@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/lambda/function/outbound/sim-lambda-aws-api-outbound.js

@@ -1,5 +1,6 @@
 import { SimSdkWireDispatcher } from "../../../../sdk/wire/sim-sdk-wire-dispatcher.js";
 import { readSimSdkWireCredentialScope, readSimSdkWireOperation, } from "../../../../sdk/wire/sim-sdk-wire-operation.js";
+import { SimS3ApiEndpoint } from "../../../s3/serve/api/sim-s3-api.js";
 import { simLambdaOutboundWireRequest, simLambdaOutboundWireResponse, } from "./sim-lambda-outbound-wire.js";
 /**
  * The hostname suffixes AWS issues its service API endpoints under.
@@ -27,6 +28,17 @@ const awsEndpointSuffixes = [
  * way it answers for every other hostname a resource is issued.
  */
 const resourceEndpointLabel = ".execute-api.";
+/**
+ * The SigV4 signing name of the one service here whose requests an endpoint of
+ * its own reads.
+ *
+ * S3 states its operation in the method, the path and a query-string
+ * sub-resource. `SimS3ApiEndpoint` reads those. The signing name is where a
+ * signed request says which service it is for, whatever protocol that service
+ * speaks, and that is what selects the endpoint here, as it is on the served
+ * AWS API endpoint.
+ */
+const s3SigningName = "s3";
 /**
  * Whether a hostname is an AWS service API endpoint.
  */
@@ -64,8 +76,10 @@ export function isSimAwsApiRequest(request) {
  */
 export class SimLambdaAwsApiOutbound {
     dispatcher;
+    s3;
     constructor(properties) {
         this.dispatcher = new SimSdkWireDispatcher(properties.simAws, properties.regionName);
+        this.s3 = new SimS3ApiEndpoint({ simAws: properties.simAws });
     }
     /**
      * Whether a hostname is one of the AWS service API endpoints.
@@ -75,8 +89,20 @@ export class SimLambdaAwsApiOutbound {
     }
     /**
      * Answer an AWS API request from the simulated operation it names.
+     *
+     * A request signed for S3 goes to the endpoint that reads S3's protocol,
+     * since S3 names its operation where the wire dispatcher looks for a header.
+     * No caller travels with it. The SDK signed it with the placeholder
+     * credentials the runtime puts in the environment, and the invocation is
+     * already running as the execution Role, the ambient caller every other call
+     * out of function code runs as.
      */
     async fetch(request) {
-        return simLambdaOutboundWireResponse(await this.dispatcher.dispatch(await simLambdaOutboundWireRequest(request)));
+        const wireRequest = await simLambdaOutboundWireRequest(request);
+        const scope = readSimSdkWireCredentialScope(wireRequest);
+        if (scope?.signingName === s3SigningName) {
+            return await this.s3.handle(request, wireRequest.body, undefined, scope.regionName);
+        }
+        return simLambdaOutboundWireResponse(await this.dispatcher.dispatch(wireRequest));
     }
 }

package/dist/service/lambda/function/sim-lambda-function.d.ts

@@ -49,8 +49,8 @@ export declare class SimLambdaFunction {
     readonly metrics: SimLambdaFunctionMetrics;
     private readonly properties;
     private readonly runAsOwner;
-    private readonly runner;
     private readonly clock;
+    private readonly background;
     private readonly logging;
     private readonly outboundHttp;
     constructor(properties: SimLambdaFunctionProperties);

package/dist/service/lambda/function/sim-lambda-function.js

@@ -6,9 +6,8 @@ import { SimLambdaHandlerReferenceCode, } from "./code/sim-lambda-executable-cod
 import { SimLambdaEnvironment } from "./environment/sim-lambda-environment.js";
 import { SimLambdaFunctionLogging } from "./logging/sim-lambda-function-logging.js";
 import { SimLambdaFunctionPolicy } from "./policy/sim-lambda-function-policy.js";
-import { SimLambdaHandlerRunner } from "./invoke/sim-lambda-handler-runner.js";
+import { SimLambdaInvocation } from "./invoke/sim-lambda-invocation.js";
 import { SimLambdaFunctionMetrics } from "../metric/sim-lambda-function-metrics.js";
-import { SimLambdaInvokeContextBuilder } from "./invoke/sim-lambda-invoke-context-builder.js";
 import { runSimLambdaInHostScope } from "./invoke/sim-lambda-host-scope.js";
 import { SimRealClock } from "../../../util/clock/sim-clock.js";
 import { defaultLambdaHandler } from "./sim-lambda-handler.type.js";
@@ -56,14 +55,15 @@ export class SimLambdaFunction {
     #code;
     properties;
     runAsOwner;
-    runner = new SimLambdaHandlerRunner();
     clock;
+    background;
     logging;
     outboundHttp;
     constructor(properties) {
-        const { name, roleArn, accountRegionScope = simAwsAccountRegionScopeFactory.make(), handlerFunction = defaultLambdaHandler, code, state = "Pending", handlerName, runtimeName, description, timeoutSeconds = DEFAULT_SIM_LAMBDA_TIMEOUT_SECONDS, memorySizeMb = DEFAULT_SIM_LAMBDA_MEMORY_SIZE_MB, environment, deadLetterTargetArn, runAsOwner = this, version = SIM_LAMBDA_LATEST_VERSION, clock = new SimRealClock(), logs, metrics, outboundHttp, } = properties;
+        const { name, roleArn, accountRegionScope = simAwsAccountRegionScopeFactory.make(), handlerFunction = defaultLambdaHandler, code, state = "Pending", handlerName, runtimeName, description, timeoutSeconds = DEFAULT_SIM_LAMBDA_TIMEOUT_SECONDS, memorySizeMb = DEFAULT_SIM_LAMBDA_MEMORY_SIZE_MB, environment, deadLetterTargetArn, runAsOwner = this, version = SIM_LAMBDA_LATEST_VERSION, clock = new SimRealClock(), background, metrics, outboundHttp, } = properties;
         this.properties = properties;
         this.clock = clock;
+        this.background = background;
         this.version = version;
         this.name = name;
         this.roleArn = roleArn;
@@ -88,7 +88,8 @@ export class SimLambdaFunction {
         this.metrics = new SimLambdaFunctionMetrics({ metrics, clock });
         this.logging = new SimLambdaFunctionLogging({
             functionName: name,
-            logs,
+            logs: properties.logs,
+            output: properties.output,
             clock,
         });
     }
@@ -181,18 +182,19 @@ export class SimLambdaFunction {
      * Runtime.* cold-start error.
      */
     async invoke(event) {
-        const contextBuilder = new SimLambdaInvokeContextBuilder({
+        const invocation = new SimLambdaInvocation({
             functionName: this.name,
             functionVersion: this.version,
             invokedFunctionArn: this.arn,
             timeoutSeconds: this.timeoutSeconds,
             memorySizeMb: this.memorySizeMb,
             clock: this.clock,
+            background: this.background,
             logGroupName: this.logging.logGroupName,
             logStreamName: this.logging.logStreamName(),
         });
         this.logging.recordFrom(this.#code);
-        return await this.metrics.around(String(this.name), async () => simAwsRunAsContext.run(this.runAsOwner, { kind: "arn", arn: this.roleArn }, async () => await this.environment.runWith(async () => await this.runInHostScope(async () => await this.logging.around(async () => await this.runner.run(this.#code.handlerFunction(), event, contextBuilder))))));
+        return await this.metrics.around(String(this.name), async () => simAwsRunAsContext.run(this.runAsOwner, { kind: "arn", arn: this.roleArn }, async () => await this.environment.runWith(async () => await this.runInHostScope(async () => await this.logging.around(async () => await invocation.run(this.#code.handlerFunction(), event))))));
     }
     /**
      * Run an invocation with the process globals host-scope code reads bridged
@@ -204,7 +206,7 @@ export class SimLambdaFunction {
             return await run();
         }
         const { clock, outboundHttp } = this;
-        const output = this.logging.outputSink();
-        return await runSimLambdaInHostScope({ clock, outboundHttp, output }, run);
+        const scope = { clock, outboundHttp, ...this.logging.outputScope() };
+        return await runSimLambdaInHostScope(scope, run);
     }
 }

package/dist/service/lambda/function/sim-lambda-function.type.d.ts

@@ -1,8 +1,10 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
 import type { Brand } from "../../../util/brand.type.js";
 import type { SimClock } from "../../../util/clock/sim-clock.js";
 import type { SimAwsRunAsOwner } from "../../aws/caller/sim-aws-run-as-context.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimCloudWatchServiceWriter } from "../../cloudwatch/write/sim-cloudwatch-service-writer.js";
+import type { SimLambdaOutput } from "./logging/sim-lambda-output.js";
 import type { SimLogsServiceWriter } from "../../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaExecutableCode } from "./code/sim-lambda-executable-code.js";
 import type { SimLambdaEnvironment } from "./environment/sim-lambda-environment.js";
@@ -42,12 +44,25 @@ export interface SimLambdaFunctionProperties {
      * real clock.
      */
     clock?: SimClock | undefined;
+    /**
+     * Scheduler this function's handler timers and invocation deadline wait on.
+     * A function built standalone, outside a SimAws instance, has none, and its
+     * handler keeps the host timers and runs for as long as it likes.
+     */
+    background?: BackgroundScheduler | undefined;
     /**
      * Where this function's handler output is recorded. A function built
      * standalone, outside a SimAws instance, has nowhere to record to and writes
      * only to the host streams.
      */
     logs?: SimLogsServiceWriter | undefined;
+    /**
+     * Where this function's output goes besides its log group, shared with every
+     * other function of the same simulated Lambda. A function built standalone
+     * gets settings of its own, which nothing else can reach and which leave the
+     * host console printing.
+     */
+    output?: SimLambdaOutput | undefined;
     /**
      * Where this function's invocations are counted. A function built
      * standalone, outside a SimAws instance, has no simulated CloudWatch to

package/dist/service/lambda/function/url/sim-lambda-function-url-cors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The cross-origin resource sharing settings of one Function URL.
+ *
+ * The member names are AWS's own. What `GetFunctionUrlConfig` reports is the
+ * record `CreateFunctionUrlConfig` was given.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/api/API_Cors.html
+ */
+export interface SimLambdaFunctionUrlCors {
+    readonly AllowCredentials?: boolean | undefined;
+    readonly AllowHeaders?: readonly string[] | undefined;
+    readonly AllowMethods?: readonly string[] | undefined;
+    readonly AllowOrigins?: readonly string[] | undefined;
+    readonly ExposeHeaders?: readonly string[] | undefined;
+    readonly MaxAge?: number | undefined;
+}

package/dist/service/lambda/function/url/sim-lambda-function-url-cors.factory.d.ts

@@ -0,0 +1,22 @@
+import { DynamicFactory } from "@kensio/part-factory";
+/**
+ * A CORS configuration whose lists are mutable. That is the shape the AWS
+ * SDK's own command input takes, so a test can hand what this factory makes
+ * straight to a `CreateFunctionUrlConfigCommand`.
+ */
+export interface SimLambdaFunctionUrlCorsParts {
+    AllowCredentials: boolean;
+    AllowHeaders: string[];
+    AllowMethods: string[];
+    AllowOrigins: string[];
+    ExposeHeaders: string[];
+    MaxAge: number;
+}
+/**
+ * Makes a valid Function URL CORS configuration, so a test states only the
+ * part of it the test is about.
+ *
+ * The default allows one named Origin. That is the case where the headers
+ * served depend on the request that asked for them.
+ */
+export declare const simLambdaFunctionUrlCorsFactory: DynamicFactory<SimLambdaFunctionUrlCorsParts, undefined>;

package/dist/service/lambda/function/url/sim-lambda-function-url-cors.factory.js

@@ -0,0 +1,17 @@
+import { faker } from "@faker-js/faker";
+import { DynamicFactory } from "@kensio/part-factory";
+/**
+ * Makes a valid Function URL CORS configuration, so a test states only the
+ * part of it the test is about.
+ *
+ * The default allows one named Origin. That is the case where the headers
+ * served depend on the request that asked for them.
+ */
+export const simLambdaFunctionUrlCorsFactory = new DynamicFactory(() => ({
+    AllowCredentials: false,
+    AllowHeaders: ["content-type"],
+    AllowMethods: ["GET"],
+    AllowOrigins: [`https://${faker.internet.domainName()}`],
+    ExposeHeaders: ["x-request-id"],
+    MaxAge: faker.number.int({ min: 1, max: 86_400 }),
+}));

package/dist/service/lambda/function/url/sim-lambda-function-url-cors.js

@@ -0,0 +1 @@
+export {};

package/dist/service/lambda/function/url/sim-lambda-function-url-factory.d.ts

@@ -1,6 +1,7 @@
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimLambdaUrlRegistry } from "../../registry/sim-lambda-url-registry.js";
 import type { SimLambdaFunction } from "../sim-lambda-function.js";
+import type { SimLambdaFunctionUrlCors } from "./sim-lambda-function-url-cors.js";
 import { SimLambdaFunctionUrl, type SimLambdaFunctionUrlAuthType, type SimLambdaFunctionUrlInvokeMode } from "./sim-lambda-function-url.js";
 import { type SimClock } from "../../../../util/clock/sim-clock.js";
 export interface SimLambdaFunctionUrlFactoryProperties {
@@ -12,6 +13,7 @@ interface MakeSimLambdaFunctionUrlProperties {
     readonly simFunction: SimLambdaFunction;
     readonly authType?: SimLambdaFunctionUrlAuthType | undefined;
     readonly invokeMode?: SimLambdaFunctionUrlInvokeMode | undefined;
+    readonly cors?: SimLambdaFunctionUrlCors | undefined;
 }
 /**
  * Builds Function URLs, taking their ids from the cross-Account registry.

package/dist/service/lambda/function/url/sim-lambda-function-url-factory.js

@@ -19,7 +19,7 @@ export class SimLambdaFunctionUrlFactory {
      * Make a registered Function URL for a function.
      */
     make(properties) {
-        const { simFunction, authType, invokeMode } = properties;
+        const { simFunction, authType, invokeMode, cors } = properties;
         const urlId = this.urlRegistry.allocateFunctionUrlId();
         this.urlRegistry.registerFunctionUrl(urlId, this.accountRegionScope.accountId);
         return new SimLambdaFunctionUrl({
@@ -29,6 +29,7 @@ export class SimLambdaFunctionUrlFactory {
             accountRegionScope: this.accountRegionScope,
             authType,
             invokeMode,
+            cors,
             clock: this.clock,
         });
     }

package/dist/service/lambda/function/url/sim-lambda-function-url-store.d.ts

@@ -1,10 +1,12 @@
 import type { SimLambdaFunction } from "../sim-lambda-function.js";
 import { type SimLambdaFunctionUrlFactoryProperties } from "./sim-lambda-function-url-factory.js";
+import type { SimLambdaFunctionUrlCors } from "./sim-lambda-function-url-cors.js";
 import type { SimLambdaFunctionUrl, SimLambdaFunctionUrlAuthType, SimLambdaFunctionUrlId, SimLambdaFunctionUrlInvokeMode } from "./sim-lambda-function-url.js";
 interface CreateSimLambdaFunctionUrlProperties {
     readonly simFunction: SimLambdaFunction;
     readonly authType?: SimLambdaFunctionUrlAuthType | undefined;
     readonly invokeMode?: SimLambdaFunctionUrlInvokeMode | undefined;
+    readonly cors?: SimLambdaFunctionUrlCors | undefined;
 }
 /**
  * Function URL state for one Account/Region scope of simulated Lambda.

package/dist/service/lambda/function/url/sim-lambda-function-url.d.ts

@@ -1,6 +1,7 @@
 import type { Brand } from "../../../../util/brand.type.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimLambdaFunctionName } from "../sim-lambda-function.js";
+import type { SimLambdaFunctionUrlCors } from "./sim-lambda-function-url-cors.js";
 import { type SimClock } from "../../../../util/clock/sim-clock.js";
 /**
  * The id AWS allocates for one Function URL, which is the leading DNS label of
@@ -31,6 +32,7 @@ interface SimLambdaFunctionUrlProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly authType?: SimLambdaFunctionUrlAuthType | undefined;
     readonly invokeMode?: SimLambdaFunctionUrlInvokeMode | undefined;
+    readonly cors?: SimLambdaFunctionUrlCors | undefined;
     /**
      * Clock stamping this Function URL's creation and last modified times. A
      * Function URL built standalone, outside a SimAws instance, falls back to the
@@ -42,12 +44,16 @@ interface SimLambdaFunctionUrlProperties {
  * Minimal structural Function URL configuration, as returned by the
  * CreateFunctionUrlConfig, GetFunctionUrlConfig and UpdateFunctionUrlConfig
  * commands.
+ *
+ * A URL configured without CORS has no `Cors` member at all. An empty block
+ * would still decide headers.
  */
 export interface SimLambdaFunctionUrlConfiguration {
     FunctionUrl: string;
     FunctionArn: string;
     AuthType: SimLambdaFunctionUrlAuthType;
     InvokeMode: SimLambdaFunctionUrlInvokeMode;
+    Cors?: SimLambdaFunctionUrlCors | undefined;
     CreationTime: string;
     LastModifiedTime: string;
 }
@@ -75,6 +81,11 @@ export declare class SimLambdaFunctionUrl {
      * Get the invocation mode for this Function URL.
      */
     get invokeMode(): SimLambdaFunctionUrlInvokeMode;
+    /**
+     * Get the CORS configuration for this Function URL. A URL without one sends
+     * no CORS headers of its own.
+     */
+    get cors(): SimLambdaFunctionUrlCors | undefined;
     /**
      * Get the endpoint hostname for this Function URL.
      */
@@ -88,10 +99,15 @@ export declare class SimLambdaFunctionUrl {
      * Apply an update to this Function URL's configuration.
      *
      * Omitted values are left as they are, as real UpdateFunctionUrlConfig does.
+     *
+     * A stated `Cors` replaces the whole block. An update naming only
+     * `AllowOrigins` drops the methods and headers the URL was created with, the
+     * way it does on AWS.
      */
     update(properties: {
         readonly authType?: SimLambdaFunctionUrlAuthType | undefined;
         readonly invokeMode?: SimLambdaFunctionUrlInvokeMode | undefined;
+        readonly cors?: SimLambdaFunctionUrlCors | undefined;
     }): void;
     /**
      * Get the AWS-like configuration for this Function URL.

package/dist/service/lambda/function/url/sim-lambda-function-url.js

@@ -23,10 +23,11 @@ export class SimLambdaFunctionUrl {
     creationTime;
     #authType;
     #invokeMode;
+    #cors;
     #lastModifiedTime;
     clock;
     constructor(properties) {
-        const { urlId, functionName, functionArn, accountRegionScope, authType = "NONE", invokeMode = "BUFFERED", clock = new SimRealClock(), } = properties;
+        const { urlId, functionName, functionArn, accountRegionScope, authType = "NONE", invokeMode = "BUFFERED", cors, clock = new SimRealClock(), } = properties;
         this.clock = clock;
         this.urlId = urlId;
         this.functionName = functionName;
@@ -34,6 +35,7 @@ export class SimLambdaFunctionUrl {
         this.accountRegionScope = accountRegionScope;
         this.#authType = authType;
         this.#invokeMode = invokeMode;
+        this.#cors = cors;
         this.creationTime = clock.now().toISOString();
         this.#lastModifiedTime = this.creationTime;
     }
@@ -49,6 +51,13 @@ export class SimLambdaFunctionUrl {
     get invokeMode() {
         return this.#invokeMode;
     }
+    /**
+     * Get the CORS configuration for this Function URL. A URL without one sends
+     * no CORS headers of its own.
+     */
+    get cors() {
+        return this.#cors;
+    }
     /**
      * Get the endpoint hostname for this Function URL.
      */
@@ -69,10 +78,15 @@ export class SimLambdaFunctionUrl {
      * Apply an update to this Function URL's configuration.
      *
      * Omitted values are left as they are, as real UpdateFunctionUrlConfig does.
+     *
+     * A stated `Cors` replaces the whole block. An update naming only
+     * `AllowOrigins` drops the methods and headers the URL was created with, the
+     * way it does on AWS.
      */
     update(properties) {
         this.#authType = properties.authType ?? this.#authType;
         this.#invokeMode = properties.invokeMode ?? this.#invokeMode;
+        this.#cors = properties.cors ?? this.#cors;
         this.#lastModifiedTime = this.clock.now().toISOString();
     }
     /**
@@ -84,6 +98,7 @@ export class SimLambdaFunctionUrl {
             FunctionArn: this.functionArn,
             AuthType: this.#authType,
             InvokeMode: this.#invokeMode,
+            ...(this.#cors !== undefined && { Cors: this.#cors }),
             CreationTime: this.creationTime,
             LastModifiedTime: this.#lastModifiedTime,
         };

package/dist/service/lambda/index.d.ts

@@ -1,4 +1,5 @@
 export { SimLambda } from "./sim-lambda.js";
+export { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 export { SimLambdaNoVmSdkModuleProvider, type SimLambdaVmSdkModuleProvider, } from "./function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
 export { SimSdkLambdaVmModuleProvider } from "./function/code/vm/sdk/sim-sdk-lambda-vm-module-provider.js";
 export { makeLambdaZipFileInput } from "./function/code/lambda-zip-file-input.js";

package/dist/service/lambda/index.js

@@ -1,4 +1,5 @@
 export { SimLambda } from "./sim-lambda.js";
+export { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 export { SimLambdaNoVmSdkModuleProvider, } from "./function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
 export { SimSdkLambdaVmModuleProvider } from "./function/code/vm/sdk/sim-sdk-lambda-vm-module-provider.js";
 export { makeLambdaZipFileInput } from "./function/code/lambda-zip-file-input.js";

package/dist/service/lambda/serve/response/sim-lambda-url-cors-headers.d.ts

@@ -0,0 +1,50 @@
+import type { SimLambdaFunctionUrlCors } from "../../function/url/sim-lambda-function-url-cors.js";
+/**
+ * The CORS headers one Function URL configuration decides for a request.
+ *
+ * Lambda adds these to every response the URL serves, and answers a preflight
+ * with them itself. `AllowOrigins` is the one member whose header depends on
+ * the request. A browser reads one value there, so Lambda sends back either the
+ * Origin that asked or the wildcard.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/dg/urls-configuration.html
+ */
+export declare class SimLambdaUrlCorsHeaders {
+    private readonly cors;
+    constructor(cors: SimLambdaFunctionUrlCors);
+    /**
+     * Whether this request is the preflight a browser sends before a
+     * cross-origin call it is not allowed to make blind.
+     */
+    isPreflight(request: Request): boolean;
+    /**
+     * The answer Lambda gives a preflight request itself.
+     *
+     * The function never runs for one. The configured headers are the whole
+     * response, and the handler has said nothing that could conflict with them.
+     */
+    preflightResponse(request: Request): Response;
+    /**
+     * Add the configured CORS headers to a response the function produced.
+     *
+     * They are appended. A handler that sends CORS headers of its own keeps them
+     * and the response carries both values, which is what AWS documents for
+     * anything but a preflight.
+     */
+    apply(headers: Headers, request: Request): void;
+    /**
+     * Which Origin this request is told it may read the response from.
+     *
+     * A list holding the wildcard allows every Origin outright. Otherwise the
+     * Origin has to be one the list names. A request carrying no Origin at all,
+     * such as one from curl, is told nothing.
+     */
+    private allowOrigin;
+    /**
+     * Send a configured list as one comma-separated header.
+     *
+     * An empty list names nothing. A header carrying an empty value says
+     * something else to a browser, so the header is left off.
+     */
+    private appendList;
+}

package/dist/service/lambda/serve/response/sim-lambda-url-cors-headers.js

@@ -0,0 +1,96 @@
+/**
+ * The request header a browser states the method it is asking about in.
+ *
+ * A preflight names it and nothing else does. That is what separates a
+ * preflight from an ordinary `OPTIONS` request the function should handle.
+ */
+const requestMethodHeader = "access-control-request-method";
+/**
+ * The CORS headers one Function URL configuration decides for a request.
+ *
+ * Lambda adds these to every response the URL serves, and answers a preflight
+ * with them itself. `AllowOrigins` is the one member whose header depends on
+ * the request. A browser reads one value there, so Lambda sends back either the
+ * Origin that asked or the wildcard.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/dg/urls-configuration.html
+ */
+export class SimLambdaUrlCorsHeaders {
+    cors;
+    constructor(cors) {
+        this.cors = cors;
+    }
+    /**
+     * Whether this request is the preflight a browser sends before a
+     * cross-origin call it is not allowed to make blind.
+     */
+    isPreflight(request) {
+        return (request.method === "OPTIONS" &&
+            request.headers.has("origin") &&
+            request.headers.has(requestMethodHeader));
+    }
+    /**
+     * The answer Lambda gives a preflight request itself.
+     *
+     * The function never runs for one. The configured headers are the whole
+     * response, and the handler has said nothing that could conflict with them.
+     */
+    preflightResponse(request) {
+        const headers = new Headers();
+        this.apply(headers, request);
+        return new Response(null, { status: 200, headers });
+    }
+    /**
+     * Add the configured CORS headers to a response the function produced.
+     *
+     * They are appended. A handler that sends CORS headers of its own keeps them
+     * and the response carries both values, which is what AWS documents for
+     * anything but a preflight.
+     */
+    apply(headers, request) {
+        const allowOrigin = this.allowOrigin(request.headers.get("origin"));
+        if (allowOrigin !== undefined) {
+            headers.append("access-control-allow-origin", allowOrigin);
+        }
+        // A false Access-Control-Allow-Credentials is not a value the fetch spec
+        // recognises. The header is left off instead.
+        if (this.cors.AllowCredentials === true) {
+            headers.append("access-control-allow-credentials", "true");
+        }
+        this.appendList(headers, "allow-methods", this.cors.AllowMethods);
+        this.appendList(headers, "allow-headers", this.cors.AllowHeaders);
+        this.appendList(headers, "expose-headers", this.cors.ExposeHeaders);
+        if (this.cors.MaxAge !== undefined) {
+            headers.append("access-control-max-age", String(this.cors.MaxAge));
+        }
+    }
+    /**
+     * Which Origin this request is told it may read the response from.
+     *
+     * A list holding the wildcard allows every Origin outright. Otherwise the
+     * Origin has to be one the list names. A request carrying no Origin at all,
+     * such as one from curl, is told nothing.
+     */
+    allowOrigin(requestOrigin) {
+        const allowOrigins = this.cors.AllowOrigins ?? [];
+        if (allowOrigins.includes("*")) {
+            return "*";
+        }
+        if (requestOrigin === null || !allowOrigins.includes(requestOrigin)) {
+            return undefined;
+        }
+        return requestOrigin;
+    }
+    /**
+     * Send a configured list as one comma-separated header.
+     *
+     * An empty list names nothing. A header carrying an empty value says
+     * something else to a browser, so the header is left off.
+     */
+    appendList(headers, suffix, values) {
+        if (values === undefined || values.length === 0) {
+            return;
+        }
+        headers.append(`access-control-${suffix}`, values.join(","));
+    }
+}

package/dist/service/lambda/serve/sim-lambda-controller.d.ts

@@ -16,6 +16,11 @@ interface SimLambdaServiceControllerProperties {
  * Either way the function itself runs as its execution Role, as it does for
  * any other invocation. Who invoked it and what it runs as are separate
  * questions on real Lambda, and stay separate here.
+ *
+ * A URL configured for CORS answers a preflight request itself, once the
+ * request has got past whatever its auth type asks of it. A browser cannot sign
+ * a preflight, and an `AWS_IAM` URL refuses one on the same terms it refuses
+ * any other unsigned request.
  */
 export declare class SimLambdaServiceController implements SimAwsServiceController {
     private readonly router;
@@ -46,6 +51,15 @@ export declare class SimLambdaServiceController implements SimAwsServiceControll
      * payload, so it is refused here rather than reaching the function.
      */
     private invokeAuthenticated;
+    /**
+     * Serve a request the Function URL has admitted.
+     *
+     * CORS is settled around the invocation. A preflight is answered from the
+     * configuration alone, and every other response carries the configured
+     * headers alongside whatever the handler sent, including a duplicate where
+     * the two disagree.
+     */
     private invoke;
+    private invokeFunction;
 }
 export {};

package/dist/service/lambda/serve/sim-lambda-controller.js

@@ -2,6 +2,7 @@ import { SimPayload2EventBuilder } from "../../../serve/payload-2/sim-payload-2-
 import { SimPayload2ResponseBuilder } from "../../../serve/payload-2/sim-payload-2-response-builder.js";
 import { SimAws } from "../../aws/sim-aws.js";
 import { simLambdaUrlEndpoint } from "./event/sim-lambda-url-endpoint.js";
+import { SimLambdaUrlCorsHeaders } from "./response/sim-lambda-url-cors-headers.js";
 import { SimLambdaUrlErrorResponse } from "./response/sim-lambda-url-error-response.js";
 import { SimLambdaUrlRouter, } from "./sim-lambda-url-router.js";
 import { SimLambdaUrlAuthorizer } from "./auth/sim-lambda-url-authorizer.js";
@@ -17,6 +18,11 @@ import { simLambdaUrlPayloadRefusal } from "./auth/sim-lambda-url-payload-hash.j
  * Either way the function itself runs as its execution Role, as it does for
  * any other invocation. Who invoked it and what it runs as are separate
  * questions on real Lambda, and stay separate here.
+ *
+ * A URL configured for CORS answers a preflight request itself, once the
+ * request has got past whatever its auth type asks of it. A browser cannot sign
+ * a preflight, and an `AWS_IAM` URL refuses one on the same terms it refuses
+ * any other unsigned request.
  */
 export class SimLambdaServiceController {
     router;
@@ -82,7 +88,28 @@ export class SimLambdaServiceController {
         }
         return await this.invoke(route, serviceRequest.request, caller);
     }
+    /**
+     * Serve a request the Function URL has admitted.
+     *
+     * CORS is settled around the invocation. A preflight is answered from the
+     * configuration alone, and every other response carries the configured
+     * headers alongside whatever the handler sent, including a duplicate where
+     * the two disagree.
+     */
     async invoke(route, request, authenticatedCaller) {
+        const { cors } = route.functionUrl;
+        if (cors === undefined) {
+            return await this.invokeFunction(route, request, authenticatedCaller);
+        }
+        const corsHeaders = new SimLambdaUrlCorsHeaders(cors);
+        if (corsHeaders.isPreflight(request)) {
+            return corsHeaders.preflightResponse(request);
+        }
+        const response = await this.invokeFunction(route, request, authenticatedCaller);
+        corsHeaders.apply(response.headers, request);
+        return response;
+    }
+    async invokeFunction(route, request, authenticatedCaller) {
         try {
             const event = await this.eventBuilder.build(request, simLambdaUrlEndpoint(route.functionUrl), { caller: authenticatedCaller });
             return this.responseBuilder.build(await route.simFunction.invoke(event));