@kensio/yulin 1.19.2 → 1.19.4

package/dist/terraform/map/sim-tf-map-events.js

@@ -0,0 +1,151 @@
+/*
+ * Reading a plan means reading records whose keys come from the document
+ * rather than from this code, so the object-injection rule fires on every
+ * lookup. The records are parsed JSON with no prototype of their own.
+ */
+// oxlint-disable security/detect-object-injection
+import { isRecord } from "../../util/type-guard/record.js";
+import { attribute, properties, renamed, tags, } from "../sim-tf-attributes.js";
+/**
+ * A rule.
+ *
+ * Tags are left off. Simulated EventBridge refuses a `Tags` property outright,
+ * because a rule's tags never reach PutRule and a tagged rule would otherwise
+ * deploy and lose them without a word, so a rule carrying tags fails the Stack
+ * around it rather than only itself.
+ *
+ * Terraform carries the enabled state twice. `state` is the current spelling
+ * and `is_enabled` is the boolean the provider deprecated in favour of it.
+ */
+export function eventRule(context) {
+    const state = ruleState(context);
+    return {
+        Type: "AWS::Events::Rule",
+        Properties: {
+            ...renamed(context, {
+                Name: "name",
+                Description: "description",
+                ScheduleExpression: "schedule_expression",
+                EventBusName: "event_bus_name",
+            }),
+            ...properties({ State: state, EventPattern: eventPattern(context) }),
+        },
+        lost: [
+            ...(tags(context) === undefined ? [] : ["tags"]),
+            ...(state === undefined && attribute(context, "state") !== undefined
+                ? ["state"]
+                : []),
+        ],
+    };
+}
+/**
+ * Whether the rule matches events.
+ *
+ * `ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS` is left off and recorded.
+ * Simulated EventBridge refuses it, because nothing here delivers CloudTrail
+ * management events, and a rule in that state behaves exactly like an enabled
+ * one. Enabled is what it gets.
+ *
+ * `is_enabled` is read where the configuration used the older spelling. A rule
+ * deployed enabled that the plan disabled would fire on a schedule the
+ * configuration turned off.
+ */
+function ruleState(context) {
+    const state = attribute(context, "state");
+    if (state === "ENABLED" || state === "DISABLED") {
+        return state;
+    }
+    if (state === undefined && attribute(context, "is_enabled") === false) {
+        return "DISABLED";
+    }
+    return undefined;
+}
+/**
+ * The pattern the rule matches events against, which Terraform carries as a
+ * JSON string and CloudFormation as an object.
+ *
+ * Simulated EventBridge takes either, so a pattern the plan resolved goes
+ * across as it stands. One built around a resource of the same plan is unknown
+ * whole, and there is no pattern to send.
+ */
+function eventPattern(context) {
+    const pattern = attribute(context, "event_pattern");
+    return typeof pattern === "string" ? pattern : undefined;
+}
+/**
+ * The target resources, which Terraform declares apart from the rule they
+ * belong to.
+ *
+ * CloudFormation holds them as one `Targets` list on the rule, so each fold
+ * adds an entry to what is already there rather than replacing it. A rule with
+ * three targets is three Terraform resources and one `AWS::Events::Rule`.
+ */
+export const eventTargetFolds = new Map([
+    [
+        "aws_cloudwatch_event_target",
+        { parentAttribute: "rule", properties: target, lost: targetLost },
+    ],
+]);
+/**
+ * The ways a target can be configured that this fold does not carry.
+ *
+ * Simulated EventBridge refuses each of them by name on a Resource, so a
+ * target declaring one is added without it and the attribute recorded. Every
+ * one changes what the target receives or what happens when a delivery fails,
+ * which is the kind of difference a test would otherwise read as working.
+ */
+const unsimulatedTargetAttributes = [
+    "input_path",
+    "input_transformer",
+    "dead_letter_config",
+    "retry_policy",
+    "role_arn",
+];
+/**
+ * One entry of the rule's `Targets` list.
+ *
+ * A target whose ARN the plan could not resolve contributes nothing rather
+ * than an entry with no ARN, which is one simulated EventBridge refuses along
+ * with the whole rule. `target_id` is optional in Terraform and generated at
+ * apply time when it is left out, so a target with no id of its own is named
+ * after the resource declaring it, which is the identifier the plan does carry.
+ */
+function target(context, parent = {}) {
+    const arn = attribute(context, "arn");
+    if (arn === undefined) {
+        return {};
+    }
+    const entry = properties({
+        Id: attribute(context, "target_id") ?? context.resource.name,
+        Arn: arn,
+        Input: attribute(context, "input"),
+    });
+    return { Targets: [...existingTargets(parent), entry] };
+}
+/** The attributes of one target this fold could not carry across. */
+function targetLost(context) {
+    const configured = unsimulatedTargetAttributes.filter((name) => configuredValue(context.resource.values[name]));
+    return attribute(context, "arn") === undefined
+        ? ["arn", ...configured]
+        : configured;
+}
+/**
+ * Whether an attribute holds anything.
+ *
+ * The provider writes an absent nested block as an empty list and an absent
+ * top-level optional as null, so both spellings of "not configured" are here.
+ */
+function configuredValue(value) {
+    if (Array.isArray(value)) {
+        return value.length > 0;
+    }
+    return value !== null && value !== undefined;
+}
+/** The targets an earlier fold on the same rule already added. */
+function existingTargets(parent) {
+    const targets = parent["Targets"];
+    return Array.isArray(targets)
+        ? targets.filter((entry) => isRecord(entry))
+        : [];
+}
+//# sourceMappingURL=sim-tf-map-events.js.map

package/dist/terraform/map/sim-tf-map-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-events.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-events.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,kDAAkD;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAE3D,OAAO,EACL,SAAS,EACT,UAAU,EACV,OAAO,EACP,IAAI,GAEL,MAAM,yBAAyB,CAAC;AAMjC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CACvB,OAAgC;IAEhC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEjC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE;gBAClB,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,aAAa;gBAC1B,kBAAkB,EAAE,qBAAqB;gBACzC,YAAY,EAAE,gBAAgB;aAC/B,CAAC;YACF,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;SACrE;QACD,IAAI,EAAE;YACJ,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAChD,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,SAAS;gBAClE,CAAC,CAAC,CAAC,OAAO,CAAC;gBACX,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAChB,OAAgC;IAEhC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE1C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,KAAK,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CACnB,OAAgC;IAEhC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAEpD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,IAAI,GAAG,CAAC;IACN;QACE,6BAA6B;QAC7B,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;KAClE;CACF,CAAC,CAAC;AAEL;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG;IAClC,YAAY;IACZ,mBAAmB;IACnB,oBAAoB;IACpB,cAAc;IACd,UAAU;CACX,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,MAAM,CACb,OAAgC,EAChC,MAAM,GAAwC,EAAE;IAEhD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC5D,GAAG,EAAE,GAAG;QACR,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;KACnC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,OAAgC;IAClD,MAAM,UAAU,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7D,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAC/C,CAAC;IAEF,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,SAAS;QAC5C,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC;QACxB,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,kEAAkE;AAClE,SAAS,eAAe,CACtB,MAA2C;IAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAElC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;AACT,CAAC"}

package/dist/terraform/map/sim-tf-map-http-api-routes.d.ts

@@ -0,0 +1,10 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/**
+ * An integration. Its URI is the value a plan most often cannot resolve,
+ * because it names a function that does not exist yet.
+ */
+export declare function httpApiIntegration(context: TerraformMappingContext): TerraformMappedResource;
+/** A route, which needs the integration it targets to have been created. */
+export declare function httpApiRoute(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-http-api-routes.d.ts.map

package/dist/terraform/map/sim-tf-map-http-api-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-http-api-routes.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-http-api-routes.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAWzB;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAC1B,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAazB"}

package/dist/{service/cloudformation/terraform/sim-tf-map-http-api-route.js → terraform/map/sim-tf-map-http-api-routes.js}

@@ -1,4 +1,20 @@
-import { attribute, properties, renamed, } from "./sim-tf-attributes.js";
+import { attribute, properties, renamed, } from "../sim-tf-attributes.js";
+/**
+ * An integration. Its URI is the value a plan most often cannot resolve,
+ * because it names a function that does not exist yet.
+ */
+export function httpApiIntegration(context) {
+    return {
+        Type: "AWS::ApiGatewayV2::Integration",
+        Properties: renamed(context, {
+            ApiId: "api_id",
+            IntegrationType: "integration_type",
+            IntegrationUri: "integration_uri",
+            PayloadFormatVersion: "payload_format_version",
+        }),
+        requires: ["ApiId", "IntegrationUri"],
+    };
+}
 /** A route, which needs the integration it targets to have been created. */
 export function httpApiRoute(context) {
     return {
@@ -11,7 +27,7 @@ export function httpApiRoute(context) {
             }),
             ...properties({ Target: routeTarget(context) }),
         },
-        requires: ["Target"],
+        requires: ["ApiId", "Target"],
     };
 }
 /**
@@ -29,4 +45,4 @@ function routeTarget(context) {
     }
     return { "Fn::Join": ["", ["integrations/", target]] };
 }
-//# sourceMappingURL=sim-tf-map-http-api-route.js.map
+//# sourceMappingURL=sim-tf-map-http-api-routes.js.map

package/dist/terraform/map/sim-tf-map-http-api-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-http-api-routes.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-http-api-routes.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,SAAS,EACT,UAAU,EACV,OAAO,GAER,MAAM,yBAAyB,CAAC;AAGjC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,KAAK,EAAE,QAAQ;YACf,eAAe,EAAE,kBAAkB;YACnC,cAAc,EAAE,iBAAiB;YACjC,oBAAoB,EAAE,wBAAwB;SAC/C,CAAC;QACF,QAAQ,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE;gBAClB,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,WAAW;gBACrB,iBAAiB,EAAE,oBAAoB;aACxC,CAAC;YACF,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;SAChD;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,OAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE5C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/dist/terraform/map/sim-tf-map-http-api.d.ts

@@ -0,0 +1,7 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/** An HTTP API. */
+export declare function httpApi(context: TerraformMappingContext): TerraformMappedResource;
+/** A stage. */
+export declare function httpApiStage(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-http-api.d.ts.map

package/dist/terraform/map/sim-tf-map-http-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-http-api.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-http-api.ts"],"names":[],"mappings":"AAOA,OAAO,EAOL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE,mBAAmB;AACnB,wBAAgB,OAAO,CACrB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAYzB;AAgBD,eAAe;AACf,wBAAgB,YAAY,CAC1B,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAUzB"}

package/dist/{service/cloudformation/terraform → terraform/map}/sim-tf-map-http-api.js

@@ -1,4 +1,4 @@
-import { block, field, properties, renamed, tags, templateValue, } from "./sim-tf-attributes.js";
+import { block, field, properties, renamed, tags, templateValue, } from "../sim-tf-attributes.js";
 /** An HTTP API. */
 export function httpApi(context) {
     return {
@@ -10,6 +10,7 @@ export function httpApi(context) {
                 Tags: tags(context),
             }),
         },
+        requires: ["Name", "ProtocolType"],
     };
 }
 function cors(configured) {
@@ -22,22 +23,6 @@ function cors(configured) {
         AllowHeaders: templateValue(field(configured, "allow_headers")),
     });
 }
-/**
- * An integration. Its URI is the value a plan most often cannot resolve,
- * because it names a function that does not exist yet.
- */
-export function httpApiIntegration(context) {
-    return {
-        Type: "AWS::ApiGatewayV2::Integration",
-        Properties: renamed(context, {
-            ApiId: "api_id",
-            IntegrationType: "integration_type",
-            IntegrationUri: "integration_uri",
-            PayloadFormatVersion: "payload_format_version",
-        }),
-        requires: ["IntegrationUri"],
-    };
-}
 /** A stage. */
 export function httpApiStage(context) {
     return {
@@ -47,6 +32,7 @@ export function httpApiStage(context) {
             StageName: "name",
             AutoDeploy: "auto_deploy",
         }),
+        requires: ["ApiId", "StageName"],
     };
 }
 //# sourceMappingURL=sim-tf-map-http-api.js.map

package/dist/terraform/map/sim-tf-map-http-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-http-api.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-http-api.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,EACL,KAAK,EACL,UAAU,EACV,OAAO,EACP,IAAI,EACJ,aAAa,GAEd,MAAM,yBAAyB,CAAC;AAGjC,mBAAmB;AACnB,MAAM,UAAU,OAAO,CACrB,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;YACpE,GAAG,UAAU,CAAC;gBACZ,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;gBAC7D,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;aACpB,CAAC;SACH;QACD,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CACX,UAA+C;IAE/C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,CAAC;QAChB,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC/D,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC/D,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;KAChE,CAAC,CAAC;AACL,CAAC;AAED,eAAe;AACf,MAAM,UAAU,YAAY,CAC1B,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,aAAa;SAC1B,CAAC;QACF,QAAQ,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/terraform/map/sim-tf-map-iam-policy.d.ts

@@ -0,0 +1,32 @@
+import type { SimCfnTemplateValue } from "../../service/cloudformation/template/value/sim-cfn-template-value.js";
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+/**
+ * An inline policy on the role it is attached to.
+ *
+ * A document built with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, and its statements are gone with it, so a deployment can
+ * supply the document against the role's own name.
+ *
+ * With nothing supplied, the role is created holding a policy that allows
+ * everything and the attribute is recorded as lost. Simulated IAM evaluates
+ * authorization, so the alternative is a role that denies what the
+ * configuration allowed, which fails the resources that use it and takes the
+ * rest of the Stack with them. A role that is too permissive is the same
+ * answer sim CloudFormation gives a Resource type it cannot create: carry on,
+ * and say what was stepped over.
+ */
+export declare function inlinePolicy(context: TerraformMappingContext): Record<string, SimCfnTemplateValue>;
+/** The attributes this fold could not carry, which is the document or none. */
+export declare function inlinePolicyLost(context: TerraformMappingContext): readonly string[];
+/**
+ * A policy document, which Terraform carries as a JSON string and
+ * CloudFormation as an object.
+ *
+ * A document built with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, so this returns nothing rather than a partial policy. A
+ * string that will not parse answers the same way. The plan is a file on disk
+ * and one unreadable document is one attribute, and failing the whole import
+ * over it would take every other resource of the plan with it.
+ */
+export declare function jsonDocument(value: unknown): SimCfnTemplateValue | undefined;
+//# sourceMappingURL=sim-tf-map-iam-policy.d.ts.map

package/dist/terraform/map/sim-tf-map-iam-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-iam-policy.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-iam-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AACjH,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAMrC;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,SAAS,MAAM,EAAE,CAEnB;AAmDD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAQ5E"}

package/dist/terraform/map/sim-tf-map-iam-policy.js

@@ -0,0 +1,85 @@
+import { isRecord } from "../../util/type-guard/record.js";
+import { attribute, field, templateValue, } from "../sim-tf-attributes.js";
+import { terraformReferencedResource } from "../sim-tf-referenced.js";
+/**
+ * An inline policy on the role it is attached to.
+ *
+ * A document built with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, and its statements are gone with it, so a deployment can
+ * supply the document against the role's own name.
+ *
+ * With nothing supplied, the role is created holding a policy that allows
+ * everything and the attribute is recorded as lost. Simulated IAM evaluates
+ * authorization, so the alternative is a role that denies what the
+ * configuration allowed, which fails the resources that use it and takes the
+ * rest of the Stack with them. A role that is too permissive is the same
+ * answer sim CloudFormation gives a Resource type it cannot create: carry on,
+ * and say what was stepped over.
+ */
+export function inlinePolicy(context) {
+    const document = policyDocument(context) ?? unknownPolicyDocument;
+    return {
+        Policies: [{ PolicyName: policyName(context), PolicyDocument: document }],
+    };
+}
+/** The attributes this fold could not carry, which is the document or none. */
+export function inlinePolicyLost(context) {
+    return policyDocument(context) === undefined ? ["policy"] : [];
+}
+/**
+ * What this policy allows, from the plan or from the deployment.
+ *
+ * The plan comes first, so a supplied document fills a gap rather than
+ * replacing a document Terraform resolved.
+ */
+function policyDocument(context) {
+    return (jsonDocument(field(context.resource.values, "policy")) ??
+        suppliedDocument(context));
+}
+/**
+ * The document a deployment supplied for the role this policy is attached to.
+ *
+ * The `role` attribute holds a reference rather than a name, because a role
+ * created by the same plan has no ID until it exists. The role behind the
+ * reference is what carries the name an override is matched on.
+ */
+function suppliedDocument(context) {
+    const role = terraformReferencedResource(context.resource, "role", context.resolver);
+    return templateValue(context.overrides.policy(role && field(role.values, "name")));
+}
+/** What a role whose policy the plan collapsed is allowed to do. */
+const unknownPolicyDocument = {
+    Version: "2012-10-17",
+    Statement: [{ Effect: "Allow", Action: "*", Resource: "*" }],
+};
+/** The name of an inline role policy, which Terraform lets go unnamed. */
+function policyName(context) {
+    const name = attribute(context, "name");
+    return typeof name === "string" && name.length > 0 ? name : "inline";
+}
+/**
+ * A policy document, which Terraform carries as a JSON string and
+ * CloudFormation as an object.
+ *
+ * A document built with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, so this returns nothing rather than a partial policy. A
+ * string that will not parse answers the same way. The plan is a file on disk
+ * and one unreadable document is one attribute, and failing the whole import
+ * over it would take every other resource of the plan with it.
+ */
+export function jsonDocument(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const parsed = parsedDocument(value);
+    return isRecord(parsed) ? templateValue(parsed) : undefined;
+}
+function parsedDocument(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=sim-tf-map-iam-policy.js.map

package/dist/terraform/map/sim-tf-map-iam-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-iam-policy.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-iam-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAE3D,OAAO,EACL,SAAS,EACT,KAAK,EACL,aAAa,GAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAgC;IAEhC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC;IAElE,OAAO;QACL,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,OAAO,cAAc,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,OAAgC;IAEhC,OAAO,CACL,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,gBAAgB,CAAC,OAAO,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAAgC;IAEhC,MAAM,IAAI,GAAG,2BAA2B,CACtC,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,OAAO,CAAC,QAAQ,CACjB,CAAC;IAEF,OAAO,aAAa,CAClB,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,qBAAqB,GAAwB;IACjD,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;CAC7D,CAAC;AAEF,0EAA0E;AAC1E,SAAS,UAAU,CAAC,OAAgC;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAExC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAErC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/{service/cloudformation/terraform → terraform/map}/sim-tf-map-iam.d.ts

@@ -1,9 +1,7 @@
-import { type TerraformMappingContext } from "./sim-tf-attributes.js";
-import type { TerraformMappedResource, TerraformResourceFold } from "./sim-tf-mapping.type.js";
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource, TerraformResourceFold } from "../sim-tf-mapping.type.js";
 /** A role. The policies on it arrive as resources of their own. */
 export declare function iamRole(context: TerraformMappingContext): TerraformMappedResource;
-/** A log group. Terraform spells "never expire" as a retention of zero. */
-export declare function logGroup(context: TerraformMappingContext): TerraformMappedResource;
 /** The IAM resources that attach policy to a role declared elsewhere. */
 export declare const iamRoleFolds: ReadonlyMap<string, TerraformResourceFold>;
 //# sourceMappingURL=sim-tf-map-iam.d.ts.map

package/dist/terraform/map/sim-tf-map-iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-iam.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-iam.ts"],"names":[],"mappings":"AAOA,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAMjC,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,2BAA2B,CAAC;AAEnC,mEAAmE;AACnE,wBAAgB,OAAO,CACrB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAgBzB;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAgBlE,CAAC"}

package/dist/terraform/map/sim-tf-map-iam.js

@@ -0,0 +1,37 @@
+import { attribute, field, properties, renamed, tags, } from "../sim-tf-attributes.js";
+import { inlinePolicy, inlinePolicyLost, jsonDocument, } from "./sim-tf-map-iam-policy.js";
+/** A role. The policies on it arrive as resources of their own. */
+export function iamRole(context) {
+    const assume = jsonDocument(field(context.resource.values, "assume_role_policy"));
+    return {
+        Type: "AWS::IAM::Role",
+        Properties: {
+            ...renamed(context, { RoleName: "name" }),
+            ...properties({
+                AssumeRolePolicyDocument: assume,
+                Tags: tags(context),
+            }),
+        },
+        lost: assume === undefined ? ["assume_role_policy"] : [],
+    };
+}
+/** The IAM resources that attach policy to a role declared elsewhere. */
+export const iamRoleFolds = new Map([
+    [
+        "aws_iam_role_policy",
+        {
+            parentAttribute: "role",
+            properties: inlinePolicy,
+            lost: inlinePolicyLost,
+        },
+    ],
+    [
+        "aws_iam_role_policy_attachment",
+        { parentAttribute: "role", properties: managedPolicy },
+    ],
+]);
+function managedPolicy(context) {
+    const arn = attribute(context, "policy_arn");
+    return arn === undefined ? {} : { ManagedPolicyArns: [arn] };
+}
+//# sourceMappingURL=sim-tf-map-iam.js.map

package/dist/terraform/map/sim-tf-map-iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-iam.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-iam.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,SAAS,EACT,KAAK,EACL,UAAU,EACV,OAAO,EACP,IAAI,GAEL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,4BAA4B,CAAC;AAMpC,mEAAmE;AACnE,MAAM,UAAU,OAAO,CACrB,OAAgC;IAEhC,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC,CACrD,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACzC,GAAG,UAAU,CAAC;gBACZ,wBAAwB,EAAE,MAAM;gBAChC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;aACpB,CAAC;SACH;QACD,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE;KACzD,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAA+C,IAAI,GAAG,CAG7E;IACA;QACE,qBAAqB;QACrB;YACE,eAAe,EAAE,MAAM;YACvB,UAAU,EAAE,YAAY;YACxB,IAAI,EAAE,gBAAgB;SACvB;KACF;IACD;QACE,gCAAgC;QAChC,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE;KACvD;CACF,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,OAAgC;IAEhC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE7C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/terraform/map/sim-tf-map-kms.d.ts

@@ -0,0 +1,25 @@
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+import type { TerraformMappedResource } from "../sim-tf-mapping.type.js";
+/**
+ * A key.
+ *
+ * Terraform spells the key spec `customer_master_key_spec`, which is the name
+ * the KMS API used before AWS renamed it, and CloudFormation carries the new
+ * one. `is_enabled` is CloudFormation's `Enabled`.
+ *
+ * Rotation and tags go across as they were written. Simulated KMS records both
+ * as properties a key is created without, rather than refusing them, so a key
+ * asking for rotation deploys and says on the Resource that its material never
+ * changes.
+ */
+export declare function kmsKey(context: TerraformMappingContext): TerraformMappedResource;
+/**
+ * An alias.
+ *
+ * Both properties are required, as they are on real CloudFormation. An alias
+ * with no name names nothing and one with no target points at nothing, so an
+ * alias whose key the template does not declare is left out rather than
+ * deployed into a failure that would take the Stack with it.
+ */
+export declare function kmsAlias(context: TerraformMappingContext): TerraformMappedResource;
+//# sourceMappingURL=sim-tf-map-kms.d.ts.map

package/dist/terraform/map/sim-tf-map-kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-kms.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-kms.ts"],"names":[],"mappings":"AAOA,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CAiBzB;AAmCD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,uBAAuB,GAC/B,uBAAuB,CASzB"}

package/dist/terraform/map/sim-tf-map-kms.js

@@ -0,0 +1,75 @@
+import { field, properties, renamed, tags, } from "../sim-tf-attributes.js";
+/**
+ * A key.
+ *
+ * Terraform spells the key spec `customer_master_key_spec`, which is the name
+ * the KMS API used before AWS renamed it, and CloudFormation carries the new
+ * one. `is_enabled` is CloudFormation's `Enabled`.
+ *
+ * Rotation and tags go across as they were written. Simulated KMS records both
+ * as properties a key is created without, rather than refusing them, so a key
+ * asking for rotation deploys and says on the Resource that its material never
+ * changes.
+ */
+export function kmsKey(context) {
+    const policy = keyPolicy(context);
+    return {
+        Type: "AWS::KMS::Key",
+        Properties: {
+            ...renamed(context, {
+                Description: "description",
+                Enabled: "is_enabled",
+                KeySpec: "customer_master_key_spec",
+                KeyUsage: "key_usage",
+                EnableKeyRotation: "enable_key_rotation",
+            }),
+            ...properties({ KeyPolicy: policy, Tags: tags(context) }),
+        },
+        lost: policy === undefined && declaredPolicy(context) ? ["policy"] : [],
+    };
+}
+/**
+ * The key policy, which Terraform carries as a JSON string.
+ *
+ * A policy written with `jsonencode` around an ARN of the same plan is unknown
+ * in its entirety, and its statements are gone with it. The reference behind it
+ * resolves to the ARN rather than to a document, so there is nothing to send
+ * and the attribute is recorded instead. A key created without a policy gets
+ * the default root delegation KMS applies, which is what a key declaring no
+ * policy gets anyway, so the key still exists and still encrypts.
+ */
+function keyPolicy(context) {
+    const policy = field(context.resource.values, "policy");
+    return typeof policy === "string" ? policy : undefined;
+}
+/**
+ * Whether the configuration wrote a policy the plan could not resolve.
+ *
+ * A key declaring no policy at all is unknown in the plan too, because KMS is
+ * the one that writes the default. That one is not lost: a key created here
+ * without a policy gets the same root delegation, so only a policy the
+ * configuration stated and the plan could not build is worth recording.
+ */
+function declaredPolicy(context) {
+    return (context.resource.unknown["policy"] === true &&
+        context.resource.expressions["policy"] !== undefined);
+}
+/**
+ * An alias.
+ *
+ * Both properties are required, as they are on real CloudFormation. An alias
+ * with no name names nothing and one with no target points at nothing, so an
+ * alias whose key the template does not declare is left out rather than
+ * deployed into a failure that would take the Stack with it.
+ */
+export function kmsAlias(context) {
+    return {
+        Type: "AWS::KMS::Alias",
+        Properties: renamed(context, {
+            AliasName: "name",
+            TargetKeyId: "target_key_id",
+        }),
+        requires: ["AliasName", "TargetKeyId"],
+    };
+}
+//# sourceMappingURL=sim-tf-map-kms.js.map

package/dist/terraform/map/sim-tf-map-kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-kms.js","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-kms.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,EACL,UAAU,EACV,OAAO,EACP,IAAI,GAEL,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CACpB,OAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE;YACV,GAAG,OAAO,CAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,YAAY;gBACrB,OAAO,EAAE,0BAA0B;gBACnC,QAAQ,EAAE,WAAW;gBACrB,iBAAiB,EAAE,qBAAqB;aACzC,CAAC;YACF,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;SAC1D;QACD,IAAI,EAAE,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAChB,OAAgC;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAExD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,OAAgC;IACtD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI;QAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,SAAS,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3B,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,eAAe;SAC7B,CAAC;QACF,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;KACvC,CAAC;AACJ,CAAC"}

package/dist/terraform/map/sim-tf-map-lambda-environment.d.ts

@@ -0,0 +1,20 @@
+import type { SimCfnTemplateValue } from "../../service/cloudformation/template/value/sim-cfn-template-value.js";
+import { type TerraformMappingContext } from "../sim-tf-attributes.js";
+/** What a function's environment came to, and what it cost to get there. */
+export interface TerraformLambdaEnvironment {
+    /** The CloudFormation property, or nothing to leave the property out. */
+    readonly property: SimCfnTemplateValue | undefined;
+    /** `environment.variables`, where the plan lost it and nothing filled it. */
+    readonly lost: readonly string[];
+}
+/**
+ * The environment variables a simulated function runs with.
+ *
+ * A map holding one reference to a resource of the same plan is unknown in its
+ * entirety, and the variable names go with it, so a deployment can supply the
+ * map against the function name the plan carries. What the plan resolved wins
+ * over what was supplied, variable by variable, which is what makes a
+ * configuration that later resolves the map stop needing the override.
+ */
+export declare function lambdaEnvironment(context: TerraformMappingContext): TerraformLambdaEnvironment;
+//# sourceMappingURL=sim-tf-map-lambda-environment.d.ts.map

package/dist/terraform/map/sim-tf-map-lambda-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-tf-map-lambda-environment.d.ts","sourceRoot":"","sources":["../../../src/terraform/map/sim-tf-map-lambda-environment.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AACjH,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACnD,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,uBAAuB,GAC/B,0BAA0B,CAc5B"}