@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/cloudformation/authorize/sim-cloudformation-authorization.d.ts

@@ -33,10 +33,33 @@ export declare class SimCloudFormationAuthorization {
      * Ensure the caller may delete the named Stack.
      */
     deleteStack(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may create a change set against the named Stack.
+     */
+    createChangeSet(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may describe a change set against the named Stack.
+     */
+    describeChangeSet(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may execute a change set against the named Stack.
+     */
+    executeChangeSet(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may delete a change set against the named Stack.
+     */
+    deleteChangeSet(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may list the change sets against the named Stack.
+     */
+    listChangeSets(stackName: string | undefined, caller?: SimAwsCaller): void;
     private authorize;
     /**
      * The Stack ARN a command operates on. A command naming no Stack, which
      * DescribeStacks allows, is asking about every Stack in the scope.
+     *
+     * A command that named the Stack by its ID named the ARN itself, so that is
+     * what gets authorized rather than an ARN built around it.
      */
     private stackArn;
 }

package/dist/service/cloudformation/authorize/sim-cloudformation-authorization.js

@@ -1,4 +1,5 @@
 import { SimIamActionAuthorizer } from "../../iam/authorize/sim-iam-action-authorizer.js";
+import { isSimCfnStackId } from "../stack/sim-cfn-stack-id.js";
 /**
  * Who may do what to a simulated CloudFormation Stack.
  *
@@ -38,14 +39,50 @@ export class SimCloudFormationAuthorization {
     deleteStack(stackName, caller) {
         this.authorize("cloudformation:DeleteStack", stackName, caller);
     }
+    /**
+     * Ensure the caller may create a change set against the named Stack.
+     */
+    createChangeSet(stackName, caller) {
+        this.authorize("cloudformation:CreateChangeSet", stackName, caller);
+    }
+    /**
+     * Ensure the caller may describe a change set against the named Stack.
+     */
+    describeChangeSet(stackName, caller) {
+        this.authorize("cloudformation:DescribeChangeSet", stackName, caller);
+    }
+    /**
+     * Ensure the caller may execute a change set against the named Stack.
+     */
+    executeChangeSet(stackName, caller) {
+        this.authorize("cloudformation:ExecuteChangeSet", stackName, caller);
+    }
+    /**
+     * Ensure the caller may delete a change set against the named Stack.
+     */
+    deleteChangeSet(stackName, caller) {
+        this.authorize("cloudformation:DeleteChangeSet", stackName, caller);
+    }
+    /**
+     * Ensure the caller may list the change sets against the named Stack.
+     */
+    listChangeSets(stackName, caller) {
+        this.authorize("cloudformation:ListChangeSets", stackName, caller);
+    }
     authorize(action, stackName, caller) {
         this.authorizer.authorize(action, this.stackArn(stackName), caller);
     }
     /**
      * The Stack ARN a command operates on. A command naming no Stack, which
      * DescribeStacks allows, is asking about every Stack in the scope.
+     *
+     * A command that named the Stack by its ID named the ARN itself, so that is
+     * what gets authorized rather than an ARN built around it.
      */
     stackArn(stackName) {
+        if (stackName !== undefined && isSimCfnStackId(stackName)) {
+            return stackName;
+        }
         const { accountId, regionName } = this.accountRegionScope;
         return `arn:aws:cloudformation:${regionName}:${accountId}:stack/${stackName ?? "*"}/*`;
     }

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-copier.d.ts

@@ -1,8 +1,10 @@
 import type { SimS3Bucket } from "../../../../../s3/bucket/sim-s3-bucket.js";
+import type { SimCdkBucketDeployNotifier } from "../notify/sim-cdk-bucket-deploy-notifier.js";
 import type { SimCdkBucketDeployProperties } from "../property/sim-cdk-bucket-deploy-properties.js";
 interface SimCdkBucketDeployCopierProperties {
     readonly bucket: SimS3Bucket;
     readonly properties: SimCdkBucketDeployProperties;
+    readonly notifier: SimCdkBucketDeployNotifier;
 }
 /**
  * Copies a staged CDK asset into a simulated destination Bucket.

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-copier.js

@@ -31,6 +31,7 @@ export class SimCdkBucketDeployCopier {
             bucket: properties.bucket,
             filter: this.filter,
             keyPrefix: this.properties.destinationKeyPrefix,
+            notifier: properties.notifier,
         });
     }
     /**

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-file.d.ts

@@ -1,8 +1,10 @@
 import type { SimS3Bucket } from "../../../../../s3/bucket/sim-s3-bucket.js";
+import type { SimCdkBucketDeployNotifier } from "../notify/sim-cdk-bucket-deploy-notifier.js";
 import type { SimCdkBucketDeployProperties } from "../property/sim-cdk-bucket-deploy-properties.js";
 interface SimCdkBucketDeployFileProperties {
     readonly bucket: SimS3Bucket;
     readonly properties: SimCdkBucketDeployProperties;
+    readonly notifier: SimCdkBucketDeployNotifier;
 }
 /**
  * Copies one file from a staged CDK asset into a simulated Bucket.
@@ -13,9 +15,14 @@ interface SimCdkBucketDeployFileProperties {
 export declare class SimCdkBucketDeployFile {
     private readonly bucket;
     private readonly properties;
+    private readonly notifier;
     constructor(properties: SimCdkBucketDeployFileProperties);
     /**
      * Store one file as an Object, and answer with the key it went under.
+     *
+     * The Object goes into the Bucket rather than through PutObject, so the
+     * event a Put would have raised is raised here, once the write has happened
+     * and carrying the version it was given.
      */
     copy(sourceDirectoryPath: string, relativePath: string): Promise<string>;
     /**

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-file.js

@@ -11,18 +11,30 @@ import { metadataForFilesystemS3ObjectKey } from "../../../../../s3/storage/file
 export class SimCdkBucketDeployFile {
     bucket;
     properties;
+    notifier;
     constructor(properties) {
         this.bucket = properties.bucket;
         this.properties = properties.properties;
+        this.notifier = properties.notifier;
     }
     /**
      * Store one file as an Object, and answer with the key it went under.
+     *
+     * The Object goes into the Bucket rather than through PutObject, so the
+     * event a Put would have raised is raised here, once the write has happened
+     * and carrying the version it was given.
      */
     async copy(sourceDirectoryPath, relativePath) {
         const key = this.properties.objectKey(relativePath);
         // oxlint-disable-next-line security/detect-non-literal-fs-filename
         const body = await readFile(path.join(sourceDirectoryPath, relativePath));
-        await this.bucket.putObject(new SimS3Object({ key, body, metadata: this.metadata(relativePath) }));
+        const object = new SimS3Object({
+            key,
+            body,
+            metadata: this.metadata(relativePath),
+        });
+        const version = await this.bucket.putObject(object);
+        this.notifier.deployed(object, version?.versionId);
         return key;
     }
     /**

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-pruner.d.ts

@@ -1,9 +1,11 @@
 import type { SimS3Bucket } from "../../../../../s3/bucket/sim-s3-bucket.js";
 import type { SimCdkBucketDeployFilter } from "../filter/sim-cdk-bucket-deploy-filter.js";
+import type { SimCdkBucketDeployNotifier } from "../notify/sim-cdk-bucket-deploy-notifier.js";
 interface SimCdkBucketDeployPrunerProperties {
     readonly bucket: SimS3Bucket;
     readonly filter: SimCdkBucketDeployFilter;
     readonly keyPrefix: string;
+    readonly notifier: SimCdkBucketDeployNotifier;
 }
 /**
  * Removes the Objects a deployment covers but no longer holds.
@@ -19,9 +21,13 @@ export declare class SimCdkBucketDeployPruner {
     private readonly bucket;
     private readonly filter;
     private readonly keyPrefix;
+    private readonly notifier;
     constructor(properties: SimCdkBucketDeployPrunerProperties);
     /**
      * Remove everything this deployment would have copied and did not.
+     *
+     * Each removal raises what a DeleteObject would have raised, since the sync
+     * this stands in for deletes through the API like any other caller.
      */
     prune(deployedKeys: ReadonlySet<string>): Promise<void>;
     private isStale;

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-pruner.js

@@ -12,19 +12,25 @@ export class SimCdkBucketDeployPruner {
     bucket;
     filter;
     keyPrefix;
+    notifier;
     constructor(properties) {
         this.bucket = properties.bucket;
         this.filter = properties.filter;
         this.keyPrefix = properties.keyPrefix;
+        this.notifier = properties.notifier;
     }
     /**
      * Remove everything this deployment would have copied and did not.
+     *
+     * Each removal raises what a DeleteObject would have raised, since the sync
+     * this stands in for deletes through the API like any other caller.
      */
     async prune(deployedKeys) {
         const existing = await this.bucket.listObjects(this.keyPrefix);
         const stale = existing.filter((object) => this.isStale(object.key, deployedKeys));
         await Promise.all(stale.map(async (object) => {
-            await this.bucket.deleteObject(object.key);
+            const deletion = await this.bucket.deleteObject(object.key);
+            this.notifier.pruned(object.key, deletion);
         }));
     }
     isStale(key, deployedKeys) {

package/dist/service/cloudformation/cdk/s3/bucket-deployment/notify/sim-cdk-bucket-deploy-notifier.d.ts

@@ -0,0 +1,50 @@
+import type { SimAwsResolvedCaller } from "../../../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimS3Bucket } from "../../../../../s3/bucket/sim-s3-bucket.js";
+import type { SimS3ObjectDeletion } from "../../../../../s3/bucket/sim-s3-object-deletion.js";
+import type { SimS3ObjectNotifier } from "../../../../../s3/notification/sim-s3-object-notifier.js";
+import type { SimS3Object } from "../../../../../s3/object/s3-object.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../../../resource/sim-cfn-resource.js";
+interface SimCdkBucketDeployNotifierProperties {
+    readonly bucket: SimS3Bucket;
+    readonly notifications: SimS3ObjectNotifier;
+    readonly caller: SimAwsResolvedCaller;
+}
+/**
+ * Raises the S3 Object events a deployment into a Bucket earns.
+ *
+ * A deployment writes Objects rather than sending S3 commands, so it says here
+ * what a command would have said for it. Real CDK runs a provider function
+ * that syncs the staged asset into the Bucket, one PutObject per file and one
+ * DeleteObject per Object the sync deletes, and a Bucket with a notification
+ * configuration hears all of them.
+ */
+export declare class SimCdkBucketDeployNotifier {
+    private readonly bucket;
+    private readonly notifications;
+    private readonly caller;
+    constructor(properties: SimCdkBucketDeployNotifierProperties);
+    /**
+     * Say that the deployment wrote an Object.
+     */
+    deployed(object: SimS3Object, versionId: string | undefined): void;
+    /**
+     * Say that the deployment pruned a key, as far as the delete got.
+     *
+     * A pruning deployment deletes rather than removes. A versioned Bucket keeps
+     * what it held behind a marker, and the event says so. That is the same
+     * three-way answer a DeleteObject command gets, so the same reading of it
+     * serves here.
+     */
+    pruned(key: string, deletion: SimS3ObjectDeletion): void;
+}
+/**
+ * The notifier for one deployment, reaching the Bucket's own simulated S3.
+ *
+ * The events are attributed to the Account root rather than to the deployment's
+ * caller. Real S3 names the identity that wrote the Object, which for a CDK
+ * BucketDeployment is the provider function's execution role, and neither that
+ * function nor its role is simulated. Root is what simulated AWS attributes an
+ * unstated caller to everywhere else.
+ */
+export declare function simCdkBucketDeployNotifier(resource: SimCfnResource, bucket: SimS3Bucket, context: SimCloudFormationResourceCreateContext): SimCdkBucketDeployNotifier;
+export {};

package/dist/service/cloudformation/cdk/s3/bucket-deployment/notify/sim-cdk-bucket-deploy-notifier.js

@@ -0,0 +1,71 @@
+import { makeSimAwsAccountRootPrincipal } from "../../../../../aws/caller/sim-aws-account-root-principal.js";
+import { simAwsResolvedCallerOf } from "../../../../../aws/caller/sim-aws-resolved-caller.js";
+import { simS3NotifyDeleted } from "../../../../../s3/command/delete-object/sim-s3-notify-deleted.js";
+/**
+ * Raises the S3 Object events a deployment into a Bucket earns.
+ *
+ * A deployment writes Objects rather than sending S3 commands, so it says here
+ * what a command would have said for it. Real CDK runs a provider function
+ * that syncs the staged asset into the Bucket, one PutObject per file and one
+ * DeleteObject per Object the sync deletes, and a Bucket with a notification
+ * configuration hears all of them.
+ */
+export class SimCdkBucketDeployNotifier {
+    bucket;
+    notifications;
+    caller;
+    constructor(properties) {
+        this.bucket = properties.bucket;
+        this.notifications = properties.notifications;
+        this.caller = properties.caller;
+    }
+    /**
+     * Say that the deployment wrote an Object.
+     */
+    deployed(object, versionId) {
+        this.notifications.objectCreated({
+            bucket: this.bucket,
+            object,
+            caller: this.caller,
+            eventName: "s3:ObjectCreated:Put",
+            versionId,
+        });
+    }
+    /**
+     * Say that the deployment pruned a key, as far as the delete got.
+     *
+     * A pruning deployment deletes rather than removes. A versioned Bucket keeps
+     * what it held behind a marker, and the event says so. That is the same
+     * three-way answer a DeleteObject command gets, so the same reading of it
+     * serves here.
+     */
+    pruned(key, deletion) {
+        simS3NotifyDeleted({
+            notifications: this.notifications,
+            bucket: this.bucket,
+            key,
+            caller: this.caller,
+            deletion,
+        });
+    }
+}
+/**
+ * The notifier for one deployment, reaching the Bucket's own simulated S3.
+ *
+ * The events are attributed to the Account root rather than to the deployment's
+ * caller. Real S3 names the identity that wrote the Object, which for a CDK
+ * BucketDeployment is the provider function's execution role, and neither that
+ * function nor its role is simulated. Root is what simulated AWS attributes an
+ * unstated caller to everywhere else.
+ */
+export function simCdkBucketDeployNotifier(resource, bucket, context) {
+    const { accountId, regionName } = resource.accountRegionScope;
+    return new SimCdkBucketDeployNotifier({
+        bucket,
+        notifications: context.simAws
+            .accountRegionScope(accountId, regionName)
+            .s3()
+            .objectNotifier(),
+        caller: simAwsResolvedCallerOf(makeSimAwsAccountRootPrincipal(accountId)),
+    });
+}

package/dist/service/cloudformation/cdk/s3/bucket-deployment/sim-cdk-bucket-deployment.js

@@ -2,6 +2,7 @@ import { SimCdkBucketDeploySource } from "./source/sim-cdk-bucket-deploy-source.
 import { SimCdkBucketDeployCopier } from "./copy/sim-cdk-bucket-deploy-copier.js";
 import { SimCdkBucketDeployProperties } from "./property/sim-cdk-bucket-deploy-properties.js";
 import { declareSimCdkBucketDeployMetadata } from "./metadata/sim-cdk-bucket-deploy-metadata.js";
+import { simCdkBucketDeployNotifier } from "./notify/sim-cdk-bucket-deploy-notifier.js";
 import { simCdkBucketDeployDestination } from "./destination/sim-cdk-bucket-deploy-destination.js";
 /**
  * CloudFormation Resource factory for CDK BucketDeployment compatibility.
@@ -36,10 +37,14 @@ export class SimCdkBucketDeploymentResourceFactory {
     async createCdkBucketDeployment(resource, context) {
         const properties = new SimCdkBucketDeployProperties(resource, context.resolvedProperties ?? resource.properties);
         const bucket = simCdkBucketDeployDestination(resource, properties, context);
-        const sourceDirectoryPaths = properties.sourceObjectKeys.map((sourceObjectKey) => this.sourceResolver.sourceDirectoryPathForObjectKey(resource, sourceObjectKey, context.cdkOutContext));
+        const sourceDirectoryPaths = this.sourceResolver.sourceDirectoryPaths(resource, properties.sourceObjectKeys, context.cdkOutContext);
+        // The copier writes Objects into the Bucket instead of sending PutObject,
+        // and a Bucket configured to notify still hears about every file it writes
+        // and every Object it prunes.
         const publishedKeys = await new SimCdkBucketDeployCopier({
             bucket,
             properties,
+            notifier: simCdkBucketDeployNotifier(resource, bucket, context),
         }).copy(sourceDirectoryPaths);
         // Said as well as set. The Objects above carry these headers themselves,
         // and a directory mounted over them later cannot, so the Bucket keeps what

package/dist/service/cloudformation/cdk/s3/bucket-deployment/source/sim-cdk-bucket-deploy-source.d.ts

@@ -4,6 +4,11 @@ import type { SimCdkOutContext } from "../../../sim-cdk-out-context.js";
  * Resolves the filesystem source directory for a CDK BucketDeployment asset.
  */
 export declare class SimCdkBucketDeploySource {
+    /**
+     * Find the local source directory for every source object key a deployment
+     * names, in the order it names them.
+     */
+    sourceDirectoryPaths(resource: SimCfnResource, sourceObjectKeys: readonly string[], cdkOutContext: SimCdkOutContext | undefined): string[];
     /**
      * Find the local source directory for a CDK BucketDeployment source object key.
      */

package/dist/service/cloudformation/cdk/s3/bucket-deployment/source/sim-cdk-bucket-deploy-source.js

@@ -4,6 +4,13 @@ import { SimCdkBucketDeployErrorMessage } from "../error-message/sim-cdk-bucket-
  * Resolves the filesystem source directory for a CDK BucketDeployment asset.
  */
 export class SimCdkBucketDeploySource {
+    /**
+     * Find the local source directory for every source object key a deployment
+     * names, in the order it names them.
+     */
+    sourceDirectoryPaths(resource, sourceObjectKeys, cdkOutContext) {
+        return sourceObjectKeys.map((objectKey) => this.sourceDirectoryPathForObjectKey(resource, objectKey, cdkOutContext));
+    }
     /**
      * Find the local source directory for a CDK BucketDeployment source object key.
      */

package/dist/service/cloudformation/changeset/sim-cfn-change-set-arn.d.ts

@@ -0,0 +1,9 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+/**
+ * The ARN CloudFormation gives one change set.
+ *
+ * The unique part is a UUID, as it is for a Stack ID, so two change sets
+ * created under the same name against different Stacks are still told apart by
+ * their ARN alone.
+ */
+export declare function simCfnChangeSetArn(scope: SimAwsAccountRegionScope, changeSetName: string): string;

package/dist/service/cloudformation/changeset/sim-cfn-change-set-arn.js

@@ -0,0 +1,12 @@
+import { randomUUID } from "node:crypto";
+/**
+ * The ARN CloudFormation gives one change set.
+ *
+ * The unique part is a UUID, as it is for a Stack ID, so two change sets
+ * created under the same name against different Stacks are still told apart by
+ * their ARN alone.
+ */
+export function simCfnChangeSetArn(scope, changeSetName) {
+    const { regionName, accountId } = scope;
+    return `arn:aws:cloudformation:${regionName}:${accountId}:changeSet/${changeSetName}/${randomUUID()}`;
+}

package/dist/service/cloudformation/changeset/sim-cfn-change-set-changes.d.ts

@@ -0,0 +1,42 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
+import type { SimCfnStack } from "../stack/sim-cfn-stack.js";
+import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
+import type { SimCfnChangeSetType, SimCfnResourceChange } from "./sim-cfn-change-set.type.js";
+interface SimCfnChangeSetPlanProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly background: BackgroundScheduler;
+    readonly stack: SimCfnStack;
+    readonly type: SimCfnChangeSetType;
+    readonly template: SimCfnTemplate;
+}
+/**
+ * What executing a change set would do to the Stack it is held against.
+ *
+ * A `CREATE` change set is compared against nothing, because the Stack it
+ * brought into being holds no created Resource yet.
+ */
+export declare function simCfnChangeSetPlan(properties: SimCfnChangeSetPlanProperties): readonly SimCfnResourceChange[];
+interface SimCfnChangeSetChangesProperties {
+    /** The Resources the Stack holds now. Empty for a Stack in review. */
+    readonly current: ReadonlyMap<string, SimCfnResource>;
+    /** The Resources the change set's template describes. */
+    readonly updated: ReadonlyMap<string, SimCfnResource>;
+}
+/**
+ * What executing a change set would do to a Stack's Resources.
+ *
+ * The same comparison an update makes, reported rather than applied. A
+ * Resource only the new template has is an `Add`, one only the Stack has is a
+ * `Remove`, and one both have whose resolved template entry changed is a
+ * `Modify`. A Resource that would be replaced because it names a replaced one
+ * is a `Modify` too, which is how CloudFormation reports a dependent it has to
+ * hand a new physical name to.
+ *
+ * The order follows the templates. The new template's Resources come first, in
+ * the order it declares them, and the dropped ones after in the order the Stack
+ * holds them.
+ */
+export declare function simCfnChangeSetChanges(properties: SimCfnChangeSetChangesProperties): readonly SimCfnResourceChange[];
+export {};

package/dist/service/cloudformation/changeset/sim-cfn-change-set-changes.js

@@ -0,0 +1,69 @@
+import { makeSimCfnStackResourceMap } from "../stack/resource-map/sim-cfn-stack-resource-map.js";
+import { simCfnStackReplacedLogicalIds } from "../stack/update/sim-cfn-stack-replaced-resources.js";
+/**
+ * What executing a change set would do to the Stack it is held against.
+ *
+ * A `CREATE` change set is compared against nothing, because the Stack it
+ * brought into being holds no created Resource yet.
+ */
+export function simCfnChangeSetPlan(properties) {
+    const { accountRegionScope, background, stack, type, template } = properties;
+    return simCfnChangeSetChanges({
+        current: type === "CREATE" ? new Map() : stack.resourceMap,
+        updated: makeSimCfnStackResourceMap({
+            accountRegionScope,
+            background,
+            template,
+        }),
+    });
+}
+/**
+ * What executing a change set would do to a Stack's Resources.
+ *
+ * The same comparison an update makes, reported rather than applied. A
+ * Resource only the new template has is an `Add`, one only the Stack has is a
+ * `Remove`, and one both have whose resolved template entry changed is a
+ * `Modify`. A Resource that would be replaced because it names a replaced one
+ * is a `Modify` too, which is how CloudFormation reports a dependent it has to
+ * hand a new physical name to.
+ *
+ * The order follows the templates. The new template's Resources come first, in
+ * the order it declares them, and the dropped ones after in the order the Stack
+ * holds them.
+ */
+export function simCfnChangeSetChanges(properties) {
+    const { current, updated } = properties;
+    const replaced = simCfnStackReplacedLogicalIds({ current, updated });
+    const changed = updated
+        .values()
+        .filter((resource) => !unchanged(resource, current, replaced))
+        .map((resource) => ({
+        action: current.has(resource.logicalId)
+            ? "Modify"
+            : "Add",
+        logicalResourceId: resource.logicalId,
+        resourceType: resource.type,
+        replacement: current.has(resource.logicalId)
+            ? "True"
+            : undefined,
+    }))
+        .toArray();
+    const removed = current
+        .values()
+        .filter((resource) => !updated.has(resource.logicalId))
+        .map((resource) => ({
+        action: "Remove",
+        logicalResourceId: resource.logicalId,
+        resourceType: resource.type,
+        replacement: undefined,
+    }))
+        .toArray();
+    return [...changed, ...removed];
+}
+/**
+ * Whether the Stack already holds this Resource as the new template describes
+ * it, which is a Resource the change set leaves out.
+ */
+function unchanged(resource, current, replaced) {
+    return current.has(resource.logicalId) && !replaced.has(resource.logicalId);
+}

package/dist/service/cloudformation/changeset/sim-cfn-change-set-commands.d.ts

@@ -0,0 +1,62 @@
+import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimCfnStack } from "../stack/sim-cfn-stack.js";
+import type { SimCloudFormationStackName } from "../stack/sim-cfn-stack.type.js";
+import type { SimCfnExports } from "../export/sim-cfn-exports.js";
+import type { SimCloudFormationAuthorization } from "../authorize/sim-cloudformation-authorization.js";
+import type { SimCreateChangeSetCommand, SimCreateChangeSetCommandOutput } from "../command/create-change-set/create-change-set.command.js";
+import type { SimDescribeChangeSetCommand, SimDescribeChangeSetCommandOutput } from "../command/describe-change-set/describe-change-set.command.js";
+import type { SimExecuteChangeSetCommand, SimExecuteChangeSetCommandOutput } from "../command/execute-change-set/execute-change-set.command.js";
+import type { SimDeleteChangeSetCommand, SimDeleteChangeSetCommandOutput } from "../command/delete-change-set/delete-change-set.command.js";
+import type { SimListChangeSetsCommand, SimListChangeSetsCommandOutput } from "../command/list-change-sets/list-change-sets.command.js";
+interface SimCfnChangeSetCommandsProperties {
+    readonly simAws: SimAws;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly stacks: Map<SimCloudFormationStackName, SimCfnStack>;
+    readonly background: BackgroundScheduler & BackgroundCompleter;
+    readonly authorization: SimCloudFormationAuthorization;
+    readonly exports?: SimCfnExports | undefined;
+}
+/**
+ * The change set half of simulated CloudFormation's SDK surface.
+ *
+ * The five change set commands share one registry of held change sets and the
+ * same Stack map every other command reads, so they are assembled once here
+ * rather than in SimCloudFormation alongside the Stack commands.
+ *
+ * Authorization happens here rather than in SimCloudFormation, because three of
+ * the five commands can name a change set by its ARN alone. The Stack such a
+ * request operates on is the one the change set belongs to, and only this
+ * registry knows which that is.
+ */
+export declare class SimCfnChangeSetCommands {
+    private readonly properties;
+    private readonly changeSets;
+    constructor(properties: SimCfnChangeSetCommandsProperties);
+    /** Work out what a template would change about a Stack, and hold it. */
+    create(command: SimCreateChangeSetCommand, caller?: SimAwsCaller): Promise<SimCreateChangeSetCommandOutput>;
+    /** Report what a held change set would do to its Stack. */
+    describe(command: SimDescribeChangeSetCommand, caller?: SimAwsCaller): Promise<SimDescribeChangeSetCommandOutput>;
+    /** Apply what a change set describes to its Stack. */
+    execute(command: SimExecuteChangeSetCommand, caller?: SimAwsCaller): Promise<SimExecuteChangeSetCommandOutput>;
+    /** Take a change set away without executing it. */
+    delete(command: SimDeleteChangeSetCommand, caller?: SimAwsCaller): Promise<SimDeleteChangeSetCommandOutput>;
+    /** List the change sets held against one Stack. */
+    list(command: SimListChangeSetsCommand, caller?: SimAwsCaller): Promise<SimListChangeSetsCommandOutput>;
+    /**
+     * The Stack a request naming one change set operates on.
+     *
+     * A request carrying the change set ARN alone leaves out the Stack name, and
+     * the change set it names knows which Stack it belongs to. Authorizing on
+     * what the request said would ask about every Stack in the scope, so a
+     * caller allowed one Stack would be refused a change set against it.
+     *
+     * A change set the registry does not hold falls back to what the request
+     * said. The handler refuses it, and refusing an unauthorized caller first is
+     * what keeps that refusal from saying which change sets exist.
+     */
+    private stackNameFor;
+}
+export {};