@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/lambda/command/create-function/create-function.handler.d.ts

@@ -8,6 +8,7 @@ import type { SimLambdaContainerImages } from "../../function/code/image/sim-lam
 import type { SimLambdaCodeStore } from "../../function/code/store/sim-lambda-code-store.js";
 import type { SimLambdaVmSdkModuleProvider } from "../../function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
 import type { SimCloudWatchServiceWriter } from "../../../cloudwatch/write/sim-cloudwatch-service-writer.js";
+import type { SimLambdaOutput } from "../../function/logging/sim-lambda-output.js";
 import type { SimLogsServiceWriter } from "../../../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaOutboundHttp } from "../../function/outbound/sim-lambda-outbound-http.js";
 import { SimLambdaEnvironmentConflicts } from "../../function/environment/sim-lambda-environment-conflicts.js";
@@ -24,6 +25,7 @@ interface CreateFunctionCommandHandlerProperties {
     vmSdkModuleProvider?: SimLambdaVmSdkModuleProvider | undefined;
     environmentConflicts?: SimLambdaEnvironmentConflicts;
     logs?: SimLogsServiceWriter | undefined;
+    output?: SimLambdaOutput | undefined;
     metrics?: SimCloudWatchServiceWriter | undefined;
     outboundHttp?: SimLambdaOutboundHttp | undefined;
 }
@@ -44,6 +46,7 @@ export declare class CreateFunctionCommandHandler implements CommandHandler<SimC
     private readonly codeResolver;
     private readonly environmentConflicts;
     private readonly logs;
+    private readonly output;
     private readonly metrics;
     private readonly outboundHttp;
     constructor(properties: CreateFunctionCommandHandlerProperties);

package/dist/service/lambda/command/create-function/create-function.handler.js

@@ -22,10 +22,11 @@ export class CreateFunctionCommandHandler {
     codeResolver;
     environmentConflicts;
     logs;
+    output;
     metrics;
     outboundHttp;
     constructor(properties) {
-        const { accountRegionScope, functions, runAsOwner, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), codeStore, containerImages, vmSdkModuleProvider, environmentConflicts = new SimLambdaEnvironmentConflicts(), logs, metrics, outboundHttp, } = properties;
+        const { accountRegionScope, functions, runAsOwner, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), codeStore, containerImages, vmSdkModuleProvider, environmentConflicts = new SimLambdaEnvironmentConflicts(), logs, output, metrics, outboundHttp, } = properties;
         this.accountRegionScope = accountRegionScope;
         this.functions = functions;
         this.runAsOwner = runAsOwner;
@@ -42,6 +43,7 @@ export class CreateFunctionCommandHandler {
         });
         this.environmentConflicts = environmentConflicts;
         this.logs = logs;
+        this.output = output;
         this.metrics = metrics;
         this.outboundHttp = outboundHttp;
     }
@@ -71,7 +73,9 @@ export class CreateFunctionCommandHandler {
             accountRegionScope: this.accountRegionScope,
             runAsOwner: this.runAsOwner,
             clock: this.background,
+            background: this.background,
             logs: this.logs,
+            output: this.output,
             metrics: this.metrics,
             outboundHttp: this.outboundHttp,
         });

package/dist/service/lambda/command/create-function-url-config/create-function-url-config.command.d.ts

@@ -2,6 +2,7 @@
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/lambda/command/CreateFunctionUrlConfigCommand/
  */
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimLambdaFunctionUrlCors } from "../../function/url/sim-lambda-function-url-cors.js";
 import type { SimLambdaFunctionUrlAuthType, SimLambdaFunctionUrlConfiguration, SimLambdaFunctionUrlInvokeMode } from "../../function/url/sim-lambda-function-url.js";
 /**
  * Minimal structural sim Lambda CreateFunctionUrlConfig command.
@@ -11,14 +12,12 @@ export interface SimCreateFunctionUrlConfigCommand {
 }
 /**
  * Minimal structural sim Lambda CreateFunctionUrlConfig input.
- *
- * The Cors block real Lambda accepts here is not simulated, so it is left out
- * rather than accepted and ignored.
  */
 export interface SimCreateFunctionUrlConfigCommandInput {
     readonly FunctionName?: string | undefined;
     readonly AuthType?: SimLambdaFunctionUrlAuthType | undefined;
     readonly InvokeMode?: SimLambdaFunctionUrlInvokeMode | undefined;
+    readonly Cors?: SimLambdaFunctionUrlCors | undefined;
 }
 /**
  * Minimal structural sim Lambda CreateFunctionUrlConfig output.

package/dist/service/lambda/command/create-function-url-config/create-function-url-config.handler.js

@@ -37,6 +37,7 @@ export class CreateFunctionUrlConfigCommandHandler {
             simFunction: this.functions.require(functionName),
             authType: this.inputParser.requireAuthType(command.input.AuthType),
             invokeMode: this.inputParser.parseOptionalInvokeMode(command.input.InvokeMode),
+            cors: this.inputParser.parseOptionalCors(command.input.Cors),
         });
         return {
             $metadata: {},

package/dist/service/lambda/command/event-source-mapping/create-event-source-mapping-input.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { type SimLambdaEventSourceArn } from "../../event-source/sim-lambda-event-source-arn.js";
 import type { SimLambdaFunctionResponseType } from "../../event-source/sim-lambda-event-source-mapping.js";
+import type { SimLambdaStreamRetryLimits } from "../../event-source/sim-lambda-stream-retry-limits.js";
 import type { SimLambdaEventSourceStart } from "../../event-source/sim-lambda-event-source-starting-position.js";
 import type { SimCreateEventSourceMappingCommandInput } from "./event-source-mapping.command.js";
 /**
@@ -28,6 +29,11 @@ export declare class SimLambdaEventSourceMappingInput {
     readonly start: SimLambdaEventSourceStart | undefined;
     readonly enabled: boolean;
     readonly functionResponseTypes: readonly SimLambdaFunctionResponseType[];
+    /**
+     * When a failed batch stops being delivered again, for a source that leaves
+     * the counting to the mapping.
+     */
+    readonly streamRetryLimits: SimLambdaStreamRetryLimits | undefined;
     private constructor();
     /**
      * Read a CreateEventSourceMapping request, refusing what this simulation

package/dist/service/lambda/command/event-source-mapping/create-event-source-mapping-input.js

@@ -28,6 +28,11 @@ export class SimLambdaEventSourceMappingInput {
     start;
     enabled;
     functionResponseTypes;
+    /**
+     * When a failed batch stops being delivered again, for a source that leaves
+     * the counting to the mapping.
+     */
+    streamRetryLimits;
     constructor(properties) {
         this.eventSourceArn = properties.eventSourceArn;
         this.functionName = properties.functionName;
@@ -36,6 +41,7 @@ export class SimLambdaEventSourceMappingInput {
         this.start = properties.start;
         this.enabled = properties.enabled;
         this.functionResponseTypes = properties.functionResponseTypes;
+        this.streamRetryLimits = properties.streamRetryLimits;
     }
     /**
      * Read a CreateEventSourceMapping request, refusing what this simulation
@@ -55,6 +61,10 @@ export class SimLambdaEventSourceMappingInput {
             }),
             enabled: input.Enabled ?? true,
             functionResponseTypes: functionResponseTypesIn(input),
+            streamRetryLimits: eventSourceArn.retryLimitRules.limitsIn({
+                maximumRetryAttempts: input.MaximumRetryAttempts,
+                maximumRecordAgeInSeconds: input.MaximumRecordAgeInSeconds,
+            }),
         });
     }
 }

package/dist/service/lambda/command/event-source-mapping/create-event-source-mapping-refusals.js

@@ -17,11 +17,6 @@ const unsimulatedInputs = new Map([
         "failure destinations are not simulated, so a stream batch that runs out " +
             "of attempts is discarded rather than sent anywhere",
     ],
-    [
-        "MaximumRetryAttempts",
-        "the number of times a stream batch is delivered again is fixed",
-    ],
-    ["MaximumRecordAgeInSeconds", "record ages are not simulated"],
     [
         "BisectBatchOnFunctionError",
         "batch bisection is not simulated, so a failing stream batch is retried " +
@@ -51,7 +46,8 @@ const unsimulatedInputs = new Map([
  *
  * `StartingPosition` is not among them, because whether a source has one is the
  * source's own rule: a stream is refused without it and a queue is refused with
- * it.
+ * it. The two failed-batch limits are left out for the same reason: a stream
+ * mapping keeps them and a queue mapping is refused for naming one.
  */
 const unsupportedEventSourceInputs = new Set([
     "Topics",

package/dist/service/lambda/command/event-source-mapping/create-event-source-mapping.handler.js

@@ -80,6 +80,7 @@ export class CreateEventSourceMappingCommandHandler {
             start: input.start,
             enabled: input.enabled,
             functionResponseTypes: input.functionResponseTypes,
+            streamRetryLimits: input.streamRetryLimits,
             createdAt: this.properties.background.now(),
         });
         this.properties.mappings.add(mapping);

package/dist/service/lambda/command/function/sim-lambda-function-commands.d.ts

@@ -7,6 +7,7 @@ import type { SimLambdaContainerImages } from "../../function/code/image/sim-lam
 import type { SimLambdaCodeStore } from "../../function/code/store/sim-lambda-code-store.js";
 import type { SimLambdaVmSdkModuleProvider } from "../../function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
 import type { SimCloudWatchServiceWriter } from "../../../cloudwatch/write/sim-cloudwatch-service-writer.js";
+import type { SimLambdaOutput } from "../../function/logging/sim-lambda-output.js";
 import type { SimLogsServiceWriter } from "../../../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaOutboundHttp } from "../../function/outbound/sim-lambda-outbound-http.js";
 import type { SimLambdaDestinationTargets } from "../../destination/sim-lambda-destination-targets.js";
@@ -39,6 +40,7 @@ interface SimLambdaFunctionCommandsProperties {
     readonly containerImages?: SimLambdaContainerImages | undefined;
     readonly vmSdkModuleProvider?: SimLambdaVmSdkModuleProvider | undefined;
     readonly logs?: SimLogsServiceWriter | undefined;
+    readonly output?: SimLambdaOutput | undefined;
     readonly metrics?: SimCloudWatchServiceWriter | undefined;
     readonly outboundHttp?: SimLambdaOutboundHttp | undefined;
 }

package/dist/service/lambda/command/function-url/function-url-cors-constraints.d.ts

@@ -0,0 +1,25 @@
+/**
+ * One list member of a `Cors` block and the bounds Lambda puts on it.
+ *
+ * `AllowMethods` is capped at six characters. That is what leaves `OPTIONS`
+ * out of the list a caller may state, since Lambda answers the preflight
+ * itself.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/api/API_Cors.html
+ */
+export interface CorsListConstraint {
+    readonly member: "AllowHeaders" | "AllowMethods" | "AllowOrigins" | "ExposeHeaders";
+    readonly field: string;
+    readonly maxItems: number;
+    readonly minLength: number;
+    readonly maxLength: number;
+}
+/**
+ * The bounds Lambda publishes for each list member of a `Cors` block.
+ */
+export declare const corsListConstraints: readonly CorsListConstraint[];
+/**
+ * The bound a list broke, worded as Lambda words it, or nothing when the list
+ * is within every bound.
+ */
+export declare function corsListViolation(values: readonly string[], constraint: CorsListConstraint): string | undefined;

package/dist/service/lambda/command/function-url/function-url-cors-constraints.js

@@ -0,0 +1,49 @@
+/**
+ * The bounds Lambda publishes for each list member of a `Cors` block.
+ */
+export const corsListConstraints = [
+    {
+        member: "AllowHeaders",
+        field: "cors.allowHeaders",
+        maxItems: 100,
+        minLength: 0,
+        maxLength: 1024,
+    },
+    {
+        member: "AllowMethods",
+        field: "cors.allowMethods",
+        maxItems: 6,
+        minLength: 0,
+        maxLength: 6,
+    },
+    {
+        member: "AllowOrigins",
+        field: "cors.allowOrigins",
+        maxItems: 100,
+        minLength: 1,
+        maxLength: 253,
+    },
+    {
+        member: "ExposeHeaders",
+        field: "cors.exposeHeaders",
+        maxItems: 100,
+        minLength: 0,
+        maxLength: 1024,
+    },
+];
+/**
+ * The bound a list broke, worded as Lambda words it, or nothing when the list
+ * is within every bound.
+ */
+export function corsListViolation(values, constraint) {
+    const { maxItems, minLength, maxLength } = constraint;
+    if (values.length > maxItems) {
+        return `Member must have length less than or equal to ${String(maxItems)}`;
+    }
+    const outOfRange = values.some((value) => value.length < minLength || value.length > maxLength);
+    return outOfRange
+        ? "Member must satisfy constraint: [Member must have length less than " +
+            `or equal to ${String(maxLength)}, Member must have length greater ` +
+            `than or equal to ${String(minLength)}]`
+        : undefined;
+}

package/dist/service/lambda/command/function-url/function-url-cors-input.d.ts

@@ -0,0 +1,25 @@
+import type { SimLambdaFunctionUrlCors } from "../../function/url/sim-lambda-function-url-cors.js";
+/**
+ * Validates the `Cors` block of Function URL config command input.
+ *
+ * Every check here is against a bound real Lambda publishes. A configuration
+ * this accepts is one the API would have taken. Nothing else is checked,
+ * because a refusal the real service would not make costs a working
+ * deployment.
+ *
+ * The check runs before the Function URL is created or updated, leaving a
+ * refused configuration with the URL as it was.
+ */
+export declare class FunctionUrlCorsInputParser {
+    /**
+     * Parse an optional `Cors` block, which every Function URL config command
+     * allows a caller to leave out.
+     */
+    parseOptional(cors: SimLambdaFunctionUrlCors | undefined): SimLambdaFunctionUrlCors | undefined;
+    private checkMaxAge;
+    private maxAgeViolation;
+    /**
+     * Fail the way Lambda fails a request that broke one bound.
+     */
+    private refuse;
+}

package/dist/service/lambda/command/function-url/function-url-cors-input.js

@@ -0,0 +1,57 @@
+import { SimLambdaValidationException } from "../../error/sim-lambda.error.js";
+import { corsListConstraints, corsListViolation, } from "./function-url-cors-constraints.js";
+const maxAgeSeconds = 86_400;
+/**
+ * Validates the `Cors` block of Function URL config command input.
+ *
+ * Every check here is against a bound real Lambda publishes. A configuration
+ * this accepts is one the API would have taken. Nothing else is checked,
+ * because a refusal the real service would not make costs a working
+ * deployment.
+ *
+ * The check runs before the Function URL is created or updated, leaving a
+ * refused configuration with the URL as it was.
+ */
+export class FunctionUrlCorsInputParser {
+    /**
+     * Parse an optional `Cors` block, which every Function URL config command
+     * allows a caller to leave out.
+     */
+    parseOptional(cors) {
+        if (cors === undefined) {
+            return undefined;
+        }
+        for (const constraint of corsListConstraints) {
+            const values = cors[constraint.member];
+            if (values !== undefined) {
+                this.refuse(`[${values.join(", ")}]`, constraint.field, corsListViolation(values, constraint));
+            }
+        }
+        this.checkMaxAge(cors.MaxAge);
+        return cors;
+    }
+    checkMaxAge(maxAge) {
+        if (maxAge === undefined) {
+            return;
+        }
+        this.refuse(String(maxAge), "cors.maxAge", this.maxAgeViolation(maxAge));
+    }
+    maxAgeViolation(maxAge) {
+        if (maxAge > maxAgeSeconds) {
+            return `Member must have value less than or equal to ${String(maxAgeSeconds)}`;
+        }
+        return maxAge < 0
+            ? "Member must have value greater than or equal to 0"
+            : undefined;
+    }
+    /**
+     * Fail the way Lambda fails a request that broke one bound.
+     */
+    refuse(value, field, violation) {
+        if (violation === undefined) {
+            return;
+        }
+        throw new SimLambdaValidationException(`1 validation error detected: Value '${value}' at '${field}' failed ` +
+            `to satisfy constraint: ${violation}`);
+    }
+}

package/dist/service/lambda/command/function-url/function-url-input.d.ts

@@ -1,3 +1,4 @@
+import type { SimLambdaFunctionUrlCors } from "../../function/url/sim-lambda-function-url-cors.js";
 import type { SimLambdaFunctionUrlAuthType, SimLambdaFunctionUrlInvokeMode } from "../../function/url/sim-lambda-function-url.js";
 /**
  * Validates the enumerated values in Function URL config command input.
@@ -7,6 +8,7 @@ import type { SimLambdaFunctionUrlAuthType, SimLambdaFunctionUrlInvokeMode } fro
  * runtime and reported the way real Lambda reports a bad enum member.
  */
 export declare class FunctionUrlInputParser {
+    private readonly corsParser;
     /**
      * Parse a required AuthType, as CreateFunctionUrlConfig requires one.
      */
@@ -19,5 +21,10 @@ export declare class FunctionUrlInputParser {
      * Parse an optional InvokeMode, which defaults to BUFFERED on real Lambda.
      */
     parseOptionalInvokeMode(value: string | undefined): SimLambdaFunctionUrlInvokeMode | undefined;
+    /**
+     * Parse an optional `Cors` block, which every Function URL config command
+     * allows a caller to leave out.
+     */
+    parseOptionalCors(value: SimLambdaFunctionUrlCors | undefined): SimLambdaFunctionUrlCors | undefined;
     private parseAuthType;
 }

package/dist/service/lambda/command/function-url/function-url-input.js

@@ -1,4 +1,5 @@
 import { SimLambdaValidationException } from "../../error/sim-lambda.error.js";
+import { FunctionUrlCorsInputParser } from "./function-url-cors-input.js";
 const authTypes = ["NONE", "AWS_IAM"];
 const invokeModes = ["BUFFERED", "RESPONSE_STREAM"];
 /**
@@ -9,6 +10,7 @@ const invokeModes = ["BUFFERED", "RESPONSE_STREAM"];
  * runtime and reported the way real Lambda reports a bad enum member.
  */
 export class FunctionUrlInputParser {
+    corsParser = new FunctionUrlCorsInputParser();
     /**
      * Parse a required AuthType, as CreateFunctionUrlConfig requires one.
      */
@@ -39,6 +41,13 @@ export class FunctionUrlInputParser {
         }
         return value;
     }
+    /**
+     * Parse an optional `Cors` block, which every Function URL config command
+     * allows a caller to leave out.
+     */
+    parseOptionalCors(value) {
+        return this.corsParser.parseOptional(value);
+    }
     parseAuthType(value) {
         if (!authTypes.includes(value)) {
             throw new SimLambdaValidationException(`1 validation error detected: Value '${value}' at 'authType' failed to satisfy constraint: Member must satisfy enum value set: [${authTypes.join(", ")}]`);

package/dist/service/lambda/command/invoke/async/sim-lambda-async-invocation.js

@@ -1,5 +1,6 @@
 import { simLambdaEventTooOld, simLambdaRetryDueTime, } from "../../../function/event-invoke/sim-lambda-event-invoke-settings.js";
 import { simLambdaAbandonedOutcome, SimLambdaAsyncOutcomeDelivery, simLambdaSuccessOutcome, } from "./sim-lambda-async-outcome.js";
+import { simLambdaHandlerAttempt } from "./sim-lambda-handler-attempt.js";
 /**
  * One asynchronous invocation of a simulated Lambda function, from the first
  * attempt to wherever its result ends up.
@@ -22,19 +23,17 @@ export class SimLambdaAsyncInvocation {
      * Accept the invocation and let it run behind the caller.
      */
     start() {
-        this.properties.background.schedule(async () => {
-            await this.attempt();
-        });
+        this.properties.background.schedule(() => this.attempt());
     }
     async attempt() {
         const { simFunction, event } = this.properties;
         this.attemptCount += 1;
-        try {
-            await this.outcomes.deliver(simLambdaSuccessOutcome(await simFunction.invoke(event)), this.attemptCount);
-        }
-        catch (error) {
-            await this.failed(error);
+        const attempt = await simLambdaHandlerAttempt(simFunction, event);
+        if (!attempt.succeeded) {
+            await this.failed(attempt.error);
+            return;
         }
+        await this.outcomes.deliver(simLambdaSuccessOutcome(attempt.result), this.attemptCount);
     }
     /**
      * Retry the attempt that threw, or give up where the last one has been
@@ -46,11 +45,9 @@ export class SimLambdaAsyncInvocation {
             await this.abandon(error, "RetriesExhausted");
             return;
         }
-        background.scheduleAt(simLambdaRetryDueTime(background.now(), this.attemptCount), async () => {
-            await (simLambdaEventTooOld(this.startedAt, background.now(), settings)
-                ? this.abandon(error, "EventAgeExceeded")
-                : this.attempt());
-        });
+        background.scheduleAt(simLambdaRetryDueTime(background.now(), this.attemptCount), () => simLambdaEventTooOld(this.startedAt, background.now(), settings)
+            ? this.abandon(error, "EventAgeExceeded")
+            : this.attempt());
     }
     /**
      * Give up on the invocation, telling its failure destination why and

package/dist/service/lambda/command/invoke/async/sim-lambda-async-outcome.js

@@ -58,6 +58,7 @@ export class SimLambdaAsyncOutcomeDelivery {
         await destinations.deliver({
             destinationArn: SimLambdaDestinationArn.of(destination),
             sourceFunctionArn: simFunction.arn,
+            sourceFunctionRoleArn: simFunction.roleArn,
             record: makeSimLambdaDestinationRecord({
                 requestId: this.requestId,
                 functionArn: simFunction.arn,
@@ -82,6 +83,7 @@ export class SimLambdaAsyncOutcomeDelivery {
             targetArn: SimLambdaDestinationArn.of(settings.deadLetterArn),
             payload: event,
             sourceFunctionArn: simFunction.arn,
+            sourceFunctionRoleArn: simFunction.roleArn,
         });
     }
 }

package/dist/service/lambda/command/invoke/async/sim-lambda-handler-attempt.d.ts

@@ -0,0 +1,13 @@
+import type { SimLambdaFunction } from "../../../function/sim-lambda-function.js";
+export type SimLambdaHandlerAttempt = {
+    readonly succeeded: true;
+    readonly result: unknown;
+} | {
+    readonly succeeded: false;
+    readonly error: unknown;
+};
+/**
+ * Invoke a function handler while keeping its error separate from later
+ * destination delivery errors.
+ */
+export declare function simLambdaHandlerAttempt(simFunction: SimLambdaFunction, event: unknown): Promise<SimLambdaHandlerAttempt>;

package/dist/service/lambda/command/invoke/async/sim-lambda-handler-attempt.js

@@ -0,0 +1,12 @@
+/**
+ * Invoke a function handler while keeping its error separate from later
+ * destination delivery errors.
+ */
+export async function simLambdaHandlerAttempt(simFunction, event) {
+    try {
+        return { succeeded: true, result: await simFunction.invoke(event) };
+    }
+    catch (error) {
+        return { succeeded: false, error };
+    }
+}

package/dist/service/lambda/command/update-function-url-config/update-function-url-config.command.d.ts

@@ -2,6 +2,7 @@
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/lambda/command/UpdateFunctionUrlConfigCommand/
  */
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimLambdaFunctionUrlCors } from "../../function/url/sim-lambda-function-url-cors.js";
 import type { SimLambdaFunctionUrlAuthType, SimLambdaFunctionUrlConfiguration, SimLambdaFunctionUrlInvokeMode } from "../../function/url/sim-lambda-function-url.js";
 /**
  * Minimal structural sim Lambda UpdateFunctionUrlConfig command.
@@ -19,6 +20,7 @@ export interface SimUpdateFunctionUrlConfigCommandInput {
     readonly FunctionName?: string | undefined;
     readonly AuthType?: SimLambdaFunctionUrlAuthType | undefined;
     readonly InvokeMode?: SimLambdaFunctionUrlInvokeMode | undefined;
+    readonly Cors?: SimLambdaFunctionUrlCors | undefined;
 }
 /**
  * Minimal structural sim Lambda UpdateFunctionUrlConfig output.

package/dist/service/lambda/command/update-function-url-config/update-function-url-config.handler.js

@@ -38,6 +38,7 @@ export class UpdateFunctionUrlConfigCommandHandler {
         functionUrl.update({
             authType: this.inputParser.parseOptionalAuthType(command.input.AuthType),
             invokeMode: this.inputParser.parseOptionalInvokeMode(command.input.InvokeMode),
+            cors: this.inputParser.parseOptionalCors(command.input.Cors),
         });
         return {
             $metadata: {},

package/dist/service/lambda/destination/deliver/sim-lambda-destination-bus.js

@@ -25,6 +25,6 @@ export class SimLambdaDestinationBus {
                     },
                 ],
             },
-        });
+        }, { caller: { kind: "arn", arn: request.sourceFunctionRoleArn } });
     }
 }

package/dist/service/lambda/destination/deliver/sim-lambda-destination-function.js

@@ -1,4 +1,3 @@
-import { SimLambdaError } from "../../error/sim-lambda.error.js";
 /**
  * A function a function is sending an asynchronous invocation result to, in
  * the Account and Region the destination ARN names.
@@ -9,16 +8,13 @@ export class SimLambdaDestinationFunction {
      */
     async deliver(scope, request) {
         const { destinationArn: arn } = request;
-        const target = scope
-            .lambda()
-            .getSimFunctionTarget(arn.functionName, arn.functionQualifier);
-        if (target === undefined) {
-            throw new SimLambdaError(`${arn.value} is not a simulated Lambda function.`);
-        }
-        // Invoked directly rather than through an Invoke command, because this is
-        // already inside the background task standing for the asynchronous
-        // invocation, and because a delivery failure has to reach the caller who
-        // advanced the clock rather than being swallowed a second time.
-        await target.simFunction.invoke(request.record);
+        await scope.lambda().invoke({
+            input: {
+                FunctionName: arn.functionName,
+                Qualifier: arn.functionQualifier,
+                InvocationType: "Event",
+                Payload: JSON.stringify(request.record),
+            },
+        }, { caller: { kind: "arn", arn: request.sourceFunctionRoleArn } });
     }
 }

package/dist/service/lambda/destination/deliver/sim-lambda-destination-queue.js

@@ -17,8 +17,9 @@ export class SimLambdaDestinationQueue {
         }
         // Sent through the ordinary SendMessage path, so what arrives is the same
         // thing an SDK caller would have sent.
-        await send.scope
-            .sqs()
-            .sendMessage({ input: { QueueUrl: queue.arn.url, MessageBody: send.body } }, { sourceArn: send.sourceFunctionArn });
+        await send.scope.sqs().sendMessage({ input: { QueueUrl: queue.arn.url, MessageBody: send.body } }, {
+            caller: { kind: "arn", arn: send.sourceFunctionRoleArn },
+            sourceArn: send.sourceFunctionArn,
+        });
     }
 }

package/dist/service/lambda/destination/deliver/sim-lambda-destination-send.d.ts

@@ -11,4 +11,6 @@ export interface SimLambdaDestinationSend {
      * The function this came from, supplied to IAM as `aws:SourceArn`.
      */
     readonly sourceFunctionArn: string;
+    /** The execution Role Lambda uses to send the document. */
+    readonly sourceFunctionRoleArn: string;
 }

package/dist/service/lambda/destination/deliver/sim-lambda-destination-topic.js

@@ -15,8 +15,9 @@ export class SimLambdaDestinationTopic {
         if (topic === undefined) {
             throw new SimLambdaError(`${send.arn.value} is not a simulated SNS topic.`);
         }
-        await send.scope
-            .sns()
-            .publish({ input: { TopicArn: topic.arn.value, Message: send.body } }, { sourceArn: send.sourceFunctionArn });
+        await send.scope.sns().publish({ input: { TopicArn: topic.arn.value, Message: send.body } }, {
+            caller: { kind: "arn", arn: send.sourceFunctionRoleArn },
+            sourceArn: send.sourceFunctionArn,
+        });
     }
 }

package/dist/service/lambda/destination/sim-aws-lambda-destinations.d.ts

@@ -11,12 +11,10 @@ interface SimAwsLambdaDestinationsProperties {
  * built: reaching another service while this one is being constructed is a
  * cycle with no bottom to it.
  *
- * Real Lambda delivers under the function's own execution role, and delivers
- * nothing when that role cannot write to the destination. The permission is
- * left unchecked here, so a delivery is made as the destination Account's own
- * root. A record that silently goes nowhere is the harder failure to find, and
- * a destination needs no resource policy on real AWS either, so nothing about
- * the destination itself has to be set up for a record to arrive.
+ * Every delivery uses the source function's execution Role as its caller. The
+ * destination service applies its ordinary IAM checks to that Role before it
+ * changes any state.
+ * @see https://docs.aws.amazon.com/lambda/latest/dg/invocation-async-retain-records.html
  */
 export declare class SimAwsLambdaDestinations implements SimLambdaDestinationTargets {
     private readonly simAws;