@kensio/yulin 1.21.27 → 1.21.29

package/dist/config/eslint/cffjs2.eslint.config.js

@@ -13,6 +13,10 @@ export default defineConfig({
     files: ["**/*.cff.js"],
     extends: [tseslint.configs.disableTypeChecked],
     languageOptions: {
+        // The typescript-eslint rules below read scope information only its own
+        // parser produces. Under ESLint's default parser, `no-unused-vars` takes
+        // every reference for a type-only one and reports each variable.
+        parser: tseslint.parser,
         parserOptions: {
             projectService: false,
         },

package/dist/sdk/wire/sim-sdk-wire-bedrock-action.d.ts

@@ -0,0 +1,18 @@
+import type { SimSdkWireRequest, SimSdkWireResponse } from "./sim-sdk-wire.types.js";
+/**
+ * The REST-JSON content type, for bodies and for errors.
+ */
+export declare const simSdkWireBedrockJsonContentType = "application/json";
+/**
+ * How one Bedrock Runtime operation reads its input off a request and writes
+ * its output back.
+ */
+export interface SimSdkWireBedrockAction {
+    readonly commandName: string;
+    input(modelId: string, request: SimSdkWireRequest): unknown;
+    outputResponse(output: unknown): Promise<SimSdkWireResponse>;
+}
+/**
+ * The invocation operations, keyed by the last segment of their path.
+ */
+export declare const simSdkWireBedrockActions: ReadonlyMap<string, SimSdkWireBedrockAction>;

package/dist/sdk/wire/sim-sdk-wire-bedrock-action.js

@@ -0,0 +1,71 @@
+import { simSdkWireConverseInput, simSdkWireInvokeInput, } from "./sim-sdk-wire-bedrock-input.js";
+import { simSdkWireEventStreamBody, simSdkWireEventStreamContentType, } from "./sim-sdk-wire-event-stream.js";
+import { simSdkWireOutputResponse } from "./sim-sdk-wire-response.js";
+/**
+ * The REST-JSON content type, for bodies and for errors.
+ */
+export const simSdkWireBedrockJsonContentType = "application/json";
+/**
+ * The invocation operations, keyed by the last segment of their path.
+ */
+export const simSdkWireBedrockActions = new Map([
+    [
+        "converse",
+        {
+            commandName: "ConverseCommand",
+            input: simSdkWireConverseInput,
+            outputResponse: (output) => Promise.resolve(simSdkWireOutputResponse(output, simSdkWireBedrockJsonContentType)),
+        },
+    ],
+    [
+        "converse-stream",
+        {
+            commandName: "ConverseStreamCommand",
+            input: simSdkWireConverseInput,
+            outputResponse: async (output) => await eventStreamResponse(output.stream, {}),
+        },
+    ],
+    [
+        "invoke",
+        {
+            commandName: "InvokeModelCommand",
+            input: (modelId, request) => simSdkWireInvokeInput(modelId, request, "accept"),
+            outputResponse: invokeModelResponse,
+        },
+    ],
+    [
+        "invoke-with-response-stream",
+        {
+            commandName: "InvokeModelWithResponseStreamCommand",
+            input: (modelId, request) => simSdkWireInvokeInput(modelId, request, "x-amzn-bedrock-accept"),
+            outputResponse: async (output) => {
+                const { body, contentType } = output;
+                return await eventStreamResponse(body, {
+                    "x-amzn-bedrock-content-type": contentType,
+                });
+            },
+        },
+    ],
+]);
+/**
+ * `InvokeModel` answers with the model's own body as it is, labelled with its
+ * content type.
+ */
+function invokeModelResponse(output) {
+    const { body, contentType } = output;
+    return Promise.resolve({
+        statusCode: 200,
+        headers: { "content-type": contentType },
+        body,
+    });
+}
+/**
+ * The streaming operations answer with an event stream body.
+ */
+async function eventStreamResponse(events, headers) {
+    return {
+        statusCode: 200,
+        headers: { "content-type": simSdkWireEventStreamContentType, ...headers },
+        body: await simSdkWireEventStreamBody(events),
+    };
+}

package/dist/sdk/wire/sim-sdk-wire-bedrock-input.d.ts

@@ -0,0 +1,11 @@
+import type { SimSdkWireRequest } from "./sim-sdk-wire.types.js";
+/**
+ * `Converse` and `ConverseStream` send their input as the JSON body, less the
+ * model id the path carries.
+ */
+export declare function simSdkWireConverseInput(modelId: string, request: SimSdkWireRequest): unknown;
+/**
+ * The model invocations send the request body as it is, with every other
+ * member in a header.
+ */
+export declare function simSdkWireInvokeInput(modelId: string, request: SimSdkWireRequest, acceptHeaderName: string): unknown;

package/dist/sdk/wire/sim-sdk-wire-bedrock-input.js

@@ -0,0 +1,45 @@
+import { readSimSdkWireInput } from "./sim-sdk-wire-json.js";
+/**
+ * The Command input members `InvokeModel` and
+ * `InvokeModelWithResponseStream` carry in headers, with the header each one
+ * travels in. The two differ only in where they carry `accept`.
+ *
+ * Every one is read, including the ones the simulation refuses, so that a
+ * request naming a guardrail is refused here as it is through an intercepted
+ * client.
+ */
+const invokeHeaderMembers = [
+    ["contentType", "content-type"],
+    ["trace", "x-amzn-bedrock-trace"],
+    ["guardrailIdentifier", "x-amzn-bedrock-guardrailidentifier"],
+    ["guardrailVersion", "x-amzn-bedrock-guardrailversion"],
+    ["performanceConfigLatency", "x-amzn-bedrock-performanceconfig-latency"],
+    ["serviceTier", "x-amzn-bedrock-service-tier"],
+    ["requestMetadata", "x-amzn-bedrock-request-metadata"],
+];
+/**
+ * `Converse` and `ConverseStream` send their input as the JSON body, less the
+ * model id the path carries.
+ */
+export function simSdkWireConverseInput(modelId, request) {
+    return { ...readSimSdkWireInput(request.body), modelId };
+}
+/**
+ * The model invocations send the request body as it is, with every other
+ * member in a header.
+ */
+export function simSdkWireInvokeInput(modelId, request, acceptHeaderName) {
+    const members = [
+        ...invokeHeaderMembers,
+        ["accept", acceptHeaderName],
+    ].flatMap(([member, headerName]) => {
+        // oxlint-disable-next-line security/detect-object-injection -- this module's own fixed header names.
+        const value = request.headers[headerName];
+        return value === undefined ? [] : [[member, value]];
+    });
+    return {
+        ...Object.fromEntries(members),
+        modelId,
+        ...(request.body.byteLength > 0 && { body: request.body }),
+    };
+}

package/dist/sdk/wire/sim-sdk-wire-bedrock.d.ts

@@ -0,0 +1,10 @@
+import type { SimSdkWireCall } from "./sim-sdk-wire-call.js";
+import type { SimSdkWireRequest } from "./sim-sdk-wire.types.js";
+/**
+ * Read a Bedrock Runtime model invocation, which names its operation and its
+ * model in the path rather than in a header.
+ *
+ * A request counts as one when it was signed for Bedrock, or, unsigned, sent
+ * to a Bedrock Runtime endpoint, and its path is a model invocation.
+ */
+export declare function readSimSdkWireBedrockCall(request: SimSdkWireRequest): SimSdkWireCall | undefined;

package/dist/sdk/wire/sim-sdk-wire-bedrock.js

@@ -0,0 +1,47 @@
+import { simSdkWireBedrockActions, simSdkWireBedrockJsonContentType, } from "./sim-sdk-wire-bedrock-action.js";
+import { readSimSdkWireCredentialScope } from "./sim-sdk-wire-operation.js";
+import { simSdkWireErrorResponse } from "./sim-sdk-wire-response.js";
+/**
+ * The SDK `config.serviceId` of a `BedrockRuntimeClient`.
+ */
+const bedrockRuntimeServiceId = "Bedrock Runtime";
+/**
+ * The SigV4 signing name Bedrock Runtime requests are signed with.
+ */
+const bedrockSigningName = "bedrock";
+/**
+ * The path of a model invocation: `/model/{modelId}/{action}`, where the
+ * model id is URL-encoded and may be a whole ARN.
+ */
+const invocationPathPattern = /^\/model\/(?<modelId>[^/]+)\/(?<action>[a-z-]+)$/;
+/**
+ * Read a Bedrock Runtime model invocation, which names its operation and its
+ * model in the path rather than in a header.
+ *
+ * A request counts as one when it was signed for Bedrock, or, unsigned, sent
+ * to a Bedrock Runtime endpoint, and its path is a model invocation.
+ */
+export function readSimSdkWireBedrockCall(request) {
+    const signingName = readSimSdkWireCredentialScope(request)?.signingName;
+    const isBedrock = signingName === undefined
+        ? request.hostname.startsWith("bedrock-runtime.")
+        : signingName === bedrockSigningName;
+    if (!isBedrock || request.method.toUpperCase() !== "POST") {
+        return undefined;
+    }
+    const groups = invocationPathPattern.exec(request.path.split("?", 1)[0] ?? "")?.groups;
+    const action = simSdkWireBedrockActions.get(groups?.["action"] ?? "");
+    if (groups === undefined || action === undefined) {
+        return undefined;
+    }
+    // A malformed escape fails decoding, which is the service's answer to the
+    // request, so the model id is decoded when the input is read.
+    const encodedModelId = groups["modelId"] ?? "";
+    return {
+        serviceId: bedrockRuntimeServiceId,
+        commandName: action.commandName,
+        input: () => action.input(decodeURIComponent(encodedModelId), request),
+        outputResponse: async (output) => await action.outputResponse(output),
+        errorResponse: (error) => simSdkWireErrorResponse(error, simSdkWireBedrockJsonContentType),
+    };
+}

package/dist/sdk/wire/sim-sdk-wire-call.d.ts

@@ -0,0 +1,30 @@
+import type { SimSdkWireRequest, SimSdkWireResponse } from "./sim-sdk-wire.types.js";
+/**
+ * One wire request read back into the Command it was serialized from, with
+ * the protocol it came in to encode the answer in.
+ */
+export interface SimSdkWireCall {
+    /** The SDK `config.serviceId` of the service the request is addressed to. */
+    readonly serviceId: string;
+    /** The SDK Command class name the request would have been sent as. */
+    readonly commandName: string;
+    /**
+     * The Command input. Reading it can fail on a malformed body, and that
+     * failure is the service's answer to the request, so it is read when the
+     * operation runs.
+     */
+    input(): unknown;
+    /** The response for an output the simulated operation answered with. */
+    outputResponse(output: unknown): Promise<SimSdkWireResponse>;
+    /** The response for an error the simulated operation refused with. */
+    errorResponse(error: unknown): SimSdkWireResponse;
+}
+/**
+ * Read a wire request as the Command it was serialized from.
+ *
+ * Returns undefined for a request no reader here understands. The AWS JSON
+ * protocol services all name their operation in one header. Bedrock Runtime
+ * speaks REST-JSON, with the operation and model in the path, and has a
+ * reader of its own.
+ */
+export declare function readSimSdkWireCall(request: SimSdkWireRequest): SimSdkWireCall | undefined;

package/dist/sdk/wire/sim-sdk-wire-call.js

@@ -0,0 +1,32 @@
+import { readSimSdkWireBedrockCall } from "./sim-sdk-wire-bedrock.js";
+import { readSimSdkWireInput } from "./sim-sdk-wire-json.js";
+import { readSimSdkWireOperation } from "./sim-sdk-wire-operation.js";
+import { simSdkWireErrorResponse, simSdkWireOutputResponse, } from "./sim-sdk-wire-response.js";
+/**
+ * Read a wire request as the Command it was serialized from.
+ *
+ * Returns undefined for a request no reader here understands. The AWS JSON
+ * protocol services all name their operation in one header. Bedrock Runtime
+ * speaks REST-JSON, with the operation and model in the path, and has a
+ * reader of its own.
+ */
+export function readSimSdkWireCall(request) {
+    return readSimSdkWireJsonCall(request) ?? readSimSdkWireBedrockCall(request);
+}
+/**
+ * Read an AWS JSON protocol request, whose body is the Command input and
+ * whose response echoes the protocol version it was sent with.
+ */
+function readSimSdkWireJsonCall(request) {
+    const operation = readSimSdkWireOperation(request);
+    if (operation === undefined) {
+        return undefined;
+    }
+    const contentType = request.headers["content-type"];
+    return {
+        ...operation,
+        input: () => readSimSdkWireInput(request.body),
+        outputResponse: (output) => Promise.resolve(simSdkWireOutputResponse(output, contentType)),
+        errorResponse: (error) => simSdkWireErrorResponse(error, contentType),
+    };
+}

package/dist/sdk/wire/sim-sdk-wire-dispatcher.js

@@ -1,8 +1,7 @@
 import { SimSdkCommandDispatcher } from "../sim-sdk-command-dispatcher.js";
 import { makeSimSdkWireClient, makeSimSdkWireCommand, } from "./sim-sdk-wire-command.js";
-import { readSimSdkWireInput } from "./sim-sdk-wire-json.js";
-import { readSimSdkWireCredentialScope, readSimSdkWireOperation, } from "./sim-sdk-wire-operation.js";
-import { simSdkWireErrorResponse, simSdkWireOutputResponse, } from "./sim-sdk-wire-response.js";
+import { readSimSdkWireCall } from "./sim-sdk-wire-call.js";
+import { readSimSdkWireCredentialScope } from "./sim-sdk-wire-operation.js";
 import { simSdkUnbridgedWireRequest } from "./sim-sdk-wire-unbridged.js";
 /**
  * Dispatches AWS API requests to simulated AWS service operations.
@@ -44,20 +43,19 @@ export class SimSdkWireDispatcher {
      * relies on.
      */
     async dispatch(request, caller) {
-        const operation = readSimSdkWireOperation(request);
-        if (operation === undefined) {
+        const call = readSimSdkWireCall(request);
+        if (call === undefined) {
             throw simSdkUnbridgedWireRequest(request);
         }
         // The operation runs in the Region it was signed for or, unsigned, the
         // Region of the code that sent it.
         const scope = readSimSdkWireCredentialScope(request);
-        const contentType = request.headers["content-type"];
         try {
-            const output = await this.dispatcher.dispatch(makeSimSdkWireCommand(operation.commandName, readSimSdkWireInput(request.body)), makeSimSdkWireClient(operation.serviceId, scope?.regionName ?? this.regionName), undefined, caller);
-            return simSdkWireOutputResponse(output, contentType);
+            const output = await this.dispatcher.dispatch(makeSimSdkWireCommand(call.commandName, call.input()), makeSimSdkWireClient(call.serviceId, scope?.regionName ?? this.regionName), undefined, caller);
+            return await call.outputResponse(output);
         }
         catch (error) {
-            return simSdkWireErrorResponse(error, contentType);
+            return call.errorResponse(error);
         }
     }
 }

package/dist/sdk/wire/sim-sdk-wire-event-stream.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The media type of an AWS event stream response body.
+ */
+export declare const simSdkWireEventStreamContentType = "application/vnd.amazon.eventstream";
+/**
+ * Encode an event stream as the `application/vnd.amazon.eventstream` body an
+ * SDK reads it from.
+ *
+ * Each event is a union with one member set, as an SDK hands it to calling
+ * code (`{ chunk: { bytes } }` or `{ contentBlockDelta: { ... } }`). The
+ * member name is the message's event type, and its value is the JSON payload.
+ *
+ * The whole stream is read before the body is built. A simulated stream has
+ * every event available at once, so sending them together loses nothing.
+ */
+export declare function simSdkWireEventStreamBody(events: AsyncIterable<object>): Promise<Uint8Array>;

package/dist/sdk/wire/sim-sdk-wire-event-stream.js

@@ -0,0 +1,79 @@
+import { crc32 } from "../../util/zip/crc32.js";
+import { simSdkWireJsonBody } from "./sim-sdk-wire-json.js";
+/**
+ * The media type of an AWS event stream response body.
+ */
+export const simSdkWireEventStreamContentType = "application/vnd.amazon.eventstream";
+/**
+ * The header value type code for a string, the only type written here.
+ */
+const stringHeaderType = 7;
+/**
+ * The bytes of the prelude: the total length, the headers length and the
+ * prelude checksum, each four bytes.
+ */
+const preludeLength = 12;
+/**
+ * The bytes of the checksum closing every message.
+ */
+const messageChecksumLength = 4;
+/**
+ * Encode an event stream as the `application/vnd.amazon.eventstream` body an
+ * SDK reads it from.
+ *
+ * Each event is a union with one member set, as an SDK hands it to calling
+ * code (`{ chunk: { bytes } }` or `{ contentBlockDelta: { ... } }`). The
+ * member name is the message's event type, and its value is the JSON payload.
+ *
+ * The whole stream is read before the body is built. A simulated stream has
+ * every event available at once, so sending them together loses nothing.
+ */
+export async function simSdkWireEventStreamBody(events) {
+    const messages = [];
+    for await (const event of events) {
+        const members = Object.entries(event).filter(([, value]) => value !== undefined);
+        for (const [eventType, value] of members) {
+            messages.push(eventMessage(eventType, simSdkWireJsonBody(value)));
+        }
+    }
+    return Buffer.concat(messages);
+}
+/**
+ * Encode one event message.
+ *
+ * The layout is the prelude, the headers, the payload and a CRC-32 of
+ * everything before it. The prelude ends with a CRC-32 of its first eight
+ * bytes.
+ */
+function eventMessage(eventType, payload) {
+    const headers = Buffer.concat([
+        stringHeader(":event-type", eventType),
+        stringHeader(":content-type", "application/json"),
+        stringHeader(":message-type", "event"),
+    ]);
+    const totalLength = preludeLength + headers.length + payload.length + messageChecksumLength;
+    const checksumOffset = totalLength - messageChecksumLength;
+    const message = Buffer.alloc(totalLength);
+    message.writeUInt32BE(totalLength, 0);
+    message.writeUInt32BE(headers.length, 4);
+    message.writeUInt32BE(crc32(message.subarray(0, 8)), 8);
+    headers.copy(message, preludeLength);
+    message.set(payload, preludeLength + headers.length);
+    message.writeUInt32BE(crc32(message.subarray(0, checksumOffset)), checksumOffset);
+    return message;
+}
+/**
+ * Encode one string-valued header: the name length and name, the type code,
+ * and the value length and value.
+ */
+function stringHeader(name, value) {
+    const nameBytes = Buffer.from(name);
+    const valueBytes = Buffer.from(value);
+    const header = Buffer.alloc(4 + nameBytes.length + valueBytes.length);
+    header.writeUInt8(nameBytes.length, 0);
+    nameBytes.copy(header, 1);
+    header.writeUInt8(stringHeaderType, 1 + nameBytes.length);
+    header.writeUInt16BE(valueBytes.length, 2 + nameBytes.length);
+    valueBytes.copy(header, 4 + nameBytes.length);
+    return header;
+}

package/dist/sdk/wire/sim-sdk-wire-unbridged.js

@@ -16,8 +16,8 @@ import { readSimSdkWireCredentialScope } from "./sim-sdk-wire-operation.js";
 export function simSdkUnbridgedWireRequest(request) {
     const service = readSimSdkWireCredentialScope(request)?.signingName ?? request.hostname;
     return new SimSdkUnbridgedWireRequestError(`Cannot answer a request to ${service} from the simulation: a ` +
-        "serialized AWS API request can only be routed for a service using " +
-        "the AWS JSON protocol. Where this is an AWS SDK bundled into " +
+        "serialized AWS API request can only be routed for S3, Bedrock " +
+        "Runtime and the services using the AWS JSON protocol. Where this is an AWS SDK bundled into " +
         "function code, leaving the SDK out of the deployment package puts it " +
         "back on the module interception path, which every simulated service " +
         "is reachable through.");

package/dist/service/bedrock/command/authorize/sim-bedrock-authorizer.js

@@ -24,9 +24,13 @@ export class SimBedrockAuthorizer {
             caller: options.caller,
         });
         if (decision.isDenied) {
-            throw new SimBedrockAccessDeniedException(`User: ${this.callerIdentifier.format(decision.caller.principal)} is ` +
-                `not authorized to perform: ${action} on resource: ${resource} ` +
-                `because no identity-based policy allows the ${action} action`);
+            // A service control policy denial names the policy, as other services'
+            // denials do.
+            const reason = decision.denialReason ??
+                `because no identity-based policy allows the ${action} action`;
+            const caller = this.callerIdentifier.format(decision.caller.principal);
+            throw new SimBedrockAccessDeniedException(`User: ${caller} is not authorized to perform: ${action} on ` +
+                `resource: ${resource} ${reason}`);
         }
         return decision.caller;
     }

package/dist/service/cloudformation/parameters/sim-cfn-parameter-list-type.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Whether a declared Parameter `Type` holds a list.
+ *
+ * `CommaDelimitedList` and every `List<...>` type do, whatever the member
+ * type. A `Ref` to one resolves to a list of strings, `List<Number>` included.
+ */
+export declare function isSimCfnParameterListType(type: string | undefined): boolean;

package/dist/service/cloudformation/parameters/sim-cfn-parameter-list-type.js

@@ -0,0 +1,9 @@
+/**
+ * Whether a declared Parameter `Type` holds a list.
+ *
+ * `CommaDelimitedList` and every `List<...>` type do, whatever the member
+ * type. A `Ref` to one resolves to a list of strings, `List<Number>` included.
+ */
+export function isSimCfnParameterListType(type) {
+    return type === "CommaDelimitedList" || (type?.startsWith("List<") ?? false);
+}

package/dist/service/cloudformation/parameters/sim-cfn-parameter-values.d.ts

@@ -13,6 +13,9 @@ interface SimCfnParameterValuesProperties {
  * the command wins over a template `Default`, and a Parameter declared as a
  * Parameter Store value type reads whichever of the two it ended up with as the
  * name to read.
+ *
+ * A `CommaDelimitedList` or `List<...>` Parameter is given its value as one
+ * comma-separated string, and holds it as the list of members.
  */
 export declare class SimCfnParameterValues {
     private readonly values;
@@ -29,5 +32,12 @@ export declare class SimCfnParameterValues {
      * `Default`.
      */
     private recordDefaults;
+    /**
+     * Split the value of each list-typed Parameter on its commas.
+     *
+     * Each member is trimmed of the spaces around it, as CloudFormation trims
+     * them. A value with no commas is a list of one.
+     */
+    private splitLists;
 }
 export {};

package/dist/service/cloudformation/parameters/sim-cfn-parameter-values.js

@@ -1,3 +1,4 @@
+import { isSimCfnParameterListType } from "./sim-cfn-parameter-list-type.js";
 import { SimCfnParameterStoreValues } from "./store/sim-cfn-parameter-store-values.js";
 /**
  * The runtime value of every Parameter a Stack was created with.
@@ -6,6 +7,9 @@ import { SimCfnParameterStoreValues } from "./store/sim-cfn-parameter-store-valu
  * the command wins over a template `Default`, and a Parameter declared as a
  * Parameter Store value type reads whichever of the two it ended up with as the
  * name to read.
+ *
+ * A `CommaDelimitedList` or `List<...>` Parameter is given its value as one
+ * comma-separated string, and holds it as the list of members.
  */
 export class SimCfnParameterValues {
     values;
@@ -15,6 +19,7 @@ export class SimCfnParameterValues {
         this.storeValues = new SimCfnParameterStoreValues({ store });
         this.values = new Map(Object.entries(supplied));
         this.recordDefaults(definitions);
+        this.splitLists(definitions);
         this.storeValues.applyTo(this.values, definitions);
     }
     /** Every Parameter that resolved to a stand-in value. */
@@ -39,4 +44,19 @@ export class SimCfnParameterValues {
             }
         }
     }
+    /**
+     * Split the value of each list-typed Parameter on its commas.
+     *
+     * Each member is trimmed of the spaces around it, as CloudFormation trims
+     * them. A value with no commas is a list of one.
+     */
+    splitLists(definitions) {
+        for (const [parameterName, definition] of definitions) {
+            const value = this.values.get(parameterName);
+            if (typeof value === "string" &&
+                isSimCfnParameterListType(definition.Type)) {
+                this.values.set(parameterName, value.split(",").map((member) => member.trim()));
+            }
+        }
+    }
 }

package/dist/service/cloudformation/parameters/sim-cfn-parameters.type.d.ts

@@ -5,9 +5,10 @@ import type { SimCfnParameterStoreReader } from "./store/sim-cfn-parameter-store
  * defaults and Parameter Store reads have been applied.
  *
  * A Parameter is given its value as a string, because AWS CloudFormation
- * command inputs provide ParameterValue as one. A Parameter declared as
- * `AWS::SSM::Parameter::Value<List<String>>` is given a parameter name and
- * resolves to the stored value split into a list, so a resolved value can be
+ * command inputs provide ParameterValue as one. A `CommaDelimitedList` or
+ * `List<...>` Parameter resolves to that string split into a list. So does an
+ * `AWS::SSM::Parameter::Value<List<String>>` Parameter, which is given a
+ * parameter name and splits the value stored under it. A resolved value can be
  * either.
  */
 export type SimCloudFormationParameterValue = string | string[];
@@ -61,8 +62,9 @@ export type SimCfnParametersContext = Pick<SimCfnParametersProperties, "definiti
  *
  * Most fields are recorded for structural typing/documentation. Runtime
  * behavior applies string Default values when a command does not provide an
- * explicit Parameter value, and reads an `AWS::SSM::Parameter::Value<...>`
- * Type from simulated Parameter Store.
+ * explicit Parameter value, splits the value of a `CommaDelimitedList` or
+ * `List<...>` Type, and reads an `AWS::SSM::Parameter::Value<...>` Type from
+ * simulated Parameter Store.
  */
 export interface SimCfnParameterDefinition {
     readonly Type?: string | undefined;

package/dist/service/cloudformation/parameters/store/sim-cfn-parameter-store-value-type.js

@@ -1,3 +1,4 @@
+import { isSimCfnParameterListType } from "../sim-cfn-parameter-list-type.js";
 /** The Parameter type that holds a Parameter Store name. */
 const parameterStoreValuePrefix = "AWS::SSM::Parameter::Value<";
 /**
@@ -14,6 +15,6 @@ export function simCfnParameterStoreValueType(declaredType) {
     }
     const innerType = declaredType.slice(parameterStoreValuePrefix.length, -1);
     return {
-        list: innerType === "CommaDelimitedList" || innerType.startsWith("List<"),
+        list: isSimCfnParameterListType(innerType),
     };
 }

package/dist/service/cloudformation/template/node/fn/join/sim-cfn-fn-join.d.ts

@@ -9,19 +9,25 @@ import type { SimCfnResolveContext } from "../../../resolve/sim-cfn-resolve-cont
  * {
  *   "Fn::Join": ["-", ["a", "b", { "Ref": "Name" }]]
  * }
+ *
+ * The values may also come from one function that returns the whole list:
+ *
+ * {
+ *   "Fn::Join": [",", { "Fn::GetAtt": ["Zone", "NameServers"] }]
+ * }
  */
 export declare class SimCfnFnJoin extends SimCfnNode {
     private readonly delimiter;
     private readonly values;
-    constructor(delimiter: string, values: readonly SimCfnNode[]);
+    constructor(delimiter: string, values: SimCfnNode);
     /**
-     * Resolve each value and join them with the delimiter.
+     * Resolve the values and join them with the delimiter.
      *
-     * Joining happens only when every value has resolved to a string. If any
-     * value is still an unresolved expression (for example a Resource `Ref`
-     * during the up-front pass before Resources exist), this node re-emits
-     * itself in template form. A later resolution pass can finish it once the
-     * referenced Resources are available.
+     * Joining happens only when the values have resolved to a list of strings.
+     * If the list, or any value in it, is still an unresolved expression (for
+     * example a Resource `Ref` during the up-front pass before Resources exist),
+     * this node re-emits itself in template form. A later resolution pass can
+     * finish it once the referenced Resources are available.
      *
      * A dynamic reference can be assembled out of the joined values, as CDK
      * writes one whenever the secret it reads sits in the same Stack: the
@@ -32,16 +38,15 @@ export declare class SimCfnFnJoin extends SimCfnNode {
      */
     resolve(context: SimCfnResolveContext): SimCfnTemplateValue;
     /**
-     * Collect referenced names from every joined value.
+     * Collect referenced names from the values.
      */
     referencedNames(): string[];
-    private resolveValue;
     /**
-     * Whether a resolved value is still an unresolved intrinsic expression.
+     * Refuse a value that can never become a string.
      *
-     * Only object-shaped values (a preserved `Ref` or nested function object)
-     * are treated as deferred. Other non-string primitives such as numbers are
-     * genuine type errors.
+     * A string joins now, and an unresolved expression may join on a later
+     * pass. Anything else (a number, a nested list, a plain object) is a type
+     * error, as CloudFormation joins a list of strings only.
      */
-    private isDeferredExpression;
+    private assertJoinable;
 }