @@ import { block, field, properties, renamed, tags, templateValue, } from "./sim-t
  * template carries.
  */
 export function lambdaFunction(context) {
-    const variables = environmentVariables(context);
+    const environment = lambdaEnvironment(context);
     return {
         Type: "AWS::Lambda::Function",
         Properties: {
@@ -28,38 +22,25 @@ export function lambdaFunction(context) {
                 MemorySize: "memory_size",
             }),
             ...properties({
-                Environment: variables && { Variables: variables },
+                Environment: environment.property,
                 Tags: tags(context),
             }),
         },
-        lost: lost(context, variables),
+        /*
+         * The code is always lost, since a plan points at a zip, an S3 object or
+         * an image. The environment joins it only where the plan collapsed the
+         * variables map and no override supplied one.
+         */
+        lost: ["code", ...environment.lost],
+        /*
+         * A function whose execution role the plan does not create, such as one
+         * read out of a data source, has no role for the template to name. Sim
+         * Lambda refuses a function without one, so the function is left out and
+         * recorded rather than failing the Stack around it.
+         */
+        requires: ["Role"],
     };
 }
-function environmentVariables(context) {
-    const environment = block(context, "environment");
-    const variables = environment && field(environment, "variables");
-    if (!isRecord(variables)) {
-        return undefined;
-    }
-    const value = templateValue(variables);
-    return value;
-}
-/**
- * What the mapping could not carry.
- *
- * The code is always one. The environment variables are another whenever any
- * value in the map names a resource of the same plan, because Terraform marks
- * the whole map unknown and the variable names go with it.
- */
-function lost(context, variables) {
-    const declared = field(context.resource.unknown, "environment");
-    const entries = Array.isArray(declared) ? declared : [];
-    const first = entries[0];
-    const collapsed = isRecord(first) &&
-        field(first, "variables") === true &&
-        variables === undefined;
-    return collapsed ? ["code", "environment.variables"] : ["code"];
-}
 /** One permission to invoke a function. */
 export function lambdaPermission(context) {
     return {
@@ -70,6 +51,7 @@ export function lambdaPermission(context) {
             Principal: "principal",
             SourceArn: "source_arn",
         }),
+        requires: ["FunctionName", "Action", "Principal"],
     };
 }
 /**
@@ -85,6 +67,7 @@ export function lambdaEventSourceMapping(context) {
             BatchSize: "batch_size",
             Enabled: "enabled",
         }),
+        requires: ["EventSourceArn", "FunctionName"],
     };
 }
 //# sourceMappingURL=sim-tf-map-lambda.js.map

package/dist/terraform/map/sim-tf-map-lambda.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-lambda.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-lambda.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,OAAO,EACP,IAAI,GAEL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAGvE;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAgC;IAEhC,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE;gBAClB,YAAY,EAAE,eAAe;gBAC7B,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,aAAa;aAC1B,CAAC;YACF,GAAG,UAAU,CAAC;gBACZ,WAAW,EAAE,WAAW,CAAC,QAAQ;gBACjC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;aACpB,CAAC;SACH;QACD;;;;WAIG;QACH,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QACnC;;;;;WAKG;QACH,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,YAAY,EAAE,eAAe;YAC7B,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,WAAW;YACtB,SAAS,EAAE,YAAY;SACxB,CAAC;QACF,QAAQ,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,iCAAiC;QACvC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,eAAe;YAC7B,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,SAAS;SACnB,CAAC;QACF,QAAQ,EAAE,CAAC,gBAAgB,EAAE,cAAc,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/terraform/map/sim-tf-map-logs.d.ts

@@ -0,0 +1,12 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/**
+ * A log group.
+ *
+ * Terraform spells "never expire" as a retention of zero, and simulated
+ * CloudWatch Logs refuses a `RetentionInDays` of zero the way real
+ * CloudFormation does. A group configured to keep its logs forever is one
+ * declaring no retention at all.
+ */
+export declare function logGroup(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-logs.d.ts.map

package/dist/terraform/map/sim-tf-map-logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-logs.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAYzB"}

package/dist/terraform/map/sim-tf-map-logs.js

@@ -0,0 +1,22 @@
+import { attribute, properties, renamed, } from "../sim-tf-attributes.js";
+/**
+ * A log group.
+ *
+ * Terraform spells "never expire" as a retention of zero, and simulated
+ * CloudWatch Logs refuses a `RetentionInDays` of zero the way real
+ * CloudFormation does. A group configured to keep its logs forever is one
+ * declaring no retention at all.
+ */
+export function logGroup(context) {
+    const retention = attribute(context, "retention_in_days");
+    return {
+        Type: "AWS::Logs::LogGroup",
+        Properties: {
+            ...renamed(context, { LogGroupName: "name" }),
+            ...properties({
+                RetentionInDays: retention === 0 ? undefined : retention,
+            }),
+        },
+    };
+}
+//# sourceMappingURL=sim-tf-map-logs.js.map

package/dist/terraform/map/sim-tf-map-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-logs.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-logs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,OAAO,GAER,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAgC;IAEhC,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YAC7C,GAAG,UAAU,CAAC;gBACZ,eAAe,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aACzD,CAAC;SACH;KACF,CAAC;AACJ,CAAC"}

package/dist/{service/cloudformation/terraform → terraform/map}/sim-tf-map-s3-folds.d.ts

@@ -1,4 +1,4 @@
-import type { TerraformResourceFold } from "./sim-tf-mapping.type.js";
+import type { TerraformResourceFold } from "../sim-tf-mapping.type.js";
 /**
  * The `aws_s3_bucket_*` resources that configure a bucket declared elsewhere.
  *

package/dist/terraform/map/sim-tf-map-s3-folds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-folds.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-folds.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAkBjE,CAAC"}

package/dist/{service/cloudformation/terraform → terraform/map}/sim-tf-map-s3-folds.js

@@ -1,6 +1,5 @@
-import { block, field, renamed, } from "./sim-tf-attributes.js";
-import { cors } from "./sim-tf-map-s3-cors.js";
-import { encryption } from "./sim-tf-map-s3-encryption.js";
+import { block, field, renamed, } from "../sim-tf-attributes.js";
+import { cors, encryption } from "./sim-tf-map-s3-rules.js";
 /**
  * The `aws_s3_bucket_*` resources that configure a bucket declared elsewhere.
  *

package/dist/terraform/map/sim-tf-map-s3-folds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-folds.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-folds.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,EACL,KAAK,EACL,OAAO,GAER,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GACxB,IAAI,GAAG,CAAC;IACN;QACE,0BAA0B;QAC1B,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE;KACtD;IACD;QACE,mCAAmC;QACnC,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE;KACxD;IACD;QACE,kCAAkC;QAClC,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;KAChD;IACD;QACE,oDAAoD;QACpD,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE;KACtD;CACF,CAAC,CAAC;AAEL,SAAS,UAAU,CACjB,OAAgC;IAEhC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IAE9D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC;IAE1D,OAAO;QACL,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,OAAgC;IAEhC,OAAO;QACL,8BAA8B,EAAE,OAAO,CAAC,OAAO,EAAE;YAC/C,eAAe,EAAE,mBAAmB;YACpC,iBAAiB,EAAE,qBAAqB;YACxC,gBAAgB,EAAE,oBAAoB;YACtC,qBAAqB,EAAE,yBAAyB;SACjD,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/terraform/map/sim-tf-map-s3-lifecycle.d.ts

@@ -0,0 +1,4 @@
+import type { TerraformResourceFold } from "../sim-tf-mapping.type.js";
+/** The resource that configures a bucket's lifecycle rules. */
+export declare const s3LifecycleFolds: ReadonlyMap<string, TerraformResourceFold>;
+//# sourceMappingURL=sim-tf-map-s3-lifecycle.d.ts.map

package/dist/terraform/map/sim-tf-map-s3-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-lifecycle.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAMpE,CAAC"}

package/dist/terraform/map/sim-tf-map-s3-lifecycle.js

@@ -0,0 +1,92 @@
+/*
+ * The bucket lifecycle configuration, which the provider declares as a
+ * resource of its own and CloudFormation carries on the bucket.
+ *
+ * Simulated S3 expires and transitions nothing, and records the whole
+ * `LifecycleConfiguration` property against the Resource as one it does not act
+ * on. The rules are carried across so that record names what the bucket was
+ * asked for, rather than the resource being skipped and the configuration
+ * disappearing from the report.
+ *
+ * Reading a plan means reading records whose keys come from the document
+ * rather than from this code, so the object-injection rule fires on every
+ * lookup. The records are parsed JSON with no prototype of their own.
+ */
+// oxlint-disable security/detect-object-injection
+import { isRecord } from "../../util/type-guard/record.js";
+import { blocks, field, properties, } from "../sim-tf-attributes.js";
+/** The resource that configures a bucket's lifecycle rules. */
+export const s3LifecycleFolds = new Map([
+    [
+        "aws_s3_bucket_lifecycle_configuration",
+        { parentAttribute: "bucket", properties: bucketLifecycle },
+    ],
+]);
+/** The lifecycle rules a bucket is deployed with. */
+function bucketLifecycle(context) {
+    const rules = blocks(context, "rule").map((rule) => lifecycleRule(rule));
+    return rules.length === 0 ? {} : { LifecycleConfiguration: { Rules: rules } };
+}
+function lifecycleRule(rule) {
+    const expiration = firstBlock(rule, "expiration");
+    const noncurrent = firstBlock(rule, "noncurrent_version_expiration");
+    const abortAfter = number(firstBlock(rule, "abort_incomplete_multipart_upload"), "days_after_initiation");
+    return properties({
+        Id: text(rule, "id"),
+        Status: text(rule, "status"),
+        Prefix: text(rule, "prefix") ?? filterPrefix(rule),
+        ExpirationInDays: number(expiration, "days"),
+        ExpirationDate: text(expiration, "date"),
+        NoncurrentVersionExpirationInDays: number(noncurrent, "noncurrent_days"),
+        AbortIncompleteMultipartUpload: abortAfter === undefined
+            ? undefined
+            : { DaysAfterInitiation: abortAfter },
+        Transitions: transitions(rule),
+    });
+}
+/**
+ * The prefix a rule matches on, where it was written as a filter.
+ *
+ * The provider takes a prefix either as the rule's own deprecated attribute or
+ * inside a `filter` block, and CloudFormation has the one `Prefix`.
+ */
+function filterPrefix(rule) {
+    return text(firstBlock(rule, "filter"), "prefix");
+}
+/** The storage class changes a rule asks for, as CloudFormation lists them. */
+function transitions(rule) {
+    const declared = field(rule, "transition");
+    const entries = (Array.isArray(declared) ? declared : [])
+        .filter((entry) => isRecord(entry))
+        .map((entry) => properties({
+        StorageClass: text(entry, "storage_class"),
+        TransitionInDays: number(entry, "days"),
+        TransitionDate: text(entry, "date"),
+    }));
+    return entries.length === 0 ? undefined : entries;
+}
+/**
+ * One entry of a nested block, which the plan represents as a list even where
+ * the schema allows only one.
+ */
+function firstBlock(record, key) {
+    const declared = record === undefined ? undefined : field(record, key);
+    const [first] = Array.isArray(declared) ? declared : [];
+    return isRecord(first) ? first : undefined;
+}
+/**
+ * A string field of a block, where the provider wrote one.
+ *
+ * An absent optional string inside a nested block arrives as an empty string
+ * rather than as null, and a rule carrying an empty `Prefix` matches every
+ * object rather than none.
+ */
+function text(record, key) {
+    const value = record === undefined ? undefined : field(record, key);
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function number(record, key) {
+    const value = record === undefined ? undefined : field(record, key);
+    return typeof value === "number" ? value : undefined;
+}
+//# sourceMappingURL=sim-tf-map-s3-lifecycle.js.map

package/dist/terraform/map/sim-tf-map-s3-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-lifecycle.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,kDAAkD;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAE3D,OAAO,EACL,MAAM,EACN,KAAK,EACL,UAAU,GAEX,MAAM,yBAAyB,CAAC;AAGjC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAC3B,IAAI,GAAG,CAAC;IACN;QACE,uCAAuC;QACvC,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE;KAC3D;CACF,CAAC,CAAC;AAEL,qDAAqD;AACrD,SAAS,eAAe,CACtB,OAAgC;IAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CACvB,UAAU,CAAC,IAAI,EAAE,mCAAmC,CAAC,EACrD,uBAAuB,CACxB,CAAC;IAEF,OAAO,UAAU,CAAC;QAChB,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC5B,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC;QAClD,gBAAgB,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5C,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC;QACxC,iCAAiC,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC;QACxE,8BAA8B,EAC5B,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,EAAE;QACzC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAA6B;IACjD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAClB,IAA6B;IAE7B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC;QAC1C,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;KACpC,CAAC,CACH,CAAC;IAEJ,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,MAA2C,EAC3C,GAAW;IAEX,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,IAAI,CACX,MAA2C,EAC3C,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEpE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,MAAM,CACb,MAA2C,EAC3C,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEpE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/terraform/map/sim-tf-map-s3-notification-destinations.d.ts

@@ -0,0 +1,5 @@
+import type { SimCfnTemplateValue } from "../../service/cloudformation/template/value/sim-cfn-template-value.js";
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+/** Every destination the bucket sends to, grouped by the service it names. */
+export declare function notificationConfiguration(context: TerraformMappingContext): SimCfnTemplateValue | undefined;
+//# sourceMappingURL=sim-tf-map-s3-notification-destinations.d.ts.map

package/dist/terraform/map/sim-tf-map-s3-notification-destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-notification-destinations.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-notification-destinations.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AACjH,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAWjC,8EAA8E;AAC9E,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,uBAAuB,GAC/B,mBAAmB,GAAG,SAAS,CAWjC"}

package/dist/terraform/map/sim-tf-map-s3-notification-destinations.js

@@ -0,0 +1,30 @@
+import { blocks, field, properties, } from "../sim-tf-attributes.js";
+import { blockAttribute } from "../sim-tf-nested-attributes.js";
+import { notificationDestinations, } from "./sim-tf-map-s3-notification.js";
+import { notificationKeyFilter, notificationText, } from "./sim-tf-map-s3-notification-filter.js";
+/** Every destination the bucket sends to, grouped by the service it names. */
+export function notificationConfiguration(context) {
+    const configuration = properties(Object.fromEntries(notificationDestinations.map((destination) => [
+        destination.property,
+        entries(context, destination),
+    ])));
+    return Object.keys(configuration).length === 0 ? undefined : configuration;
+}
+/** One destination's entries, each naming the events it wants. */
+function entries(context, destination) {
+    const declared = blocks(context, destination.block).flatMap((entry, index) => {
+        const arn = blockAttribute(context, destination.block, index, destination.destination);
+        return arn === undefined
+            ? []
+            : [
+                properties({
+                    Id: notificationText(entry, "id"),
+                    [destination.arn]: arn,
+                    Events: field(entry, "events"),
+                    Filter: notificationKeyFilter(entry),
+                }),
+            ];
+    });
+    return declared.length === 0 ? undefined : declared;
+}
+//# sourceMappingURL=sim-tf-map-s3-notification-destinations.js.map

package/dist/terraform/map/sim-tf-map-s3-notification-destinations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-notification-destinations.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-notification-destinations.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,MAAM,EACN,KAAK,EACL,UAAU,GAEX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EACL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wCAAwC,CAAC;AAEhD,8EAA8E;AAC9E,MAAM,UAAU,yBAAyB,CACvC,OAAgC;IAEhC,MAAM,aAAa,GAAG,UAAU,CAC9B,MAAM,CAAC,WAAW,CAChB,wBAAwB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5C,WAAW,CAAC,QAAQ;QACpB,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC;KAC9B,CAAC,CACH,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;AAC7E,CAAC;AAED,kEAAkE;AAClE,SAAS,OAAO,CACd,OAAgC,EAChC,WAAoC;IAEpC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,CACzD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,cAAc,CACxB,OAAO,EACP,WAAW,CAAC,KAAK,EACjB,KAAK,EACL,WAAW,CAAC,WAAW,CACxB,CAAC;QAEF,OAAO,GAAG,KAAK,SAAS;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,UAAU,CAAC;oBACT,EAAE,EAAE,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC;oBACjC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG;oBACtB,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAwB;oBACrD,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC;iBACrC,CAAC;aACH,CAAC;IACR,CAAC,CACF,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC"}

package/dist/terraform/map/sim-tf-map-s3-notification-filter.d.ts

@@ -0,0 +1,12 @@
+import type { SimCfnTemplateValue } from "../../service/cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * The object key filter, from the prefix and suffix Terraform states apart.
+ *
+ * An absent optional string inside a nested block arrives as an empty string
+ * rather than as null, and a rule matching the empty prefix matches every
+ * object, which is what a filter is written to stop.
+ */
+export declare function notificationKeyFilter(entry: Record<string, unknown>): SimCfnTemplateValue | undefined;
+/** A string field of a block, where the provider wrote anything in it. */
+export declare function notificationText(entry: Record<string, unknown>, key: string): string | undefined;
+//# sourceMappingURL=sim-tf-map-s3-notification-filter.d.ts.map

package/dist/terraform/map/sim-tf-map-s3-notification-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-notification-filter.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-notification-filter.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AAGjH;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,mBAAmB,GAAG,SAAS,CASjC;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAIpB"}

package/dist/terraform/map/sim-tf-map-s3-notification-filter.js

@@ -0,0 +1,21 @@
+import { field } from "../sim-tf-attributes.js";
+/**
+ * The object key filter, from the prefix and suffix Terraform states apart.
+ *
+ * An absent optional string inside a nested block arrives as an empty string
+ * rather than as null, and a rule matching the empty prefix matches every
+ * object, which is what a filter is written to stop.
+ */
+export function notificationKeyFilter(entry) {
+    const rules = [
+        { Name: "prefix", Value: notificationText(entry, "filter_prefix") },
+        { Name: "suffix", Value: notificationText(entry, "filter_suffix") },
+    ].filter((rule) => rule.Value !== undefined);
+    return rules.length === 0 ? undefined : { Key: { FilterRules: rules } };
+}
+/** A string field of a block, where the provider wrote anything in it. */
+export function notificationText(entry, key) {
+    const value = field(entry, key);
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=sim-tf-map-s3-notification-filter.js.map

package/dist/terraform/map/sim-tf-map-s3-notification-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-notification-filter.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-notification-filter.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA8B;IAE9B,MAAM,KAAK,GAAG;QACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE;QACnE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE;KACpE,CAAC,MAAM,CACN,CAAC,IAAI,EAA2C,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAC5E,CAAC;IAEF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,KAA8B,EAC9B,GAAW;IAEX,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEhC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC"}

package/dist/terraform/map/sim-tf-map-s3-notification.d.ts

@@ -0,0 +1,50 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/**
+ * The three destination blocks, and what the request calls each of them.
+ *
+ * `destination` is the Terraform attribute holding the ARN, and `arn` is the
+ * key it is written under, which repeats the service's name on all three.
+ */
+export declare const notificationDestinations: readonly [{
+    readonly block: "lambda_function";
+    readonly destination: "lambda_function_arn";
+    readonly property: "LambdaFunctionConfigurations";
+    readonly arn: "LambdaFunctionArn";
+}, {
+    readonly block: "queue";
+    readonly destination: "queue_arn";
+    readonly property: "QueueConfigurations";
+    readonly arn: "QueueArn";
+}, {
+    readonly block: "topic";
+    readonly destination: "topic_arn";
+    readonly property: "TopicConfigurations";
+    readonly arn: "TopicArn";
+}];
+export interface NotificationDestination {
+    readonly block: string;
+    readonly destination: string;
+    readonly property: string;
+    readonly arn: string;
+}
+/**
+ * The notification configuration a bucket is deployed with.
+ *
+ * This is a Resource of its own rather than a bucket property, for the reason
+ * CDK gives it one as well. A function's `AWS::Lambda::Permission` names the
+ * bucket whose events it admits, so a bucket naming the function back is a
+ * circular dependency CloudFormation refuses. Terraform declares the same three
+ * resources and has no cycle, because the notification sits between them, and
+ * `Custom::S3BucketNotifications` is that resource here. Simulated
+ * CloudFormation applies one with a single
+ * PutBucketNotificationConfiguration call, after everything the plan declared
+ * it to come after.
+ *
+ * The Resource carries the SDK request shape rather than the CloudFormation
+ * one, which is what CDK's own provider function is handed, and it is the
+ * closer of the two to what Terraform writes: a list of events per destination
+ * rather than one configuration per event.
+ */
+export declare function bucketNotification(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-s3-notification.d.ts.map

package/dist/terraform/map/sim-tf-map-s3-notification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-notification.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-notification.ts"],"names":[],"mappings":"AAIA,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAIzE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;aAEjC,KAAK,EAAE,iBAAiB;aACxB,WAAW,EAAE,qBAAqB;aAClC,QAAQ,EAAE,8BAA8B;aACxC,GAAG,EAAE,mBAAmB;;aAGxB,KAAK,EAAE,OAAO;aACd,WAAW,EAAE,WAAW;aACxB,QAAQ,EAAE,qBAAqB;aAC/B,GAAG,EAAE,UAAU;;aAGf,KAAK,EAAE,OAAO;aACd,WAAW,EAAE,WAAW;aACxB,QAAQ,EAAE,qBAAqB;aAC/B,GAAG,EAAE,UAAU;EAET,CAAC;AAEX,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAUzB"}

package/dist/terraform/map/sim-tf-map-s3-notification.js

@@ -0,0 +1,80 @@
+/*
+ * Where a bucket sends its events, which the provider declares as a resource
+ * of its own.
+ */
+import { attribute, blocks, field, properties, } from "../sim-tf-attributes.js";
+import { blockAttribute } from "../sim-tf-nested-attributes.js";
+import { notificationConfiguration } from "./sim-tf-map-s3-notification-destinations.js";
+/**
+ * The three destination blocks, and what the request calls each of them.
+ *
+ * `destination` is the Terraform attribute holding the ARN, and `arn` is the
+ * key it is written under, which repeats the service's name on all three.
+ */
+export const notificationDestinations = [
+    {
+        block: "lambda_function",
+        destination: "lambda_function_arn",
+        property: "LambdaFunctionConfigurations",
+        arn: "LambdaFunctionArn",
+    },
+    {
+        block: "queue",
+        destination: "queue_arn",
+        property: "QueueConfigurations",
+        arn: "QueueArn",
+    },
+    {
+        block: "topic",
+        destination: "topic_arn",
+        property: "TopicConfigurations",
+        arn: "TopicArn",
+    },
+];
+/**
+ * The notification configuration a bucket is deployed with.
+ *
+ * This is a Resource of its own rather than a bucket property, for the reason
+ * CDK gives it one as well. A function's `AWS::Lambda::Permission` names the
+ * bucket whose events it admits, so a bucket naming the function back is a
+ * circular dependency CloudFormation refuses. Terraform declares the same three
+ * resources and has no cycle, because the notification sits between them, and
+ * `Custom::S3BucketNotifications` is that resource here. Simulated
+ * CloudFormation applies one with a single
+ * PutBucketNotificationConfiguration call, after everything the plan declared
+ * it to come after.
+ *
+ * The Resource carries the SDK request shape rather than the CloudFormation
+ * one, which is what CDK's own provider function is handed, and it is the
+ * closer of the two to what Terraform writes: a list of events per destination
+ * rather than one configuration per event.
+ */
+export function bucketNotification(context) {
+    return {
+        Type: "Custom::S3BucketNotifications",
+        Properties: properties({
+            BucketName: attribute(context, "bucket"),
+            NotificationConfiguration: notificationConfiguration(context),
+        }),
+        requires: ["BucketName", "NotificationConfiguration"],
+        lost: notificationLost(context),
+    };
+}
+/**
+ * What the notification configuration could not carry across.
+ *
+ * A destination whose ARN the plan left unresolvable is dropped, since a
+ * configuration naming nothing would raise its events at nothing. EventBridge
+ * delivery is dropped too: simulated S3 refuses an `EventBridgeConfiguration`
+ * by name rather than accepting one it would never deliver through.
+ */
+function notificationLost(context) {
+    const dropped = notificationDestinations.filter((destination) => blocks(context, destination.block).some((_, index) => blockAttribute(context, destination.block, index, destination.destination) === undefined));
+    return [
+        ...dropped.map((destination) => destination.block),
+        ...(field(context.resource.values, "eventbridge") === true
+            ? ["eventbridge"]
+            : []),
+    ];
+}
+//# sourceMappingURL=sim-tf-map-s3-notification.js.map

package/dist/terraform/map/sim-tf-map-s3-notification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-notification.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-notification.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,SAAS,EACT,MAAM,EACN,KAAK,EACL,UAAU,GAEX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,qBAAqB;QAClC,QAAQ,EAAE,8BAA8B;QACxC,GAAG,EAAE,mBAAmB;KACzB;IACD;QACE,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,qBAAqB;QAC/B,GAAG,EAAE,UAAU;KAChB;IACD;QACE,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,qBAAqB;QAC/B,GAAG,EAAE,UAAU;KAChB;CACO,CAAC;AASX;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,UAAU,EAAE,UAAU,CAAC;YACrB,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC;YACxC,yBAAyB,EAAE,yBAAyB,CAAC,OAAO,CAAC;SAC9D,CAAC;QACF,QAAQ,EAAE,CAAC,YAAY,EAAE,2BAA2B,CAAC;QACrD,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9D,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CACX,cAAc,CACZ,OAAO,EACP,WAAW,CAAC,KAAK,EACjB,KAAK,EACL,WAAW,CAAC,WAAW,CACxB,KAAK,SAAS,CAClB,CACF,CAAC;IAEF,OAAO;QACL,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC;QAClD,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,IAAI;YACxD,CAAC,CAAC,CAAC,aAAa,CAAC;YACjB,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/terraform/map/sim-tf-map-s3-rules.d.ts

@@ -0,0 +1,7 @@
+import type { SimCfnTemplateValue } from "../../service/cloudformation/template/value/sim-cfn-template-value.js";
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+/** The CORS rules a bucket answers browser requests under. */
+export declare function cors(context: TerraformMappingContext): Record<string, SimCfnTemplateValue>;
+/** The default encryption a bucket applies, as CloudFormation declares it. */
+export declare function encryption(context: TerraformMappingContext): Record<string, SimCfnTemplateValue>;
+//# sourceMappingURL=sim-tf-map-s3-rules.d.ts.map

package/dist/terraform/map/sim-tf-map-s3-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-s3-rules.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-s3-rules.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AACjH,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,8DAA8D;AAC9D,wBAAgB,IAAI,CAClB,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAWrC;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CACxB,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAQrC"}

package/dist/{service/cloudformation/terraform/sim-tf-map-s3-encryption.js → terraform/map/sim-tf-map-s3-rules.js}

@@ -1,11 +1,28 @@
 /*
+ * The two bucket sections that are lists of rules rather than flat settings.
+ *
+ * Versioning and the public access block are renames. CORS and default
+ * encryption arrive as repeating Terraform blocks and CloudFormation holds
+ * each as a list of rules under a wrapper of its own, so both are rebuilt
+ * rather than carried across.
+ *
  * Reading a plan means reading records whose keys come from the document
  * rather than from this code, so the object-injection rule fires on every
  * lookup. The records are parsed JSON with no prototype of their own.
  */
 // oxlint-disable security/detect-object-injection
-import { isRecord } from "../../../util/type-guard/record.js";
-import { blocks, field, properties, } from "./sim-tf-attributes.js";
+import { isRecord } from "../../util/type-guard/record.js";
+import { blocks, field, properties, } from "../sim-tf-attributes.js";
+/** The CORS rules a bucket answers browser requests under. */
+export function cors(context) {
+    const rules = blocks(context, "cors_rule").map((rule) => properties({
+        AllowedHeaders: field(rule, "allowed_headers"),
+        AllowedMethods: field(rule, "allowed_methods"),
+        AllowedOrigins: field(rule, "allowed_origins"),
+        MaxAge: field(rule, "max_age_seconds"),
+    }));
+    return { CorsConfiguration: { CorsRules: rules } };
+}
 /** The default encryption a bucket applies, as CloudFormation declares it. */
 export function encryption(context) {
     return {
@@ -29,4 +46,4 @@ function encryptionRule(rule) {
         }),
     };
 }
-//# sourceMappingURL=sim-tf-map-s3-encryption.js.map
+//# sourceMappingURL=sim-tf-map-s3-rules.js.map