@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-cognito-event.js

@@ -0,0 +1,88 @@
+import { isSamTemplateRecord, samValueList } from "../../sim-cfn-sam-record.js";
+import { samTriggeredUserPool } from "./sim-cfn-sam-triggered-user-pool.js";
+/**
+ * The Resource a `Cognito` event expands into, which is the permission the
+ * pool invokes the function under.
+ *
+ * A user pool checks the function's resource policy every time a trigger
+ * fires, so the entry in its `LambdaConfig` is not enough on its own. The
+ * grant names the pool as the source, so a permission written for one pool
+ * does not open the function to another.
+ *
+ * The pool is not made to depend on the permission. Cognito reads the policy
+ * when the trigger fires rather than when the pool is created, and a pool
+ * depending on a permission that names the pool is the circular dependency
+ * CloudFormation refuses.
+ */
+export function samCognitoEventResources(event) {
+    const trigger = samCognitoTrigger(event);
+    if (trigger === undefined) {
+        return {};
+    }
+    return {
+        [`${event.functionLogicalId}${event.eventName}CognitoPermission`]: {
+            Type: "AWS::Lambda::Permission",
+            ...event.condition,
+            Properties: {
+                Action: "lambda:InvokeFunction",
+                FunctionName: { "Fn::GetAtt": [event.functionLogicalId, "Arn"] },
+                Principal: "cognito-idp.amazonaws.com",
+                SourceArn: { "Fn::GetAtt": [trigger.userPoolLogicalId, "Arn"] },
+            },
+        },
+    };
+}
+/**
+ * The change a `Cognito` event makes to the user pool the template already
+ * declares.
+ *
+ * A trigger is a property of the pool, so this is the second event type with
+ * no Resource of its own to be.
+ */
+export function samCognitoEventEdits(event) {
+    const trigger = samCognitoTrigger(event);
+    if (trigger === undefined) {
+        return [];
+    }
+    return [
+        {
+            logicalId: trigger.userPoolLogicalId,
+            edit: (resource) => samTriggeredUserPool(event, trigger.triggers, resource),
+        },
+    ];
+}
+/**
+ * What the event asks of the pool, or nothing where it named no pool or no
+ * trigger.
+ *
+ * Either one missing leaves the function as it is rather than failing the
+ * deployment, the same answer an event of a type nothing expands gets.
+ *
+ * `UserPool` is the logical ID of a pool of this template, written as the name
+ * or as a `Ref` to it, which is what SAM accepts. A pool named any other way is
+ * a pool this cannot reach to put a trigger on.
+ */
+function samCognitoTrigger(event) {
+    const userPoolLogicalId = logicalIdOf(event.properties["UserPool"]);
+    const triggers = triggerNames(event.properties["Trigger"]);
+    if (userPoolLogicalId === undefined || triggers.length === 0) {
+        return undefined;
+    }
+    return { userPoolLogicalId, triggers };
+}
+function logicalIdOf(userPool) {
+    if (typeof userPool === "string") {
+        return userPool;
+    }
+    const reference = isSamTemplateRecord(userPool) ? userPool["Ref"] : undefined;
+    return typeof reference === "string" ? reference : undefined;
+}
+/**
+ * The triggers the event names, which SAM states as one name or as a list.
+ */
+function triggerNames(trigger) {
+    if (typeof trigger === "string") {
+        return [trigger];
+    }
+    return samValueList(trigger).filter((name) => typeof name === "string");
+}

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-declared-event.d.ts

@@ -1,4 +1,5 @@
 import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamTemplateApiAuth } from "../../api/auth/sim-cfn-sam-template-api-auth.js";
 /**
  * What the expansion of a SAM function is asked about its events.
  */
@@ -12,6 +13,11 @@ export interface SamFunctionEventsProperties {
      * an API of their own.
      */
     readonly apiGlobals: SimCfnTemplateValueRecord;
+    /**
+     * The `Auth` of every API of the template, for the events that put a method
+     * or a route on one.
+     */
+    readonly apiAuth: SamTemplateApiAuth;
     /** The `Condition` the SAM Resource carried, where it carried one. */
     readonly condition: SimCfnTemplateValue | undefined;
 }
@@ -43,6 +49,12 @@ export interface SamFunctionEvent {
      * defaults as one the template declared.
      */
     readonly apiGlobals: SimCfnTemplateValueRecord;
+    /**
+     * The `Auth` of every API of the template, by the logical ID each is expanded
+     * under. An `Api` or `HttpApi` event reads the one belonging to the API it
+     * names, to say how the method or route it expands into is authorized.
+     */
+    readonly apiAuth: SamTemplateApiAuth;
 }
 /**
  * One event of a function, as the expansion tables are asked about it.

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-declared-event.js

@@ -32,6 +32,7 @@ function declaredEvent(properties, eventName, event) {
                 properties: isSamTemplateRecord(eventProperties) ? eventProperties : {},
                 condition: samConditionAttribute(properties.condition),
                 apiGlobals: properties.apiGlobals,
+                apiAuth: properties.apiAuth,
             },
         },
     ];

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-function-events.js

@@ -2,6 +2,7 @@ import { samDeclaredEvents } from "./sim-cfn-sam-declared-event.js";
 import { samDynamoDbEventResources, samSqsEventResources, } from "./sim-cfn-sam-event-source-mapping-event.js";
 import { samDynamoDbEventEdits, samSqsEventEdits, } from "./sim-cfn-sam-event-source-role.js";
 import { samApiEventResources } from "./sim-cfn-sam-api-event.js";
+import { samCognitoEventEdits, samCognitoEventResources, } from "./sim-cfn-sam-cognito-event.js";
 import { samEventBridgeRuleEventResources } from "./sim-cfn-sam-event-bridge-rule-event.js";
 import { samHttpApiEventResources } from "./sim-cfn-sam-http-api-event.js";
 import { samS3EventEdits, samS3EventResources, } from "./sim-cfn-sam-s3-event.js";
@@ -19,6 +20,7 @@ import { samSnsEventResources } from "./sim-cfn-sam-sns-event.js";
  */
 const eventExpansions = new Map([
     ["Api", samApiEventResources],
+    ["Cognito", samCognitoEventResources],
     ["DynamoDB", samDynamoDbEventResources],
     ["EventBridgeRule", samEventBridgeRuleEventResources],
     ["HttpApi", samHttpApiEventResources],
@@ -34,15 +36,16 @@ const eventExpansions = new Map([
  *
  * This is the second half of the same table, for what an event cannot express
  * as a Resource of its own. An `S3` event notifies a Bucket the template
- * declares, and a polled event grants the function's own execution Role the
- * permission to poll. Keying either by the logical ID it changes would deploy
- * the change in place of the Resource, since expanded Resources are merged
- * last write wins.
+ * declares, a `Cognito` event puts a trigger on a user pool, and a polled event
+ * grants the function's own execution Role the permission to poll. Keying any
+ * of them by the logical ID it changes would deploy the change in place of the
+ * Resource, since expanded Resources are merged last write wins.
  *
- * An event type belongs in both tables where it does both, as all three of
+ * An event type belongs in both tables where it does both, as all four of
  * these do.
  */
 const eventEdits = new Map([
+    ["Cognito", samCognitoEventEdits],
     ["DynamoDB", samDynamoDbEventEdits],
     ["S3", samS3EventEdits],
     ["SQS", samSqsEventEdits],

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-event.js

@@ -20,14 +20,16 @@ import { samImplicitHttpApiLogicalId, samImplicitHttpApiResources, } from "./sim
  */
 export function samHttpApiEventResources(event) {
     const apiId = samHttpApiEventApiId(event.properties);
+    const apiLogicalId = samHttpApiEventApiLogicalId(event.properties);
     const prefix = `${event.functionLogicalId}${event.eventName}HttpApi`;
     const integrationLogicalId = `${prefix}Integration`;
     return {
         ...(event.properties["ApiId"] === undefined &&
-            samImplicitHttpApiResources()),
+            samImplicitHttpApiResources(event.apiAuth.get(samImplicitHttpApiLogicalId))),
         [integrationLogicalId]: integrationResource(event, apiId),
         [`${prefix}Route`]: samHttpApiRouteResource({
             apiId,
+            apiLogicalId,
             integrationLogicalId,
             event,
         }),
@@ -54,6 +56,26 @@ function samHttpApiEventApiId(properties) {
     }
     return isSamTemplateRecord(apiId) ? apiId : { Ref: apiId };
 }
+/**
+ * The logical ID of the API this event routes to, where that API is a Resource
+ * of this template.
+ *
+ * It is the name the event's `Auth` is read against, since an API's
+ * authorizers are declared on the API the template holds. An `ApiId` written
+ * as an intrinsic this cannot read names an API whose `Auth` block is out of
+ * reach, and the route it expands into takes no authorizer from it.
+ */
+function samHttpApiEventApiLogicalId(properties) {
+    const apiId = properties["ApiId"];
+    if (apiId === undefined) {
+        return samImplicitHttpApiLogicalId;
+    }
+    if (typeof apiId === "string") {
+        return apiId;
+    }
+    const reference = isSamTemplateRecord(apiId) ? apiId["Ref"] : undefined;
+    return typeof reference === "string" ? reference : undefined;
+}
 /**
  * The AWS::ApiGatewayV2::Integration the route sends its requests through.
  *

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-route.d.ts

@@ -5,13 +5,20 @@ interface SamHttpApiRouteProperties {
     readonly apiId: SimCfnTemplateValue;
     /** The logical ID of the integration the route targets. */
     readonly integrationLogicalId: string;
+    /**
+     * The logical ID of the API the route belongs to, where the API is one this
+     * template declares. An event naming its API with an intrinsic this cannot
+     * read names no `Auth` block either.
+     */
+    readonly apiLogicalId: string | undefined;
     readonly event: SamFunctionEvent;
 }
 /**
  * The AWS::ApiGatewayV2::Route the event's path and method are served by.
  *
- * `Auth` on the event is not expanded. The route authorizes nothing, and every
- * request matching it reaches the function.
+ * `Auth` on the event names one of the API's authorizers, and an event naming
+ * none takes the API's `DefaultAuthorizer`. A route neither of them closes
+ * authorizes nothing, and every request matching it reaches the function.
  */
 export declare function samHttpApiRouteResource(route: SamHttpApiRouteProperties): SimCfnTemplateValueRecord;
 export {};

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-route.js

@@ -1,10 +1,12 @@
 import { simHttpApiDefaultRouteKey } from "../../../../apigatewayv2/api/route/key/sim-http-api-default-route-key.js";
 import { simHttpApiAnyMethod } from "../../../../apigatewayv2/api/route/key/sim-http-api-route-method.js";
+import { samEventAuthorization } from "../../api/auth/sim-cfn-sam-event-authorization.js";
 /**
  * The AWS::ApiGatewayV2::Route the event's path and method are served by.
  *
- * `Auth` on the event is not expanded. The route authorizes nothing, and every
- * request matching it reaches the function.
+ * `Auth` on the event names one of the API's authorizers, and an event naming
+ * none takes the API's `DefaultAuthorizer`. A route neither of them closes
+ * authorizes nothing, and every request matching it reaches the function.
  */
 export function samHttpApiRouteResource(route) {
     return {
@@ -13,7 +15,7 @@ export function samHttpApiRouteResource(route) {
         Properties: {
             ApiId: route.apiId,
             ...samHttpApiRouteKey(route.event.properties),
-            AuthorizationType: "NONE",
+            ...samEventAuthorization(route.event, route.apiLogicalId),
             Target: {
                 "Fn::Join": [
                     "",

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-implicit-http-api.d.ts

@@ -1,4 +1,5 @@
 import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuth } from "../../api/auth/sim-cfn-sam-api-auth.types.js";
 /**
  * The logical ID SAM gives the API that every `HttpApi` event naming no
  * `ApiId` shares. It is the name a template reaches the implicit API by, in an
@@ -15,5 +16,9 @@ export declare const samImplicitHttpApiLogicalId = "ServerlessHttpApi";
  *
  * Every event naming no `ApiId` produces this same pair, and they are keyed by
  * logical ID, so the API is created once however many events share it.
+ *
+ * The `Auth` it takes is the one `Globals.HttpApi` states, which is where SAM
+ * says an implicit API's authorizers come from. Nothing else of that section
+ * reaches this API.
  */
-export declare function samImplicitHttpApiResources(): Record<string, SimCfnTemplateValue>;
+export declare function samImplicitHttpApiResources(auth: SamApiAuth | undefined): Record<string, SimCfnTemplateValue>;

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-implicit-http-api.js

@@ -1,3 +1,4 @@
+import { samApiAuthResources } from "../../api/auth/sim-cfn-sam-api-auth.js";
 /**
  * The logical ID SAM gives the API that every `HttpApi` event naming no
  * `ApiId` shares. It is the name a template reaches the implicit API by, in an
@@ -18,8 +19,12 @@ const implicitStageLogicalId = `${samImplicitHttpApiLogicalId}ApiGatewayDefaultS
  *
  * Every event naming no `ApiId` produces this same pair, and they are keyed by
  * logical ID, so the API is created once however many events share it.
+ *
+ * The `Auth` it takes is the one `Globals.HttpApi` states, which is where SAM
+ * says an implicit API's authorizers come from. Nothing else of that section
+ * reaches this API.
  */
-export function samImplicitHttpApiResources() {
+export function samImplicitHttpApiResources(auth) {
     return {
         [samImplicitHttpApiLogicalId]: {
             Type: "AWS::ApiGatewayV2::Api",
@@ -36,5 +41,6 @@ export function samImplicitHttpApiResources() {
                 AutoDeploy: true,
             },
         },
+        ...(auth !== undefined && samApiAuthResources(auth)),
     };
 }

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-triggered-user-pool.d.ts

@@ -0,0 +1,19 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamFunctionEvent } from "./sim-cfn-sam-declared-event.js";
+/**
+ * The user pool with an event's triggers on it.
+ *
+ * What the pool already declared is kept, so a template naming some of its
+ * triggers by hand keeps them and two events on one pool both arrive.
+ *
+ * A trigger the pool already names a function for is refused. The pool runs
+ * one function per trigger, so the alternative is a template whose two
+ * declarations disagree and whose deployment silently picks one.
+ *
+ * The trigger is unconditional even where the function is conditioned. A
+ * `Condition` covers a whole Resource, and there is no conditioning a fragment
+ * of somebody else's property. A template that conditions the function out and
+ * leaves the pool fails on the pool naming a function the Stack never created,
+ * the same answer an `S3` event on a conditioned function gets.
+ */
+export declare function samTriggeredUserPool(event: SamFunctionEvent, triggers: readonly string[], resource: SimCfnTemplateValueRecord): SimCfnTemplateValueRecord;

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-triggered-user-pool.js

@@ -0,0 +1,69 @@
+import { samPropertyError } from "../../sim-cfn-sam-error.js";
+import { isSamTemplateRecord, samRecordAt } from "../../sim-cfn-sam-record.js";
+import { samFunctionType } from "../sim-cfn-sam-function-type.js";
+/**
+ * The user pool with an event's triggers on it.
+ *
+ * What the pool already declared is kept, so a template naming some of its
+ * triggers by hand keeps them and two events on one pool both arrive.
+ *
+ * A trigger the pool already names a function for is refused. The pool runs
+ * one function per trigger, so the alternative is a template whose two
+ * declarations disagree and whose deployment silently picks one.
+ *
+ * The trigger is unconditional even where the function is conditioned. A
+ * `Condition` covers a whole Resource, and there is no conditioning a fragment
+ * of somebody else's property. A template that conditions the function out and
+ * leaves the pool fails on the pool naming a function the Stack never created,
+ * the same answer an `S3` event on a conditioned function gets.
+ */
+export function samTriggeredUserPool(event, triggers, resource) {
+    const properties = samRecordAt(resource, "Properties");
+    const declared = declaredLambdaConfig(event, properties);
+    return {
+        ...resource,
+        Properties: {
+            ...properties,
+            LambdaConfig: {
+                ...declared,
+                ...Object.fromEntries(triggers.map((name) => [name, functionArn(event, declared, name)])),
+            },
+        },
+    };
+}
+/**
+ * The `LambdaConfig` the pool already carries.
+ *
+ * One written as anything but a block of triggers is refused rather than
+ * replaced, since adding to it would drop what it holds. A `LambdaConfig`
+ * written as an intrinsic is a block as far as this can tell, and the event's
+ * triggers go on beside it for the pool to refuse the unresolved key by name.
+ */
+function declaredLambdaConfig(event, properties) {
+    const declared = properties["LambdaConfig"];
+    if (declared !== undefined && !isSamTemplateRecord(declared)) {
+        throw triggerError(event, "UserPool", "the pool's LambdaConfig is not a block of triggers by name, and a " +
+            "Cognito event has no way to add a trigger to one");
+    }
+    return samRecordAt(properties, "LambdaConfig");
+}
+/**
+ * The function the trigger runs, refusing a trigger the pool already names a
+ * function for.
+ */
+function functionArn(event, declared, name) {
+    // oxlint-disable-next-line security/detect-object-injection -- a template record read by a trigger name the event stated.
+    if (declared[name] !== undefined) {
+        throw triggerError(event, "Trigger", `the pool already names a function for ${name}, and it runs one ` +
+            "function per trigger");
+    }
+    return { "Fn::GetAtt": [event.functionLogicalId, "Arn"] };
+}
+function triggerError(event, property, reason) {
+    return samPropertyError({
+        resourceType: samFunctionType,
+        logicalId: event.functionLogicalId,
+        property: `Events.${event.eventName}.${property}`,
+        reason,
+    });
+}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-template.factory.d.ts

@@ -20,6 +20,11 @@ export interface SimCfnSamFunctionTemplateInput {
      * `Api` event takes from them. A test stating none gets no section.
      */
     readonly apiGlobals: SimCfnTemplateValueRecord;
+    /**
+     * The `Globals.HttpApi` defaults the template states, for a test about what
+     * an `HttpApi` event takes from them. A test stating none gets no section.
+     */
+    readonly httpApiGlobals: SimCfnTemplateValueRecord;
     /**
      * Resources the template carries beside the function, such as the API an
      * event names or a second function sharing one.

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-template.factory.js

@@ -1,6 +1,6 @@
 import { MappedFactory } from "@kensio/part-factory";
 import { samTransformName } from "../sim-cfn-sam-transform.js";
-import { samFunctionType } from "./sim-cfn-sam-function.js";
+import { samFunctionType } from "./sim-cfn-sam-function-type.js";
 /**
  * The logical ID the function carries, and so the name the Lambda function and
  * its execution Role are expanded under.
@@ -31,6 +31,7 @@ export const simCfnSamFunctionTemplateFactory = new MappedFactory(() => ({
     functionProperties: {},
     globals: {},
     apiGlobals: {},
+    httpApiGlobals: {},
     resources: {},
 }), (input) => ({
     Transform: samTransformName,
@@ -50,6 +51,7 @@ function globalsSection(input) {
     const globals = {
         ...section("Function", input.globals),
         ...section("Api", input.apiGlobals),
+        ...section("HttpApi", input.httpApiGlobals),
     };
     return Object.keys(globals).length === 0 ? {} : { Globals: globals };
 }

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-type.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The SAM Resource type a function is declared as.
+ *
+ * It sits on its own so that what a function's events expand into can name the
+ * Resource they were declared on without importing the expansion they are part
+ * of.
+ */
+export declare const samFunctionType = "AWS::Serverless::Function";

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-type.js

@@ -0,0 +1,8 @@
+/**
+ * The SAM Resource type a function is declared as.
+ *
+ * It sits on its own so that what a function's events expand into can name the
+ * Resource they were declared on without importing the expansion they are part
+ * of.
+ */
+export const samFunctionType = "AWS::Serverless::Function";

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-url.js

@@ -2,11 +2,8 @@ import { isSamTemplateRecord } from "../sim-cfn-sam-record.js";
 import { samConditionAttribute } from "./sim-cfn-sam-function-properties.js";
 /**
  * The `FunctionUrlConfig` properties the AWS::Lambda::Url carries over.
- *
- * `Cors` is left out. The simulated Function URL answers no preflight request,
- * and carrying the property over would say it did.
  */
-const carriedNames = new Set(["AuthType", "InvokeMode"]);
+const carriedNames = new Set(["AuthType", "InvokeMode", "Cors"]);
 /**
  * The AWS::Lambda::Url a function's `FunctionUrlConfig` is expanded into.
  *

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function.d.ts

@@ -1,4 +1,5 @@
 import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+import type { SamTemplateApiAuth } from "../api/auth/sim-cfn-sam-template-api-auth.js";
 import type { SamTemplateGlobals } from "../sim-cfn-sam-globals.js";
 import type { SamResourceEdit } from "./event/sim-cfn-sam-resource-edit.js";
 interface SamFunctionExpansionProperties {
@@ -9,11 +10,12 @@ interface SamFunctionExpansionProperties {
      * `Function`, and its `Api` events take theirs from `Api`.
      */
     readonly globals: SamTemplateGlobals;
+    /**
+     * The `Auth` of every API of the template, for the function's `Api` and
+     * `HttpApi` events.
+     */
+    readonly apiAuth: SamTemplateApiAuth;
 }
-/**
- * The SAM Resource type this expansion covers.
- */
-export declare const samFunctionType = "AWS::Serverless::Function";
 /**
  * Expand one AWS::Serverless::Function into the Resources CloudFormation
  * deploys for it.

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function.js

@@ -3,10 +3,6 @@ import { samFunctionEventEdits, samFunctionEventResources, } from "./event/sim-c
 import { samCarriedAttributes, samCarriedProperties, samResourceProperties, } from "./sim-cfn-sam-function-properties.js";
 import { samFunctionRoleResource } from "./sim-cfn-sam-function-role.js";
 import { samFunctionUrlResources } from "./sim-cfn-sam-function-url.js";
-/**
- * The SAM Resource type this expansion covers.
- */
-export const samFunctionType = "AWS::Serverless::Function";
 /**
  * Expand one AWS::Serverless::Function into the Resources CloudFormation
  * deploys for it.
@@ -56,6 +52,7 @@ export function samFunctionResources(properties) {
             functionProperties,
             condition,
             apiGlobals: globals.forApi,
+            apiAuth: properties.apiAuth,
         }),
     };
 }
@@ -75,5 +72,6 @@ export function samFunctionResourceEdits(properties) {
         functionProperties: samMergedFunctionProperties(globals.forFunction, samResourceProperties(resource)),
         condition: resource["Condition"],
         apiGlobals: globals.forApi,
+        apiAuth: properties.apiAuth,
     });
 }

package/dist/service/cloudformation/sam/sim-cfn-sam-error.d.ts

@@ -0,0 +1,31 @@
+/**
+ * What a refusal names. The property comes first, then the SAM Resource that
+ * declared it.
+ */
+export interface SamPropertyRefusal {
+    /** The SAM Resource type the property was declared on. */
+    readonly resourceType: string;
+    /**
+     * The logical ID of the SAM Resource. An implicit API carries the logical ID
+     * SAM gives it, since that is the name a template reaches it by.
+     */
+    readonly logicalId: string;
+    /** The property, written the way a template writes it. */
+    readonly property: string;
+    /** Why the expansion will not take it. */
+    readonly reason: string;
+}
+/**
+ * Build the error a property of a SAM Resource is refused with.
+ *
+ * The wording matters. Sim CloudFormation downgrades a failure whose message
+ * reads as an unsupported Resource type into a skip, and a skipped `Auth` is
+ * the dangerous case. The API is still deployed, the Stack looks right, and
+ * every request reaches the function. So this says `Invalid`, and never says
+ * `Unsupported sim`.
+ *
+ * The property is named separately from the Resource because an `Auth` block
+ * is read several levels deep, and a refusal saying only which API failed
+ * leaves the Stack owner hunting for the level that was wrong.
+ */
+export declare function samPropertyError(refusal: SamPropertyRefusal): Error;

package/dist/service/cloudformation/sam/sim-cfn-sam-error.js

@@ -0,0 +1,17 @@
+/**
+ * Build the error a property of a SAM Resource is refused with.
+ *
+ * The wording matters. Sim CloudFormation downgrades a failure whose message
+ * reads as an unsupported Resource type into a skip, and a skipped `Auth` is
+ * the dangerous case. The API is still deployed, the Stack looks right, and
+ * every request reaches the function. So this says `Invalid`, and never says
+ * `Unsupported sim`.
+ *
+ * The property is named separately from the Resource because an `Auth` block
+ * is read several levels deep, and a refusal saying only which API failed
+ * leaves the Stack owner hunting for the level that was wrong.
+ */
+export function samPropertyError(refusal) {
+    return new Error(`Invalid ${refusal.property} on ${refusal.resourceType} Resource ` +
+        `${refusal.logicalId}: ${refusal.reason}`);
+}

package/dist/service/cloudformation/sam/sim-cfn-sam-expansion.js

@@ -1,8 +1,10 @@
 import { isRecord } from "../../../util/type-guard/record.js";
 import { samHttpApiResources, samHttpApiType, } from "./api/sim-cfn-sam-http-api.js";
 import { samRestApiResources, samRestApiType, } from "./api/sim-cfn-sam-rest-api.js";
+import { samTemplateApiAuth } from "./api/auth/sim-cfn-sam-template-api-auth.js";
 import { samEditedResources } from "./function/event/sim-cfn-sam-resource-edit.js";
-import { samFunctionResourceEdits, samFunctionResources, samFunctionType, } from "./function/sim-cfn-sam-function.js";
+import { samFunctionResourceEdits, samFunctionResources, } from "./function/sim-cfn-sam-function.js";
+import { samFunctionType } from "./function/sim-cfn-sam-function-type.js";
 import { samSimpleTableResources, samSimpleTableType, } from "./table/sim-cfn-sam-simple-table.js";
 import { samTemplateGlobals } from "./sim-cfn-sam-globals.js";
 import { isSamTemplateRecord } from "./sim-cfn-sam-record.js";
@@ -30,10 +32,11 @@ export function samExpandedTemplate(template) {
         return template;
     }
     const globals = samTemplateGlobals(template);
+    const apiAuth = samTemplateApiAuth(template, globals);
     const resources = Object.entries(template.Resources);
     return {
         ...withoutSamSections(template),
-        Resources: samEditedResources(Object.fromEntries(resources.flatMap(([logicalId, resource]) => Object.entries(expandedResource(logicalId, resource, globals)))), resources.flatMap(([logicalId, resource]) => resourceEdits(logicalId, resource, globals))),
+        Resources: samEditedResources(Object.fromEntries(resources.flatMap(([logicalId, resource]) => Object.entries(expandedResource({ logicalId, resource, globals, apiAuth })))), resources.flatMap(([logicalId, resource]) => resourceEdits({ logicalId, resource, globals, apiAuth }))),
     };
 }
 /**
@@ -43,23 +46,25 @@ export function samExpandedTemplate(template) {
  * Resources afterwards, because a Resource being edited may be expanded from a
  * SAM Resource of its own and may not have been read yet.
  */
-function resourceEdits(logicalId, resource, globals) {
+function resourceEdits(properties) {
+    const { logicalId, resource, globals, apiAuth } = properties;
     if (!isSamTemplateRecord(resource) || resource["Type"] !== samFunctionType) {
         return [];
     }
-    return samFunctionResourceEdits({ logicalId, resource, globals });
+    return samFunctionResourceEdits({ logicalId, resource, globals, apiAuth });
 }
 /**
  * The Resources one template Resource is deployed as. Anything the expansion
  * does not cover is deployed as itself.
  */
-function expandedResource(logicalId, resource, globals) {
+function expandedResource(properties) {
+    const { logicalId, resource, globals, apiAuth } = properties;
     if (!isSamTemplateRecord(resource)) {
         return { [logicalId]: resource };
     }
     const type = resource["Type"];
     if (type === samFunctionType) {
-        return samFunctionResources({ logicalId, resource, globals });
+        return samFunctionResources({ logicalId, resource, globals, apiAuth });
     }
     if (type === samHttpApiType) {
         return samHttpApiResources({

package/dist/service/cloudformation/sdk/sim-cloudformation-sdk-command-router.js

@@ -19,6 +19,26 @@ export class SimCloudFormationSdkCommandRouter {
                 "UpdateStackCommand",
                 async (command, context) => await simCloudFormation.updateStack(command, simSdkCallerOptions(context)),
             ],
+            [
+                "CreateChangeSetCommand",
+                async (command, context) => await simCloudFormation.createChangeSet(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DescribeChangeSetCommand",
+                async (command, context) => await simCloudFormation.describeChangeSet(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ExecuteChangeSetCommand",
+                async (command, context) => await simCloudFormation.executeChangeSet(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteChangeSetCommand",
+                async (command, context) => await simCloudFormation.deleteChangeSet(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ListChangeSetsCommand",
+                async (command, context) => await simCloudFormation.listChangeSets(command, simSdkCallerOptions(context)),
+            ],
             [
                 "DescribeStacksCommand",
                 async (command, context) => await simCloudFormation.describeStacks(command, simSdkCallerOptions(context)),