@kensio/yulin 1.20.13 → 1.20.14

package/dist/service/athena/engine/sim-athena-distinct-values.js

@@ -0,0 +1,37 @@
+/** An empty accumulator, which is what an aggregate over no rows answers from. */
+export const noDistinctValues = "[]";
+/**
+ * This value with one more added, where it is not null.
+ *
+ * Trino and SQLite both leave a null out of a distinct count, so a null row
+ * adds nothing.
+ */
+export function withDistinctValue(accumulator, value) {
+    if (value === null) {
+        return accumulator;
+    }
+    const seen = new Set(JSON.parse(accumulator));
+    seen.add(keyOf(value));
+    return JSON.stringify([...seen]);
+}
+/** How many distinct values this accumulator saw. */
+export function countedDistinctValues(accumulator) {
+    return JSON.parse(accumulator).length;
+}
+/**
+ * One value as the key that tells it apart from the others.
+ *
+ * The tag is what keeps the number `1` and the text `'1'` apart, which is how
+ * SQLite keeps them apart too. A whole number arrives as a `bigint` or as a
+ * `number` by its size alone, so both take the same tag and the same spelling.
+ * Bytes are keyed by their hex, since a digest is a blob here and two rows
+ * carrying the same digest are one value.
+ */
+function keyOf(value) {
+    if (typeof value === "string") {
+        return `s:${value}`;
+    }
+    return value instanceof Uint8Array
+        ? `b:${Buffer.from(value).toString("hex")}`
+        : `n:${String(value)}`;
+}

package/dist/service/athena/engine/sim-athena-hash-words.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The 64-bit arithmetic both hand-written hashes are built on.
+ *
+ * Neither xxHash64 nor MurmurHash3 has an implementation in Node, and both are
+ * defined over 64-bit words. A BigInt carries as many bits as it is given, so
+ * every operation masks its answer back down to the width the algorithm works
+ * in.
+ */
+/** Every bit of one 64-bit word. */
+export declare const hashWord: bigint;
+/** One word rotated left, with the bits carried off the top brought back in. */
+export declare function rotateWord(value: bigint, by: number): bigint;
+/** Whatever bytes are left over, read as the low end of a word. */
+export declare function partialWord(bytes: Uint8Array): bigint;

package/dist/service/athena/engine/sim-athena-hash-words.js

@@ -0,0 +1,22 @@
+/**
+ * The 64-bit arithmetic both hand-written hashes are built on.
+ *
+ * Neither xxHash64 nor MurmurHash3 has an implementation in Node, and both are
+ * defined over 64-bit words. A BigInt carries as many bits as it is given, so
+ * every operation masks its answer back down to the width the algorithm works
+ * in.
+ */
+/** Every bit of one 64-bit word. */
+export const hashWord = (1n << 64n) - 1n;
+/** One word rotated left, with the bits carried off the top brought back in. */
+export function rotateWord(value, by) {
+    return ((value << BigInt(by)) | (value >> BigInt(64 - by))) & hashWord;
+}
+/** Whatever bytes are left over, read as the low end of a word. */
+export function partialWord(bytes) {
+    let value = 0n;
+    for (const [index, byte] of bytes.entries()) {
+        value |= BigInt(byte) << BigInt(8 * index);
+    }
+    return value;
+}

package/dist/service/athena/engine/sim-athena-murmur3-mixing.d.ts

@@ -0,0 +1,15 @@
+/** The two accumulators MurmurHash3 carries, the low half first. */
+export type SimAthenaMurmurHalves = readonly [bigint, bigint];
+/** Two words scrambled into the keys one round mixes in. */
+export declare function murmurKeys(low: bigint, high: bigint): SimAthenaMurmurHalves;
+/**
+ * Both accumulators taken through one round, the low half leading.
+ *
+ * The high half is crossed with the low half the round has just written, which
+ * is what carries a block into every later one.
+ */
+export declare function murmurRound(halves: SimAthenaMurmurHalves, keys: SimAthenaMurmurHalves): SimAthenaMurmurHalves;
+/** Each accumulator with the other added into it, the low half first. */
+export declare function murmurCrossed(halves: SimAthenaMurmurHalves): SimAthenaMurmurHalves;
+/** The final mix, which spreads every bit of one half over its word. */
+export declare function murmurAvalanche(value: bigint): bigint;

package/dist/service/athena/engine/sim-athena-murmur3-mixing.js

@@ -0,0 +1,37 @@
+import { hashWord as word, rotateWord as rotate, } from "./sim-athena-hash-words.js";
+const constant1 = 0x87c37b91114253d5n;
+const constant2 = 0x4cf5ad432745937fn;
+/** Two words scrambled into the keys one round mixes in. */
+export function murmurKeys(low, high) {
+    return [
+        scramble(low, constant1, 31, constant2),
+        scramble(high, constant2, 33, constant1),
+    ];
+}
+/**
+ * Both accumulators taken through one round, the low half leading.
+ *
+ * The high half is crossed with the low half the round has just written, which
+ * is what carries a block into every later one.
+ */
+export function murmurRound(halves, keys) {
+    const low = mixed(halves[0] ^ keys[0], halves[1], 27, 0x52dce729n);
+    return [low, mixed(halves[1] ^ keys[1], low, 31, 0x38495ab5n)];
+}
+/** Each accumulator with the other added into it, the low half first. */
+export function murmurCrossed(halves) {
+    const low = (halves[0] + halves[1]) & word;
+    return [low, (halves[1] + low) & word];
+}
+/** The final mix, which spreads every bit of one half over its word. */
+export function murmurAvalanche(value) {
+    let spread = ((value ^ (value >> 33n)) * 0xff51afd7ed558ccdn) & word;
+    spread = ((spread ^ (spread >> 33n)) * 0xc4ceb9fe1a85ec53n) & word;
+    return spread ^ (spread >> 33n);
+}
+function scramble(value, before, by, after) {
+    return (rotate((value * before) & word, by) * after) & word;
+}
+function mixed(half, other, by, added) {
+    return ((rotate(half, by) + other) * 5n + added) & word;
+}

package/dist/service/athena/engine/sim-athena-murmur3.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The 128-bit MurmurHash3 of these bytes, seeded with zero, as Trino's
+ * `murmur3` seeds it.
+ *
+ * This is the x64 variant, which answers differently from the x86 one of the
+ * same width. Trino writes each half of the answer little-endian, which is what
+ * makes `to_hex(murmur3(from_hex('69A69A69')))` read as
+ * `BA5855635569B42F4920372CA0E396EF`. That is the one worked example Trino's
+ * own documentation carries.
+ */
+export declare function simAthenaMurmur3(bytes: Uint8Array): Uint8Array;

package/dist/service/athena/engine/sim-athena-murmur3.js

@@ -0,0 +1,51 @@
+import { partialWord } from "./sim-athena-hash-words.js";
+import { murmurAvalanche, murmurCrossed, murmurKeys, murmurRound, } from "./sim-athena-murmur3-mixing.js";
+/** How many bytes one round of the body reads. */
+const block = 16;
+/**
+ * The 128-bit MurmurHash3 of these bytes, seeded with zero, as Trino's
+ * `murmur3` seeds it.
+ *
+ * This is the x64 variant, which answers differently from the x86 one of the
+ * same width. Trino writes each half of the answer little-endian, which is what
+ * makes `to_hex(murmur3(from_hex('69A69A69')))` read as
+ * `BA5855635569B42F4920372CA0E396EF`. That is the one worked example Trino's
+ * own documentation carries.
+ */
+export function simAthenaMurmur3(bytes) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const body = bytes.length - (bytes.length % block);
+    let halves = [0n, 0n];
+    for (let at = 0; at < body; at += block) {
+        halves = murmurRound(halves, murmurKeys(view.getBigUint64(at, true), view.getBigUint64(at + 8, true)));
+    }
+    return written(finish(halves, bytes.subarray(body), bytes.length));
+}
+/**
+ * Whatever the body left over, then the final mix over both accumulators.
+ *
+ * The tail bytes are read low to high, which is the little-endian read of a
+ * partial word. Neither half is rotated for them and neither is crossed with
+ * the other, and a tail short enough to leave a half empty scrambles a zero
+ * into it, which changes nothing.
+ */
+function finish(halves, tail, length) {
+    const keys = murmurKeys(partialWord(tail.subarray(0, 8)), partialWord(tail.subarray(8)));
+    const counted = BigInt(length);
+    const carried = murmurCrossed([
+        halves[0] ^ keys[0] ^ counted,
+        halves[1] ^ keys[1] ^ counted,
+    ]);
+    return murmurCrossed([
+        murmurAvalanche(carried[0]),
+        murmurAvalanche(carried[1]),
+    ]);
+}
+/** Both halves as bytes, each one written little-endian, as Trino writes them. */
+function written(halves) {
+    const digest = new Uint8Array(block);
+    const view = new DataView(digest.buffer);
+    view.setBigUint64(0, halves[0], true);
+    view.setBigUint64(8, halves[1], true);
+    return digest;
+}

package/dist/service/athena/engine/sim-athena-shim-registry.d.ts

@@ -21,3 +21,12 @@ export declare function isExplicitNull(values: readonly SQLOutputValue[], index:
 export declare function shimText(value: SQLOutputValue | undefined): string | undefined;
 /** One argument as a number, or nothing where it is not one. */
 export declare function shimNumber(value: SQLOutputValue | undefined): number | undefined;
+/**
+ * One argument as bytes, or nothing where it is null.
+ *
+ * The binary functions take a `varbinary`, and Trino refuses text where one is
+ * wanted rather than converting it. SQLite has no such analysis to run, so a
+ * column of text reaching `sha256` without a `to_utf8` around it is hashed as
+ * its UTF-8 bytes, which is what the missing call would have produced.
+ */
+export declare function shimBytes(value: SQLOutputValue | undefined): Uint8Array | undefined;

package/dist/service/athena/engine/sim-athena-shim-registry.js

@@ -6,7 +6,20 @@
  * with an optional argument would stop resolving.
  */
 export function simAthenaScalarShim(database, name, implementation) {
-    database.function(name, { varargs: true, deterministic: true }, implementation);
+    database.function(name, { varargs: true, deterministic: true }, (...values) => withEmptyBytes(implementation(...values)));
+}
+/**
+ * One answer, with an empty `varbinary` written so that SQLite keeps it.
+ *
+ * `node:sqlite` reads a zero length typed array as SQL NULL where its backing
+ * store carries no pointer, and `TextEncoder` answers with exactly that over an
+ * empty string. Copying those bytes gives the empty blob back, and `to_utf8('')`
+ * then answers the empty `varbinary` Trino answers with rather than a null.
+ */
+function withEmptyBytes(answered) {
+    return answered instanceof Uint8Array && answered.length === 0
+        ? Buffer.alloc(0)
+        : answered;
 }
 /**
  * Whether an optional argument was written as an explicit `NULL`.
@@ -30,3 +43,19 @@ export function shimNumber(value) {
     const parsed = Number(value);
     return Number.isFinite(parsed) ? parsed : undefined;
 }
+/**
+ * One argument as bytes, or nothing where it is null.
+ *
+ * The binary functions take a `varbinary`, and Trino refuses text where one is
+ * wanted rather than converting it. SQLite has no such analysis to run, so a
+ * column of text reaching `sha256` without a `to_utf8` around it is hashed as
+ * its UTF-8 bytes, which is what the missing call would have produced.
+ */
+export function shimBytes(value) {
+    if (value === null || value === undefined) {
+        return undefined;
+    }
+    return value instanceof Uint8Array
+        ? value
+        : new TextEncoder().encode(String(value));
+}

package/dist/service/athena/engine/sim-athena-shims.js

@@ -1,5 +1,6 @@
 import { simAthenaInstallAggregateShims } from "./sim-athena-aggregate-shims.js";
 import { simAthenaInstallArrayShims } from "./sim-athena-array-shims.js";
+import { simAthenaInstallBinaryShims } from "./sim-athena-binary-shims.js";
 import { simAthenaInstallClockShims } from "./sim-athena-clock-shims.js";
 import { simAthenaInstallDateArithmeticShims } from "./sim-athena-date-arithmetic-shims.js";
 import { simAthenaInstallDateShims } from "./sim-athena-date-shims.js";
@@ -24,6 +25,7 @@ export function simAthenaInstallShims(database, startedAt) {
     simAthenaInstallJsonDocumentShims(database);
     simAthenaInstallArrayShims(database);
     simAthenaInstallStringShims(database);
+    simAthenaInstallBinaryShims(database);
     simAthenaInstallRegexpShims(database);
     simAthenaInstallUrlShims(database);
     simAthenaInstallAggregateShims(database);

package/dist/service/athena/engine/sim-athena-sql-rewrites.d.ts

@@ -7,11 +7,13 @@ export interface SimAthenaParserSql {
 /**
  * The statement as the parser's Athena grammar will take it.
  *
- * The two rewrites close a gap in that grammar rather than a gap in SQLite.
+ * Every rewrite here closes a gap in that grammar rather than a gap in SQLite.
  * `try_cast` becomes a plain cast, which changes meaning in the forgiving
  * direction, since SQLite already answers with a value where a cast fails
  * rather than failing the query. Trino writes `OFFSET` before `LIMIT` and every
- * other dialect writes it after.
+ * other dialect writes it after. `count(DISTINCT <expression>)` becomes a call
+ * to an aggregate of the simulator's own, since the grammar takes a column
+ * after `DISTINCT` and nothing else.
  */
 export declare function simAthenaSqlForParser(sql: string): SimAthenaParserSql;
 /**

package/dist/service/athena/engine/sim-athena-sql-rewrites.js

@@ -1,3 +1,4 @@
+import { simAthenaCountDistinct } from "./sim-athena-count-distinct.js";
 /**
  * `WITH ORDINALITY`, which the parser's Athena grammar refuses outright.
  *
@@ -9,14 +10,16 @@ const withOrdinality = /\s+WITH\s+ORDINALITY\b/giu;
 /**
  * The statement as the parser's Athena grammar will take it.
  *
- * The two rewrites close a gap in that grammar rather than a gap in SQLite.
+ * Every rewrite here closes a gap in that grammar rather than a gap in SQLite.
  * `try_cast` becomes a plain cast, which changes meaning in the forgiving
  * direction, since SQLite already answers with a value where a cast fails
  * rather than failing the query. Trino writes `OFFSET` before `LIMIT` and every
- * other dialect writes it after.
+ * other dialect writes it after. `count(DISTINCT <expression>)` becomes a call
+ * to an aggregate of the simulator's own, since the grammar takes a column
+ * after `DISTINCT` and nothing else.
  */
 export function simAthenaSqlForParser(sql) {
-    const rewritten = sql
+    const rewritten = simAthenaCountDistinct(sql)
         .replaceAll(/\btry_cast\s*\(/giu, "CAST(")
         .replaceAll(/\bOFFSET\s+(\d+)\s+LIMIT\s+(\d+)/giu, (_match, offset, limit) => `LIMIT ${limit} OFFSET ${offset}`);
     const forParser = rewritten.replaceAll(withOrdinality, "");

package/dist/service/athena/engine/sim-athena-xxhash64.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The xxHash64 of these bytes, seeded with zero, as Trino's `xxhash64` seeds
+ * it.
+ *
+ * Trino answers with the eight bytes of the hash written big-endian, which is
+ * what makes `to_hex(xxhash64(to_utf8('hello')))` read as `26C7827D889F6DA3`.
+ */
+export declare function simAthenaXxHash64(bytes: Uint8Array): Uint8Array;

package/dist/service/athena/engine/sim-athena-xxhash64.js

@@ -0,0 +1,82 @@
+import { hashWord as word, rotateWord as rotate, } from "./sim-athena-hash-words.js";
+const prime1 = 11400714785074694791n;
+const prime2 = 14029467366897019727n;
+const prime3 = 1609587929392839161n;
+const prime4 = 9650029242287828579n;
+const prime5 = 2870177450012600261n;
+/** How many bytes one round of the four-lane body reads. */
+const stripe = 32;
+/**
+ * The xxHash64 of these bytes, seeded with zero, as Trino's `xxhash64` seeds
+ * it.
+ *
+ * Trino answers with the eight bytes of the hash written big-endian, which is
+ * what makes `to_hex(xxhash64(to_utf8('hello')))` read as `26C7827D889F6DA3`.
+ */
+export function simAthenaXxHash64(bytes) {
+    const digest = new Uint8Array(8);
+    new DataView(digest.buffer).setBigUint64(0, hashOf(bytes), false);
+    return digest;
+}
+function hashOf(bytes) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const body = bytes.length - (bytes.length % stripe);
+    let hash = bytes.length < stripe ? prime5 : mixedLanes(view, body);
+    hash = (hash + BigInt(bytes.length)) & word;
+    return avalanche(tail(view, bytes, hash, body));
+}
+/**
+ * The four lanes the body is read into, mixed back down to one word.
+ *
+ * Each lane takes every fourth eight bytes, which is what lets the real
+ * implementation read four of them at once.
+ */
+function mixedLanes(view, body) {
+    let lanes = [
+        { value: (prime1 + prime2) & word, rotation: 1 },
+        { value: prime2, rotation: 7 },
+        { value: 0n, rotation: 12 },
+        { value: -prime1 & word, rotation: 18 },
+    ];
+    for (let at = 0; at < body; at += stripe) {
+        lanes = lanes.map((lane, index) => ({
+            ...lane,
+            value: round(lane.value, view.getBigUint64(at + index * 8, true)),
+        }));
+    }
+    let hash = lanes.reduce((sum, lane) => (sum + rotate(lane.value, lane.rotation)) & word, 0n);
+    for (const lane of lanes) {
+        hash = ((hash ^ round(0n, lane.value)) * prime1 + prime4) & word;
+    }
+    return hash;
+}
+/**
+ * Whatever the body left over, read eight bytes at a time, then four, then one.
+ */
+function tail(view, bytes, hash, body) {
+    let mixed = hash;
+    let at = body;
+    for (; at + 8 <= bytes.length; at += 8) {
+        const lane = round(0n, view.getBigUint64(at, true));
+        mixed = (rotate(mixed ^ lane, 27) * prime1 + prime4) & word;
+    }
+    if (at + 4 <= bytes.length) {
+        const lane = (BigInt(view.getUint32(at, true)) * prime1) & word;
+        mixed = (rotate(mixed ^ lane, 23) * prime2 + prime3) & word;
+        at += 4;
+    }
+    for (; at < bytes.length; at += 1) {
+        const lane = (BigInt(view.getUint8(at)) * prime5) & word;
+        mixed = (rotate(mixed ^ lane, 11) * prime1) & word;
+    }
+    return mixed;
+}
+/** The final mix, which spreads every bit of the accumulator over the word. */
+function avalanche(hash) {
+    let mixed = ((hash ^ (hash >> 33n)) * prime2) & word;
+    mixed = ((mixed ^ (mixed >> 29n)) * prime3) & word;
+    return mixed ^ (mixed >> 32n);
+}
+function round(lane, input) {
+    return (rotate((lane + input * prime2) & word, 31) * prime1) & word;
+}

package/dist/service/athena/sim-athena-executions.d.ts

@@ -1,6 +1,6 @@
 import { type BackgroundScheduler } from "../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type * as simAthenaCommands from "./command/sim-athena-command.types.js";
 import { SimAthenaCommands } from "./command/sim-athena-commands.js";
 import type { SimAthenaRequestOptions } from "./command/sim-athena-request-options.js";

package/dist/service/athena/sim-athena-executions.js

@@ -1,6 +1,6 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { SimAthenaCommands } from "./command/sim-athena-commands.js";
 import { SimAthenaQueryEngine } from "./engine/sim-athena-query-engine.js";
 import { simAthenaTableObjects, } from "./engine/sim-athena-table-objects.js";
@@ -49,7 +49,8 @@ export class SimAthenaExecutions {
     #results = new SimAthenaQueryResults();
     #engine = new SimAthenaQueryEngine();
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const writer = new SimAthenaResultWriter({
             s3: properties.s3 ?? new SimAthenaNoResultDestination(),
         });

package/dist/service/bedrock/sim-bedrock.d.ts

@@ -1,6 +1,6 @@
 import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
 import { type BackgroundScheduler } from "../../util/background/background.js";
-import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
 import type { SimConverseCommand, SimConverseCommandOutput } from "./command/converse/converse.command.js";
 import type { SimConverseStreamCommand, SimConverseStreamCommandOutput } from "./command/converse/converse-stream.command.js";

package/dist/service/bedrock/sim-bedrock.js

@@ -1,5 +1,5 @@
 import { BackgroundTasks, } from "../../util/background/background.js";
-import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { simIamInRegion } from "../iam/authorize/sim-iam-region-auth-z.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimBedrockAuthorizer } from "./command/authorize/sim-bedrock-authorizer.js";
 import { SimBedrockConverseHandler } from "./command/converse/sim-bedrock-converse.js";
@@ -31,7 +31,8 @@ export class SimBedrock {
     background;
     sdkRouter = new SimBedrockSdkCommandRouter(this);
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = properties;
+        const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const commandProperties = {
             responses: this.responseRules,
             authorizer: new SimBedrockAuthorizer({ iam }),

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.d.ts

@@ -1,11 +1,19 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCdkOutContext } from "../sim-cdk-out-context.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface SimCdkAssetsPublisherProperties {
     readonly simAws: SimAws;
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly stackName?: string | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
+    /**
+     * The principal the deployment runs as, which the staging Bucket is created
+     * and written to as. A real `cdk deploy` publishes assets before
+     * CloudFormation sees the template, and it publishes them as somebody; a
+     * deployment that names a caller is what says who.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.js

@@ -1,6 +1,7 @@
 import { SimCfnPseudoParameters } from "../../parameters/pseudo/sim-cfn-pseudo-parameters.js";
 import { SimCdkAssetPublications, } from "./sim-cdk-asset-publications.js";
 import { readSimCdkAssetBytes } from "./sim-cdk-asset-bytes.js";
+import { simCfnResourceCallerOptions, } from "../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.
  *
@@ -51,14 +52,15 @@ export class SimCdkAssetsPublisher {
             return;
         }
         const s3 = this.stagingS3();
-        await this.ensureBucket(s3, publication.bucketName);
+        const options = simCfnResourceCallerOptions(this.properties.caller);
+        await this.ensureBucket(s3, publication.bucketName, options);
         await s3.putObject({
             input: {
                 Bucket: publication.bucketName,
                 Key: publication.objectKey,
                 Body: assetBytes,
             },
-        });
+        }, options);
     }
     /**
      * Create the staging Bucket if this is the first asset published into it,
@@ -71,12 +73,12 @@ export class SimCdkAssetsPublisher {
      * wanted, whoever created it. Anything else, such as the name already being
      * taken in another scope, is a real failure and is reported.
      */
-    async ensureBucket(s3, bucketName) {
+    async ensureBucket(s3, bucketName, options) {
         if (s3.getSimBucketByName(bucketName) !== undefined) {
             return;
         }
         try {
-            await s3.createBucket({ input: { Bucket: bucketName } });
+            await s3.createBucket({ input: { Bucket: bucketName } }, options);
         }
         catch (error) {
             if (s3.getSimBucketByName(bucketName) === undefined) {

package/dist/service/cloudformation/command/create-stack/create-stack.handler.d.ts

@@ -1,6 +1,7 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { SimCfnStack, type SimCloudFormationStackName } from "../../stack/sim-cfn-stack.js";
 import type { SimCreateStackCommand, SimCreateStackCommandOutput } from "./create-stack.command.js";
@@ -14,6 +15,8 @@ interface CreateStackCommandHandlerProperties {
     readonly background: BackgroundScheduler & BackgroundCompleter;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /** The principal the Stack's Resources are created as. */
+    readonly caller?: SimAwsCaller | undefined;
     readonly exports?: SimCfnExports | undefined;
 }
 /**
@@ -28,6 +31,7 @@ export declare class CreateStackCommandHandler implements CommandHandler<SimCrea
     private readonly background;
     private readonly cdkOutContext;
     private readonly bindings;
+    private readonly caller;
     private readonly exports;
     constructor(properties: CreateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/create-stack/create-stack.handler.js

@@ -16,15 +16,17 @@ export class CreateStackCommandHandler {
     background;
     cdkOutContext;
     bindings;
+    caller;
     exports;
     constructor(properties) {
-        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, exports, } = properties;
+        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, exports, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stacks = stacks;
         this.background = background;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
+        this.caller = caller;
         this.exports = exports;
     }
     /**
@@ -60,6 +62,7 @@ export class CreateStackCommandHandler {
             template,
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
+            caller: this.caller,
             exports: this.exports,
         });
         this.stacks.set(stack.stackName, stack);

package/dist/service/cloudformation/command/update-stack/update-stack.handler.d.ts

@@ -1,6 +1,7 @@
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../../util/background/background.js";
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnStack, SimCloudFormationStackName } from "../../stack/sim-cfn-stack.js";
@@ -16,6 +17,11 @@ interface UpdateStackCommandHandlerProperties {
      * applied from a template file rather than from an SDK Command.
      */
     readonly cdkOutContext?: SimCdkOutContext | undefined;
+    /**
+     * The principal to apply the changed template as, for an update that names
+     * one. Left out, the Stack goes on running as whoever deployed it.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /** The export names published in this Account and Region. */
     readonly exports?: SimCfnExports | undefined;
 }
@@ -30,6 +36,7 @@ export declare class UpdateStackCommandHandler implements CommandHandler<SimUpda
     private readonly stacks;
     private readonly background;
     private readonly cdkOutContext;
+    private readonly caller;
     private readonly exports;
     constructor(properties: UpdateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/update-stack/update-stack.handler.js

@@ -14,6 +14,7 @@ export class UpdateStackCommandHandler {
     stacks;
     background;
     cdkOutContext;
+    caller;
     exports;
     constructor(properties) {
         this.simAws = properties.simAws;
@@ -21,6 +22,7 @@ export class UpdateStackCommandHandler {
         this.stacks = properties.stacks;
         this.background = properties.background;
         this.cdkOutContext = properties.cdkOutContext;
+        this.caller = properties.caller;
         this.exports = properties.exports;
     }
     /**
@@ -56,7 +58,7 @@ export class UpdateStackCommandHandler {
             parameters,
             accountRegionScope: this.accountRegionScope,
             exports: this.exports,
-        }), { cdkOutContext: this.cdkOutContext });
+        }), { cdkOutContext: this.cdkOutContext, caller: this.caller });
         return {
             StackId: stack.stackName,
             $metadata: {},

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-deployer.js

@@ -27,7 +27,7 @@ export class SimCfnCdkOutDeployer {
     }
     async deployStack(stack, plan, deployed) {
         const { simAws, accountRegionScope } = this.scope;
-        const { transform, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
+        const { transform, caller, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
         return await simAws
             .accountRegionScope(accountRegionScope.accountId, stack.regionName)
             .cloudFormation()
@@ -35,6 +35,7 @@ export class SimCfnCdkOutDeployer {
             templatePath: stack.templatePath,
             stackName: stack.stackName,
             ...options,
+            caller: caller ?? plan.caller,
             transform: cdkOutBoundTransform(transform, deployed),
         });
     }