@kensio/yulin 1.21.17 → 1.21.19

package/dist/service/athena/engine/sim-athena-engine-answer.d.ts

@@ -0,0 +1,29 @@
+import type { SimAthenaResolvedResult } from "../result/sim-athena-resolved-result.js";
+/**
+ * What the engine came to for one query.
+ *
+ * A turn-down carries why, because a strict engine fails the query with it and
+ * a reader of that failing test has to learn which of them it hit.
+ */
+export interface SimAthenaEngineAnswer {
+    /** The rows, where the engine ran the statement. */
+    readonly result: SimAthenaResolvedResult | undefined;
+    /** What the engine could not do, where it turned the query down. */
+    readonly turnedDown: string | undefined;
+    /** Why Athena refuses the statement, where the engine found it invalid. */
+    readonly rejected: string | undefined;
+}
+/** One answer the engine ran for real. */
+export declare function simAthenaEngineAnswered(result: SimAthenaResolvedResult): SimAthenaEngineAnswer;
+/** One query the engine turned down, and why. */
+export declare function simAthenaEngineTurnedDown(turnedDown: string): SimAthenaEngineAnswer;
+/**
+ * One statement Athena refuses, and why.
+ *
+ * The engine ran nothing. A query that reaches this fails whether or not the
+ * engine is strict, since the alternative is a green test on SQL the service
+ * rejects.
+ */
+export declare function simAthenaEngineRejected(rejected: string): SimAthenaEngineAnswer;
+/** An engine nobody turned on, which has no opinion about the query. */
+export declare function simAthenaEngineSilent(): SimAthenaEngineAnswer;

package/dist/service/athena/engine/sim-athena-engine-answer.js

@@ -0,0 +1,22 @@
+/** One answer the engine ran for real. */
+export function simAthenaEngineAnswered(result) {
+    return { result, turnedDown: undefined, rejected: undefined };
+}
+/** One query the engine turned down, and why. */
+export function simAthenaEngineTurnedDown(turnedDown) {
+    return { result: undefined, turnedDown, rejected: undefined };
+}
+/**
+ * One statement Athena refuses, and why.
+ *
+ * The engine ran nothing. A query that reaches this fails whether or not the
+ * engine is strict, since the alternative is a green test on SQL the service
+ * rejects.
+ */
+export function simAthenaEngineRejected(rejected) {
+    return { result: undefined, turnedDown: undefined, rejected };
+}
+/** An engine nobody turned on, which has no opinion about the query. */
+export function simAthenaEngineSilent() {
+    return { result: undefined, turnedDown: undefined, rejected: undefined };
+}

package/dist/service/athena/engine/sim-athena-engine-run.d.ts

@@ -1,25 +1,9 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAthenaPlannedTable } from "../execution/sim-athena-query-refusal.js";
-import type { SimAthenaResolvedResult } from "../result/sim-athena-resolved-result.js";
+import { type SimAthenaEngineAnswer } from "./sim-athena-engine-answer.js";
 import type { SimAthenaSqlParser } from "./sim-athena-parser-module.js";
 import type { SimAthenaSqliteModule } from "./sim-athena-sqlite-module.js";
 import type { SimAthenaTableObjects } from "./sim-athena-table-objects.js";
-/**
- * What the engine came to for one query.
- *
- * A turn-down carries why, because a strict engine fails the query with it and
- * a reader of that failing test has to learn which of them it hit.
- */
-export interface SimAthenaEngineAnswer {
-    /** The rows, where the engine ran the statement. */
-    readonly result: SimAthenaResolvedResult | undefined;
-    /** What the engine could not do, where it turned the query down. */
-    readonly turnedDown: string | undefined;
-}
-/** One answer the engine ran for real. */
-export declare function simAthenaEngineAnswered(result: SimAthenaResolvedResult): SimAthenaEngineAnswer;
-/** One query the engine turned down, and why. */
-export declare function simAthenaEngineTurnedDown(turnedDown: string): SimAthenaEngineAnswer;
 /** What one query is run with, once the engine is on and has somewhere to read. */
 export interface SimAthenaEngineRun {
     readonly parser: SimAthenaSqlParser;

package/dist/service/athena/engine/sim-athena-engine-run.js

@@ -1,15 +1,8 @@
+import { simAthenaEngineAnswered, simAthenaEngineTurnedDown, } from "./sim-athena-engine-answer.js";
 import { simAthenaRunFailure } from "./sim-athena-turn-down.js";
 import { simAthenaEngineResult } from "./sim-athena-engine-result.js";
 import { simAthenaSqliteDatabase } from "./sim-athena-sqlite-database.js";
 import { simAthenaLoadedTables } from "./sim-athena-loaded-tables.js";
-/** One answer the engine ran for real. */
-export function simAthenaEngineAnswered(result) {
-    return { result, turnedDown: undefined };
-}
-/** One query the engine turned down, and why. */
-export function simAthenaEngineTurnedDown(turnedDown) {
-    return { result: undefined, turnedDown };
-}
 /**
  * Load the tables, build the database and run the statement.
  *

package/dist/service/athena/engine/sim-athena-query-engine.d.ts

@@ -1,6 +1,6 @@
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAthenaPlannedTable } from "../execution/sim-athena-query-refusal.js";
-import { type SimAthenaEngineAnswer } from "./sim-athena-engine-run.js";
+import { type SimAthenaEngineAnswer } from "./sim-athena-engine-answer.js";
 import type { SimAthenaTableObjects } from "./sim-athena-table-objects.js";
 /** How one scope's engine is turned on. */
 export interface SimAthenaEngineOptions {

package/dist/service/athena/engine/sim-athena-query-engine.js

@@ -1,4 +1,5 @@
-import { simAthenaEngineRun, simAthenaEngineTurnedDown, } from "./sim-athena-engine-run.js";
+import { simAthenaEngineRejected, simAthenaEngineSilent, simAthenaEngineTurnedDown, } from "./sim-athena-engine-answer.js";
+import { simAthenaEngineRun } from "./sim-athena-engine-run.js";
 import { simAthenaSqlParser, } from "./sim-athena-parser-module.js";
 import { simAthenaSqliteModule, } from "./sim-athena-sqlite-module.js";
 import { simAthenaSqliteSql } from "./sim-athena-sql-translation.js";
@@ -63,7 +64,7 @@ export class SimAthenaQueryEngine {
         const sqlite = this.#sqlite;
         const { objects } = request;
         if (parser === undefined || sqlite === undefined) {
-            return { result: undefined, turnedDown: undefined };
+            return simAthenaEngineSilent();
         }
         if (objects === undefined) {
             return simAthenaEngineTurnedDown(simAthenaNoObjects);
@@ -73,6 +74,9 @@ export class SimAthenaQueryEngine {
             athenaSql: request.queryString,
             tables: request.tables.map((planned) => planned.table),
         });
+        if (translated.rejected !== undefined) {
+            return simAthenaEngineRejected(translated.rejected);
+        }
         return translated.sql === undefined
             ? simAthenaEngineTurnedDown(translated.turnedDown)
             : simAthenaEngineRun({

package/dist/service/athena/engine/sim-athena-rejected-statement.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Why Athena refuses one parsed statement, where it does.
+ *
+ * Everything here is a statement SQLite runs happily and the real service
+ * rejects. A translation that hands such a statement to SQLite answers a test
+ * with rows, and the command then fails against AWS. Each shape is spotted on
+ * the tree the Athena grammar produced, before anything is written out for
+ * SQLite.
+ *
+ * Trino and SQLite resolve names by different rules in more places than this.
+ * One shape is covered, the one seen reaching production. Add the next when a
+ * query hits it.
+ */
+export declare function simAthenaRejectedStatement(ast: unknown): string | undefined;

package/dist/service/athena/engine/sim-athena-rejected-statement.js

@@ -0,0 +1,103 @@
+import { isColumnRef, simAthenaAstNodes, } from "./sim-athena-ast-nodes.js";
+/**
+ * Why Athena refuses one parsed statement, where it does.
+ *
+ * Everything here is a statement SQLite runs happily and the real service
+ * rejects. A translation that hands such a statement to SQLite answers a test
+ * with rows, and the command then fails against AWS. Each shape is spotted on
+ * the tree the Athena grammar produced, before anything is written out for
+ * SQLite.
+ *
+ * Trino and SQLite resolve names by different rules in more places than this.
+ * One shape is covered, the one seen reaching production. Add the next when a
+ * query hits it.
+ */
+export function simAthenaRejectedStatement(ast) {
+    for (const node of simAthenaAstNodes(ast)) {
+        const sort = node["orderby"];
+        const columns = node["columns"];
+        if (!Array.isArray(sort) || !Array.isArray(columns)) {
+            continue;
+        }
+        const alias = aggregatedAlias(sort, columns);
+        if (alias !== undefined) {
+            return orderByAggregateOverAlias(alias);
+        }
+    }
+    return undefined;
+}
+/** What Athena says about an `ORDER BY` aggregate over an aggregate alias. */
+function orderByAggregateOverAlias(alias) {
+    return (`Athena refuses this statement. Its ORDER BY aggregates over ${alias}, ` +
+        `and the select list names ${alias} as the output alias of an aggregate. ` +
+        `Trino resolves a bare name in ORDER BY against the select list before ` +
+        `the table. That makes the sort an aggregate over an aggregate, and the ` +
+        `service answers "Invalid reference to output projection attribute from ` +
+        `ORDER BY aggregation". Sort by ${alias} on its own, or give the alias a ` +
+        `name the sort leaves alone.`);
+}
+/**
+ * The output alias one `ORDER BY` aggregates over, where the alias aggregates
+ * too.
+ *
+ * A select list of `sum(qty) AS qty` sorted by `ORDER BY sum(qty)` is the
+ * shape. SQLite reads that `qty` as the table's column and sorts correctly.
+ * Trino reads it as the alias and refuses the query.
+ *
+ * `ORDER BY qty` over the same select list is the form Athena takes, with no
+ * aggregate wrapped around the name. An aggregate over a name the select list
+ * leaves alone is legal too, as in `ORDER BY sum(revenue_total)` beside
+ * `coalesce(sum(revenue_total), 0) AS revenue`. The aliases are what tell this
+ * shape from those two.
+ */
+function aggregatedAlias(sort, columns) {
+    const aliases = aggregateAliases(columns);
+    if (aliases.size === 0) {
+        return undefined;
+    }
+    for (const node of simAthenaAstNodes(sort)) {
+        if (!isAggregate(node)) {
+            continue;
+        }
+        const arguments_ = simAthenaAstNodes(node["args"]);
+        for (const inner of arguments_) {
+            const alias = isColumnRef(inner) && inner.table === null
+                ? aliases.get(inner.column.toLowerCase())
+                : undefined;
+            if (alias !== undefined) {
+                return alias;
+            }
+        }
+    }
+    return undefined;
+}
+/** Every output alias of one select list whose own expression aggregates. */
+function aggregateAliases(columns) {
+    const aliases = new Map();
+    for (const column of columns) {
+        const alias = column["as"];
+        if (typeof alias === "string" && holdsAggregate(column["expr"])) {
+            aliases.set(alias.toLowerCase(), alias);
+        }
+    }
+    return aliases;
+}
+/** Whether anything under this expression aggregates. */
+function holdsAggregate(expression) {
+    for (const node of simAthenaAstNodes(expression)) {
+        if (isAggregate(node)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Whether this node is a grouped aggregate call.
+ *
+ * A window function carries `over` and is computed once the grouped aggregates
+ * have been. It takes an output alias in `ORDER BY` happily, and stays out of
+ * this.
+ */
+function isAggregate(node) {
+    return node["type"] === "aggr_func" && (node["over"] ?? null) === null;
+}

package/dist/service/athena/engine/sim-athena-sql-translation.d.ts

@@ -1,12 +1,18 @@
 import type { SimAthenaCatalogTable } from "../table/sim-athena-catalog-table.js";
 import type { SimAthenaSqlParser } from "./sim-athena-parser-module.js";
-/** One statement translated for SQLite, or why it could not be. */
+/** One statement translated for SQLite, or why it was not. */
 export type SimAthenaTranslatedSql = {
     readonly sql: string;
     readonly turnedDown: undefined;
+    readonly rejected: undefined;
 } | {
     readonly sql: undefined;
     readonly turnedDown: string;
+    readonly rejected: undefined;
+} | {
+    readonly sql: undefined;
+    readonly turnedDown: undefined;
+    readonly rejected: string;
 };
 interface SimAthenaSqlTranslationRequest {
     readonly parser: SimAthenaSqlParser;
@@ -15,13 +21,18 @@ interface SimAthenaSqlTranslationRequest {
     readonly tables: readonly SimAthenaCatalogTable[];
 }
 /**
- * One Athena statement written back out for SQLite, or why it cannot be.
+ * One Athena statement written back out for SQLite, or why it is not.
+ *
+ * Three things turn the query down, and each is told apart because a strict
+ * engine fails the query with the reason. The Athena grammar can refuse the
+ * statement, an `UNNEST` in it can have no `json_each` to become, and the
+ * parser can decline to write the statement back out. A lenient engine answers
+ * all three the same way, by letting the declared result take the query.
  *
- * Three things stop it, and each is told apart because a strict engine fails
- * the query with the reason. The Athena grammar can refuse the statement, an
- * `UNNEST` in it can have no `json_each` to become, and the parser can decline
- * to write the statement back out. A lenient engine answers all three the same
- * way, by turning the query down and letting the declared result take it.
+ * A rejection is the fourth outcome and a different thing. The statement
+ * parsed, and Athena would still refuse to run it. That fails the query
+ * whether or not the engine is strict, since falling back would leave a test
+ * green on SQL the service rejects.
  */
 export declare function simAthenaSqliteSql(request: SimAthenaSqlTranslationRequest): SimAthenaTranslatedSql;
 export {};

package/dist/service/athena/engine/sim-athena-sql-translation.js

@@ -1,14 +1,20 @@
 import { simAthenaSqlForParser, simAthenaSqlForSqlite, } from "./sim-athena-sql-rewrites.js";
 import { simAthenaUnparsedStatement, simAthenaUnrewrittenUnnest, simAthenaUnwrittenStatement, } from "./sim-athena-turn-down.js";
+import { simAthenaRejectedStatement } from "./sim-athena-rejected-statement.js";
 import { simAthenaRewriteUnnest } from "./sim-athena-unnest-rewrite.js";
 /**
- * One Athena statement written back out for SQLite, or why it cannot be.
+ * One Athena statement written back out for SQLite, or why it is not.
  *
- * Three things stop it, and each is told apart because a strict engine fails
- * the query with the reason. The Athena grammar can refuse the statement, an
- * `UNNEST` in it can have no `json_each` to become, and the parser can decline
- * to write the statement back out. A lenient engine answers all three the same
- * way, by turning the query down and letting the declared result take it.
+ * Three things turn the query down, and each is told apart because a strict
+ * engine fails the query with the reason. The Athena grammar can refuse the
+ * statement, an `UNNEST` in it can have no `json_each` to become, and the
+ * parser can decline to write the statement back out. A lenient engine answers
+ * all three the same way, by letting the declared result take the query.
+ *
+ * A rejection is the fourth outcome and a different thing. The statement
+ * parsed, and Athena would still refuse to run it. That fails the query
+ * whether or not the engine is strict, since falling back would leave a test
+ * green on SQL the service rejects.
  */
 export function simAthenaSqliteSql(request) {
     const { parser } = request;
@@ -21,6 +27,10 @@ export function simAthenaSqliteSql(request) {
     catch {
         return turnedDown(simAthenaUnparsedStatement);
     }
+    const rejected = simAthenaRejectedStatement(ast);
+    if (rejected !== undefined) {
+        return { sql: undefined, turnedDown: undefined, rejected };
+    }
     try {
         if (!simAthenaRewriteUnnest({
             ast,
@@ -32,6 +42,7 @@ export function simAthenaSqliteSql(request) {
         return {
             sql: simAthenaSqlForSqlite(parser.sqlify(ast, { database: "sqlite" })),
             turnedDown: undefined,
+            rejected: undefined,
         };
     }
     catch {
@@ -39,5 +50,5 @@ export function simAthenaSqliteSql(request) {
     }
 }
 function turnedDown(reason) {
-    return { sql: undefined, turnedDown: reason };
+    return { sql: undefined, turnedDown: reason, rejected: undefined };
 }

package/dist/service/athena/result/sim-athena-query-answer.d.ts

@@ -48,6 +48,10 @@ interface SimAthenaQueryAnswerRequest {
  * A strict engine is the exception, and it fails the query it turned down.
  * The declaration keeps its place ahead of that, since a test writing one
  * against this exact statement has already said what the engine gets wrong.
+ *
+ * A statement Athena refuses fails whichever mode the engine is in. That is
+ * SQL the service would never have run, and falling back would leave the query
+ * green on it.
  */
 export declare function simAthenaQueryAnswer(request: SimAthenaQueryAnswerRequest): Promise<SimAthenaQueryAnswer>;
 export {};

package/dist/service/athena/result/sim-athena-query-answer.js

@@ -15,6 +15,10 @@ import { simAthenaStrictRefusal } from "../engine/sim-athena-turn-down.js";
  * A strict engine is the exception, and it fails the query it turned down.
  * The declaration keeps its place ahead of that, since a test writing one
  * against this exact statement has already said what the engine gets wrong.
+ *
+ * A statement Athena refuses fails whichever mode the engine is in. That is
+ * SQL the service would never have run, and falling back would leave the query
+ * green on it.
  */
 export async function simAthenaQueryAnswer(request) {
     const forQuery = request.results.declaredForQuery(request.queryString);
@@ -35,7 +39,7 @@ export async function simAthenaQueryAnswer(request) {
     return {
         result: request.declared,
         source: "declaration",
-        refusal: strictRefusal(request.engine, computed.turnedDown),
+        refusal: computed.rejected ?? strictRefusal(request.engine, computed.turnedDown),
     };
 }
 /**

package/dist/service/cloudformation/cdk/provider/sim-cdk-provider-invoke-arn.d.ts

@@ -0,0 +1,13 @@
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+import { type SimLambdaFunctionArn } from "../../../lambda/function/sim-lambda-function-configuration.js";
+/**
+ * The provider function a custom Resource's `ServiceToken` names, as an ARN.
+ *
+ * Nothing comes back where the Resource names no provider this Stack can put
+ * an ARN to. A `ServiceToken` built from a Parameter, or one pointing at a
+ * Resource type that is not a function, both leave the deployment with nothing
+ * to authorize against, and inventing an ARN for it would refuse a template
+ * over a permission real CloudFormation never asked for.
+ */
+export declare function simCdkProviderInvokeArn(resolvedProperties: SimCfnTemplateValueRecord, resources: ReadonlyMap<string, SimCfnResource>): SimLambdaFunctionArn | undefined;

package/dist/service/cloudformation/cdk/provider/sim-cdk-provider-invoke-arn.js

@@ -0,0 +1,63 @@
+import { namesSimCfnUnansweredAttribute } from "../../resource/cfn/sim-cfn-unanswered-attribute.js";
+import { parseSimLambdaFunctionArn } from "../../../lambda/function/sim-lambda-function-arn-parts.js";
+import { simLambdaFunctionArn, } from "../../../lambda/function/sim-lambda-function-configuration.js";
+const lambdaFunctionResourceType = "AWS::Lambda::Function";
+/**
+ * The provider function a custom Resource's `ServiceToken` names, as an ARN.
+ *
+ * Nothing comes back where the Resource names no provider this Stack can put
+ * an ARN to. A `ServiceToken` built from a Parameter, or one pointing at a
+ * Resource type that is not a function, both leave the deployment with nothing
+ * to authorize against, and inventing an ARN for it would refuse a template
+ * over a permission real CloudFormation never asked for.
+ */
+export function simCdkProviderInvokeArn(resolvedProperties, resources) {
+    const serviceToken = resolvedProperties["ServiceToken"];
+    if (typeof serviceToken !== "string" || serviceToken === "") {
+        return undefined;
+    }
+    return (writtenFunctionArn(serviceToken) ??
+        standInFunctionArn(serviceToken, resources));
+}
+/**
+ * The ARN a `ServiceToken` already carries.
+ *
+ * A provider deployed outside this Stack is named by its ARN outright, and a
+ * template written by hand can name one in the same Stack that way too.
+ */
+function writtenFunctionArn(serviceToken) {
+    return parseSimLambdaFunctionArn(serviceToken) === undefined
+        ? undefined
+        : serviceToken;
+}
+/**
+ * The ARN behind a `ServiceToken` that resolved to an attribute stand-in.
+ *
+ * CDK writes `ServiceToken` as an `Fn::GetAtt` for the provider function's
+ * `Arn`, and this simulator leaves that provider uncreated: the function is
+ * declined on its Python runtime and then reported as scaffolding for the
+ * custom Resource the simulator carries out itself. An uncreated Resource
+ * answers `Fn::GetAtt` with {@link namesSimCfnUnansweredAttribute}'s stand-in
+ * rather than an ARN.
+ *
+ * The name survives that refusal. Sim Lambda works out the name real
+ * CloudFormation would have given the function before declining it, so the
+ * Resource's `Ref` holds a function name to build the ARN from. A provider
+ * that reached neither creation nor a name has only its logical ID behind
+ * `Ref`, and an ARN built from that would be denied by a policy naming the
+ * function real CloudFormation invokes.
+ */
+function standInFunctionArn(serviceToken, resources) {
+    if (!namesSimCfnUnansweredAttribute(serviceToken, resources.keys())) {
+        return undefined;
+    }
+    const provider = resources.get(serviceToken.split(".", 1)[0] ?? "");
+    if (provider?.type !== lambdaFunctionResourceType ||
+        (!provider.deployed && provider.uncreatedPhysicalName === undefined)) {
+        return undefined;
+    }
+    const { refValue } = provider;
+    return typeof refValue === "string" && refValue !== ""
+        ? simLambdaFunctionArn(provider.accountRegionScope, refValue)
+        : undefined;
+}

package/dist/service/cloudformation/cdk/provider/sim-cdk-provider-invoke-auth-z.d.ts

@@ -0,0 +1,36 @@
+import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCloudFormationParsedResourceType } from "../../resource/factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+/**
+ * What authorizing one custom Resource's provider invoke needs.
+ */
+export interface SimCdkProviderInvokeAuthZProperties {
+    readonly resourceType: SimCloudFormationParsedResourceType;
+    readonly resource: SimCfnResource;
+    readonly resolvedProperties: SimCfnTemplateValueRecord;
+    readonly resources: ReadonlyMap<string, SimCfnResource>;
+    readonly simAws: SimAws;
+    readonly caller?: SimAwsCaller | undefined;
+}
+/**
+ * Authorize the invoke a custom Resource costs the deployment.
+ *
+ * Real CloudFormation answers a `Custom::` Resource by invoking the function
+ * its `ServiceToken` names, as the Stack's execution role. That invoke is the
+ * first thing a deployment pays for, and a role without `lambda:InvokeFunction`
+ * on the provider fails the Stack there rather than at the work the provider
+ * would have done.
+ *
+ * This simulator carries several custom Resources out itself instead of
+ * running the provider, which leaves the invoke unpaid for unless it is
+ * authorized here. A deploy Role standing in for a real CloudFormation
+ * execution policy is meant to fail the same template the real one refuses.
+ *
+ * Only the caller's identity policies decide it. The provider function is
+ * uncreated in the usual case, so there is no simulated function holding a
+ * resource policy to consult, and CDK grants the invoke on the execution role
+ * anyway.
+ */
+export declare function authorizeSimCdkProviderInvoke(properties: SimCdkProviderInvokeAuthZProperties): void;

package/dist/service/cloudformation/cdk/provider/sim-cdk-provider-invoke-auth-z.js

@@ -0,0 +1,47 @@
+import { simScopeIamAuthZ } from "../../../iam/authorize/sim-iam-region-auth-z.js";
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simCdkProviderInvokeArn } from "./sim-cdk-provider-invoke-arn.js";
+const customResourceProviderName = "Custom";
+const invokeAction = "lambda:InvokeFunction";
+/**
+ * Authorize the invoke a custom Resource costs the deployment.
+ *
+ * Real CloudFormation answers a `Custom::` Resource by invoking the function
+ * its `ServiceToken` names, as the Stack's execution role. That invoke is the
+ * first thing a deployment pays for, and a role without `lambda:InvokeFunction`
+ * on the provider fails the Stack there rather than at the work the provider
+ * would have done.
+ *
+ * This simulator carries several custom Resources out itself instead of
+ * running the provider, which leaves the invoke unpaid for unless it is
+ * authorized here. A deploy Role standing in for a real CloudFormation
+ * execution policy is meant to fail the same template the real one refuses.
+ *
+ * Only the caller's identity policies decide it. The provider function is
+ * uncreated in the usual case, so there is no simulated function holding a
+ * resource policy to consult, and CDK grants the invoke on the execution role
+ * anyway.
+ */
+export function authorizeSimCdkProviderInvoke(properties) {
+    if (properties.resourceType.providerName !== customResourceProviderName) {
+        return;
+    }
+    const functionArn = simCdkProviderInvokeArn(properties.resolvedProperties, properties.resources);
+    if (functionArn === undefined) {
+        return;
+    }
+    const { accountId, regionName } = properties.resource.accountRegionScope;
+    const decision = simScopeIamAuthZ(properties.simAws.accountRegionScope(accountId, regionName)).authorize({
+        action: invokeAction,
+        resource: functionArn,
+        caller: properties.caller,
+    });
+    if (decision.isDenied) {
+        throw new SimIamAccessDenied({
+            principal: decision.caller.principal,
+            reason: decision.denialReason,
+            action: invokeAction,
+            resource: functionArn,
+        });
+    }
+}

package/dist/service/cloudformation/cdk/s3/bucket-notifications/property/sim-cdk-bucket-notification-properties.js

@@ -2,9 +2,11 @@ import { bucketNotificationsError } from "../error/sim-cdk-bucket-notification-e
 /**
  * The properties CDK puts on a Custom::S3BucketNotifications Resource.
  *
- * `ServiceToken` is read and ignored. It points at CDK's own Python provider
- * function, whose whole job is the PutBucketNotificationConfiguration call this
- * factory makes instead.
+ * `ServiceToken` is accepted and read no further here. It points at CDK's own
+ * Python provider function, whose whole job is the
+ * PutBucketNotificationConfiguration call this factory makes instead. The
+ * deployment reads it once more, to authorize the invoke real CloudFormation
+ * makes of that function.
  */
 const knownPropertyNames = new Set([
     "BucketName",

package/dist/service/cloudformation/cdk/s3/bucket-notifications/sim-cdk-bucket-notifications-remover.js

@@ -1,5 +1,6 @@
 import { bucketNotificationsError } from "./error/sim-cdk-bucket-notification-error.js";
 import { SimCdkBucketNotificationProperties } from "./property/sim-cdk-bucket-notification-properties.js";
+import { simCfnResourceCallerOptions } from "../../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * Removes the notification configuration a Custom::S3BucketNotifications
  * Resource put on a Bucket.
@@ -29,6 +30,6 @@ export class SimCdkBucketNotificationsRemover {
                 Bucket: properties.bucketName,
                 NotificationConfiguration: {},
             },
-        });
+        }, simCfnResourceCallerOptions(context.caller));
     }
 }

package/dist/service/cloudformation/cdk/s3/bucket-notifications/sim-cdk-bucket-notifications.d.ts

@@ -16,10 +16,13 @@ import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFo
  * bucket alongside the function's `AWS::Lambda::Permission` is the circular
  * dependency this Resource type exists to break.
  *
- * `ServiceToken` is read for the provider function it names, and otherwise
- * ignored. That function is declined on its runtime, as CDK's BucketDeployment
- * provider is, and recorded as inert rather than as a gap, since this factory
- * has already made the call it would have made.
+ * `ServiceToken` is read for the provider function it names. That function is
+ * declined on its runtime, as CDK's BucketDeployment provider is, and recorded
+ * as inert rather than as a gap, since this factory has already made the call
+ * it would have made. The deployment still pays for the invoke real
+ * CloudFormation makes, which
+ * {@link import("../../provider/sim-cdk-provider-invoke-auth-z.js").authorizeSimCdkProviderInvoke}
+ * authorizes for every custom Resource ahead of its factory.
  */
 export declare class SimCdkBucketNotificationsResourceFactory implements SimCfnServiceResourceFactory {
     /**

package/dist/service/cloudformation/cdk/s3/bucket-notifications/sim-cdk-bucket-notifications.js

@@ -2,6 +2,7 @@ import { SimCdkBucketNotificationConfiguration } from "./configuration/sim-cdk-b
 import { bucketNotificationsError } from "./error/sim-cdk-bucket-notification-error.js";
 import { SimCdkBucketNotificationProperties } from "./property/sim-cdk-bucket-notification-properties.js";
 import { SimCdkBucketNotificationsRemover } from "./sim-cdk-bucket-notifications-remover.js";
+import { simCfnResourceCallerOptions } from "../../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for CDK Bucket event notifications.
  *
@@ -18,10 +19,13 @@ import { SimCdkBucketNotificationsRemover } from "./sim-cdk-bucket-notifications
  * bucket alongside the function's `AWS::Lambda::Permission` is the circular
  * dependency this Resource type exists to break.
  *
- * `ServiceToken` is read for the provider function it names, and otherwise
- * ignored. That function is declined on its runtime, as CDK's BucketDeployment
- * provider is, and recorded as inert rather than as a gap, since this factory
- * has already made the call it would have made.
+ * `ServiceToken` is read for the provider function it names. That function is
+ * declined on its runtime, as CDK's BucketDeployment provider is, and recorded
+ * as inert rather than as a gap, since this factory has already made the call
+ * it would have made. The deployment still pays for the invoke real
+ * CloudFormation makes, which
+ * {@link import("../../provider/sim-cdk-provider-invoke-auth-z.js").authorizeSimCdkProviderInvoke}
+ * authorizes for every custom Resource ahead of its factory.
  */
 export class SimCdkBucketNotificationsResourceFactory {
     /**
@@ -48,7 +52,7 @@ export class SimCdkBucketNotificationsResourceFactory {
                 NotificationConfiguration: configuration,
                 SkipDestinationValidation: properties.skipDestinationValidation,
             },
-        });
+        }, simCfnResourceCallerOptions(context.caller));
         return undefined;
     }
     /**

package/dist/service/cloudformation/cdk/ssm/cross-region-parameter/sim-cdk-cross-region-parameter-properties.js

@@ -5,9 +5,10 @@ import { crossRegionParameterError } from "./sim-cdk-cross-region-parameter-erro
  * The properties CDK puts on a Custom::CrossRegionStringParameterReader
  * Resource.
  *
- * `ServiceToken` is read and ignored. It points at CDK's own provider
- * function, whose whole job is the GetParameter call this factory makes
- * instead. `RefreshToken` is the logical ID of the function version the
+ * `ServiceToken` is accepted and read no further here. It points at CDK's own
+ * provider function, whose whole job is the GetParameter call this factory
+ * makes instead, and the deployment reads it once more to authorize the invoke
+ * real CloudFormation makes of that function. `RefreshToken` is the logical ID of the function version the
  * parameter was written from, and CDK puts it there so that publishing a new
  * version makes CloudFormation run the reader again. The reader here runs on
  * every deployment either way, so the token has nothing left to say.

package/dist/service/cloudformation/cdk/ssm/cross-region-parameter/sim-cdk-cross-region-parameter-reader.js

@@ -2,6 +2,7 @@ import { SimSsmParameterNotFound } from "../../../../ssm/error/sim-ssm.error.js"
 import { crossRegionParameterError, crossRegionParameterResourceTypeName, } from "./sim-cdk-cross-region-parameter-error.js";
 import { SimCdkCrossRegionParameterProperties } from "./sim-cdk-cross-region-parameter-properties.js";
 import { SimCdkCrossRegionParameterReading } from "./sim-cdk-cross-region-parameter-reading.js";
+import { simCfnResourceCallerOptions } from "../../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * CloudFormation Resource factory for CDK's cross-Region parameter reader.
  *
@@ -64,7 +65,7 @@ export class SimCdkCrossRegionParameterReaderResourceFactory {
             const output = await context.simAws
                 .accountRegionScope(resource.accountRegionScope.accountId, regionName)
                 .ssm()
-                .getParameter({ input: { Name: parameterName } });
+                .getParameter({ input: { Name: parameterName } }, simCfnResourceCallerOptions(context.caller));
             return output.Parameter?.Value;
         }
         catch (error) {

package/dist/service/cloudformation/resource/create/sim-cfn-resource-creator.js

@@ -1,6 +1,7 @@
 import { parseSimCloudFormationResourceType } from "../parser/sim-cfn-resource-parser.js";
 import { resolveSimCloudFormationServiceResourceFactory } from "../resolve/service/sim-cfn-service-resolver.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { authorizeSimCdkProviderInvoke } from "../../cdk/provider/sim-cdk-provider-invoke-auth-z.js";
 /**
  * Creates the underlying simulated AWS service Resource for a CloudFormation
  * Resource.
@@ -35,9 +36,18 @@ export class SimCfnResourceCreator {
         const resourceType = parseSimCloudFormationResourceType(type);
         const factory = this.cfnResourceFactory ??
             resolveSimCloudFormationServiceResourceFactory(context.simAws, this.resource.accountRegionScope, resourceType);
+        const resolvedProperties = await this.resource.resolvedProperties(context);
+        authorizeSimCdkProviderInvoke({
+            resourceType,
+            resource: this.resource,
+            resolvedProperties,
+            resources: context.resources,
+            simAws: context.simAws,
+            caller: context.caller,
+        });
         const resolvedContext = {
             ...context,
-            resolvedProperties: await this.resource.resolvedProperties(context),
+            resolvedProperties,
         };
         return await factory.create(resourceType.resourceTypeName, this.resource, resolvedContext);
     }

package/dist/service/cloudformation/resource/delete/sim-cfn-resource-deleter.js

@@ -1,6 +1,7 @@
 import { parseSimCloudFormationResourceType } from "../parser/sim-cfn-resource-parser.js";
 import { resolveSimCloudFormationServiceResourceFactory } from "../resolve/service/sim-cfn-service-resolver.js";
 import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { authorizeSimCdkProviderInvoke } from "../../cdk/provider/sim-cdk-provider-invoke-auth-z.js";
 /**
  * Removes the underlying simulated AWS service Resource for a CloudFormation
  * Resource.
@@ -39,9 +40,18 @@ export class SimCfnResourceDeleter {
         const resourceType = parseSimCloudFormationResourceType(type);
         const factory = this.cfnResourceFactory ??
             resolveSimCloudFormationServiceResourceFactory(context.simAws, this.resource.accountRegionScope, resourceType);
+        const resolvedProperties = await this.resource.resolvedProperties(context);
+        authorizeSimCdkProviderInvoke({
+            resourceType,
+            resource: this.resource,
+            resolvedProperties,
+            resources: context.resources,
+            simAws: context.simAws,
+            caller: context.caller,
+        });
         await factory.delete(resourceType.resourceTypeName, this.resource, {
             ...context,
-            resolvedProperties: await this.resource.resolvedProperties(context),
+            resolvedProperties,
         });
     }
 }

package/docs/services/athena/README.md

@@ -381,6 +381,36 @@ Strict mode is off unless a test asks for it, and `disable()` takes it off with
 declaration written against one exact query text still answers, with no failure, because that is a
 test's own statement about a query the engine gets wrong.
 
+### Failing a statement Athena refuses
+
+One failure ignores strict mode. Where the engine can see that Athena would refuse a statement
+outright, the query fails whether strict mode is on or off. A turn-down means the engine reached its
+limits, and a declaration is a fair answer to that. A rejection means the SQL is invalid, and
+answering from a declaration would leave a test green on a query that fails against AWS.
+
+The one shape it catches today is an `ORDER BY` that aggregates over an output alias which is itself
+an aggregate.
+
+```sql
+SELECT sku, coalesce(sum(qty), 0) AS qty
+FROM rainlytics.lines
+GROUP BY sku
+ORDER BY sum(qty) DESC
+```
+
+Trino resolves the bare `qty` in `ORDER BY` against the select list before the table. The sort then
+asks for an aggregate over an aggregate, and Athena answers `COLUMN_NOT_FOUND: Invalid reference to
+output projection attribute from ORDER BY aggregation`. SQLite resolves the same name against the
+table's column, runs the statement and orders it correctly. That is how a green test shipped a
+command that failed against the service.
+
+`ORDER BY qty DESC` over the same select list is the form Athena takes, and it is what to write.
+`ORDER BY sum(revenue_total) DESC` beside `coalesce(sum(revenue_total), 0) AS revenue` is fine as
+well, since the two names differ and nothing shadows.
+
+Trino and SQLite resolve names by different rules in other places too, and the engine catches this
+one. A statement that behaves differently under the two is worth reporting.
+
 ### The objects it reads
 
 The SerDe class name in the table's storage descriptor says how its objects are decoded.

package/docs/services/cloudformation/README.md

@@ -2549,6 +2549,94 @@ working simulation with a hand-written one.
 The provider is found through the `ServiceToken` its custom resource names it by, not by the logical
 ID CDK generated for it. That ID is a hash of the construct path, and no kind of thing to match on.
 
+### What a custom resource costs the deploy Role
+
+Real CloudFormation answers a `Custom::` resource by invoking the provider function its `ServiceToken`
+names, as the stack's execution role. Yulin carries several of these out itself instead of running the
+provider, and it authorizes that invoke anyway. A deploy Role holding no `lambda:InvokeFunction` on the
+provider fails the stack where the real deployment fails.
+
+The `ServiceToken` decides the ARN. A token written as an ARN is taken as it stands. CDK's `Fn::GetAtt`
+for the provider's `Arn` is resolved back to the function the stack declares, since the provider is
+left uncreated and has no ARN of its own to give.
+
+The work the resource does is authorized too, as the deployment's principal.
+`Custom::S3BucketNotifications` costs `s3:PutBucketNotification` and
+`Custom::CrossRegionStringParameterReader` costs `ssm:GetParameter`. `Custom::CDKBucketDeployment`
+writes its Objects into the simulated Bucket without sending `PutObject`, so nothing there reaches IAM.
+
+```typescript sim-cloudformation-custom-resource-invoke
+/**
+ * A deploy Role refused the provider invoke its custom resource needs.
+ */
+
+import { SimAws } from "@kensio/yulin";
+
+const simAws = new SimAws();
+
+const { Role } = await simAws.iam().createRole({
+  input: {
+    RoleName: "DeployRole",
+    AssumeRolePolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Principal: { Service: "cloudformation.amazonaws.com" },
+          Action: "sts:AssumeRole",
+        },
+      ],
+    }),
+  },
+});
+
+// Everything the template needs apart from the invoke of the provider.
+await simAws.iam().putRolePolicy({
+  input: {
+    RoleName: "DeployRole",
+    PolicyName: "DeployPolicy",
+    PolicyDocument: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: ["cloudformation:*", "s3:*"],
+          Resource: "*",
+        },
+      ],
+    }),
+  },
+});
+
+try {
+  await simAws.cloudFormation().deployTemplate({
+    stackName: "uploads-stack",
+    caller: { kind: "arn", arn: Role.Arn },
+    template: {
+      Resources: {
+        Bucket: {
+          Type: "AWS::S3::Bucket",
+          Properties: { BucketName: "uploads" },
+        },
+        BucketNotifications: {
+          Type: "Custom::S3BucketNotifications",
+          Properties: {
+            ServiceToken: "arn:aws:lambda:us-east-1:888888888888:function:cdk",
+            BucketName: { Ref: "Bucket" },
+            NotificationConfiguration: {},
+            Managed: true,
+          },
+        },
+      },
+    },
+  });
+} catch (error) {
+  // is not authorized to perform: lambda:InvokeFunction on resource:
+  // arn:aws:lambda:us-east-1:888888888888:function:cdk
+  console.log((error as Error).message);
+}
+```
+
 ## S3 Bucket notifications
 
 The `NotificationConfiguration` property of `AWS::S3::Bucket` deploys through the ordinary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.17",
+  "version": "1.21.19",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -299,7 +299,7 @@
     "hyparquet": "^1.29.2",
     "hyparquet-writer": "^0.16.9",
     "node-sql-parser": "^5.4.0",
-    "oxfmt": "^0.65.0",
+    "oxfmt": "^0.66.0",
     "oxlint": "^1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "semantic-release": "25.0.9",