@kensio/yulin 1.21.3 → 1.21.4

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-event.js

@@ -20,14 +20,16 @@ import { samImplicitHttpApiLogicalId, samImplicitHttpApiResources, } from "./sim
  */
 export function samHttpApiEventResources(event) {
     const apiId = samHttpApiEventApiId(event.properties);
+    const apiLogicalId = samHttpApiEventApiLogicalId(event.properties);
     const prefix = `${event.functionLogicalId}${event.eventName}HttpApi`;
     const integrationLogicalId = `${prefix}Integration`;
     return {
         ...(event.properties["ApiId"] === undefined &&
-            samImplicitHttpApiResources()),
+            samImplicitHttpApiResources(event.apiAuth.get(samImplicitHttpApiLogicalId))),
         [integrationLogicalId]: integrationResource(event, apiId),
         [`${prefix}Route`]: samHttpApiRouteResource({
             apiId,
+            apiLogicalId,
             integrationLogicalId,
             event,
         }),
@@ -54,6 +56,26 @@ function samHttpApiEventApiId(properties) {
     }
     return isSamTemplateRecord(apiId) ? apiId : { Ref: apiId };
 }
+/**
+ * The logical ID of the API this event routes to, where that API is a Resource
+ * of this template.
+ *
+ * It is the name the event's `Auth` is read against, since an API's
+ * authorizers are declared on the API the template holds. An `ApiId` written
+ * as an intrinsic this cannot read names an API whose `Auth` block is out of
+ * reach, and the route it expands into takes no authorizer from it.
+ */
+function samHttpApiEventApiLogicalId(properties) {
+    const apiId = properties["ApiId"];
+    if (apiId === undefined) {
+        return samImplicitHttpApiLogicalId;
+    }
+    if (typeof apiId === "string") {
+        return apiId;
+    }
+    const reference = isSamTemplateRecord(apiId) ? apiId["Ref"] : undefined;
+    return typeof reference === "string" ? reference : undefined;
+}
 /**
  * The AWS::ApiGatewayV2::Integration the route sends its requests through.
  *

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-route.d.ts

@@ -5,13 +5,20 @@ interface SamHttpApiRouteProperties {
     readonly apiId: SimCfnTemplateValue;
     /** The logical ID of the integration the route targets. */
     readonly integrationLogicalId: string;
+    /**
+     * The logical ID of the API the route belongs to, where the API is one this
+     * template declares. An event naming its API with an intrinsic this cannot
+     * read names no `Auth` block either.
+     */
+    readonly apiLogicalId: string | undefined;
     readonly event: SamFunctionEvent;
 }
 /**
  * The AWS::ApiGatewayV2::Route the event's path and method are served by.
  *
- * `Auth` on the event is not expanded. The route authorizes nothing, and every
- * request matching it reaches the function.
+ * `Auth` on the event names one of the API's authorizers, and an event naming
+ * none takes the API's `DefaultAuthorizer`. A route neither of them closes
+ * authorizes nothing, and every request matching it reaches the function.
  */
 export declare function samHttpApiRouteResource(route: SamHttpApiRouteProperties): SimCfnTemplateValueRecord;
 export {};

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-http-api-route.js

@@ -1,10 +1,12 @@
 import { simHttpApiDefaultRouteKey } from "../../../../apigatewayv2/api/route/key/sim-http-api-default-route-key.js";
 import { simHttpApiAnyMethod } from "../../../../apigatewayv2/api/route/key/sim-http-api-route-method.js";
+import { samEventAuthorization } from "../../api/auth/sim-cfn-sam-event-authorization.js";
 /**
  * The AWS::ApiGatewayV2::Route the event's path and method are served by.
  *
- * `Auth` on the event is not expanded. The route authorizes nothing, and every
- * request matching it reaches the function.
+ * `Auth` on the event names one of the API's authorizers, and an event naming
+ * none takes the API's `DefaultAuthorizer`. A route neither of them closes
+ * authorizes nothing, and every request matching it reaches the function.
  */
 export function samHttpApiRouteResource(route) {
     return {
@@ -13,7 +15,7 @@ export function samHttpApiRouteResource(route) {
         Properties: {
             ApiId: route.apiId,
             ...samHttpApiRouteKey(route.event.properties),
-            AuthorizationType: "NONE",
+            ...samEventAuthorization(route.event, route.apiLogicalId),
             Target: {
                 "Fn::Join": [
                     "",

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-implicit-http-api.d.ts

@@ -1,4 +1,5 @@
 import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamApiAuth } from "../../api/auth/sim-cfn-sam-api-auth.types.js";
 /**
  * The logical ID SAM gives the API that every `HttpApi` event naming no
  * `ApiId` shares. It is the name a template reaches the implicit API by, in an
@@ -15,5 +16,9 @@ export declare const samImplicitHttpApiLogicalId = "ServerlessHttpApi";
  *
  * Every event naming no `ApiId` produces this same pair, and they are keyed by
  * logical ID, so the API is created once however many events share it.
+ *
+ * The `Auth` it takes is the one `Globals.HttpApi` states, which is where SAM
+ * says an implicit API's authorizers come from. Nothing else of that section
+ * reaches this API.
  */
-export declare function samImplicitHttpApiResources(): Record<string, SimCfnTemplateValue>;
+export declare function samImplicitHttpApiResources(auth: SamApiAuth | undefined): Record<string, SimCfnTemplateValue>;

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-implicit-http-api.js

@@ -1,3 +1,4 @@
+import { samApiAuthResources } from "../../api/auth/sim-cfn-sam-api-auth.js";
 /**
  * The logical ID SAM gives the API that every `HttpApi` event naming no
  * `ApiId` shares. It is the name a template reaches the implicit API by, in an
@@ -18,8 +19,12 @@ const implicitStageLogicalId = `${samImplicitHttpApiLogicalId}ApiGatewayDefaultS
  *
  * Every event naming no `ApiId` produces this same pair, and they are keyed by
  * logical ID, so the API is created once however many events share it.
+ *
+ * The `Auth` it takes is the one `Globals.HttpApi` states, which is where SAM
+ * says an implicit API's authorizers come from. Nothing else of that section
+ * reaches this API.
  */
-export function samImplicitHttpApiResources() {
+export function samImplicitHttpApiResources(auth) {
     return {
         [samImplicitHttpApiLogicalId]: {
             Type: "AWS::ApiGatewayV2::Api",
@@ -36,5 +41,6 @@ export function samImplicitHttpApiResources() {
                 AutoDeploy: true,
             },
         },
+        ...(auth !== undefined && samApiAuthResources(auth)),
     };
 }

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-triggered-user-pool.d.ts

@@ -0,0 +1,19 @@
+import type { SimCfnTemplateValueRecord } from "../../../template/value/sim-cfn-template-value.js";
+import type { SamFunctionEvent } from "./sim-cfn-sam-declared-event.js";
+/**
+ * The user pool with an event's triggers on it.
+ *
+ * What the pool already declared is kept, so a template naming some of its
+ * triggers by hand keeps them and two events on one pool both arrive.
+ *
+ * A trigger the pool already names a function for is refused. The pool runs
+ * one function per trigger, so the alternative is a template whose two
+ * declarations disagree and whose deployment silently picks one.
+ *
+ * The trigger is unconditional even where the function is conditioned. A
+ * `Condition` covers a whole Resource, and there is no conditioning a fragment
+ * of somebody else's property. A template that conditions the function out and
+ * leaves the pool fails on the pool naming a function the Stack never created,
+ * the same answer an `S3` event on a conditioned function gets.
+ */
+export declare function samTriggeredUserPool(event: SamFunctionEvent, triggers: readonly string[], resource: SimCfnTemplateValueRecord): SimCfnTemplateValueRecord;

package/dist/service/cloudformation/sam/function/event/sim-cfn-sam-triggered-user-pool.js

@@ -0,0 +1,69 @@
+import { samPropertyError } from "../../sim-cfn-sam-error.js";
+import { isSamTemplateRecord, samRecordAt } from "../../sim-cfn-sam-record.js";
+import { samFunctionType } from "../sim-cfn-sam-function-type.js";
+/**
+ * The user pool with an event's triggers on it.
+ *
+ * What the pool already declared is kept, so a template naming some of its
+ * triggers by hand keeps them and two events on one pool both arrive.
+ *
+ * A trigger the pool already names a function for is refused. The pool runs
+ * one function per trigger, so the alternative is a template whose two
+ * declarations disagree and whose deployment silently picks one.
+ *
+ * The trigger is unconditional even where the function is conditioned. A
+ * `Condition` covers a whole Resource, and there is no conditioning a fragment
+ * of somebody else's property. A template that conditions the function out and
+ * leaves the pool fails on the pool naming a function the Stack never created,
+ * the same answer an `S3` event on a conditioned function gets.
+ */
+export function samTriggeredUserPool(event, triggers, resource) {
+    const properties = samRecordAt(resource, "Properties");
+    const declared = declaredLambdaConfig(event, properties);
+    return {
+        ...resource,
+        Properties: {
+            ...properties,
+            LambdaConfig: {
+                ...declared,
+                ...Object.fromEntries(triggers.map((name) => [name, functionArn(event, declared, name)])),
+            },
+        },
+    };
+}
+/**
+ * The `LambdaConfig` the pool already carries.
+ *
+ * One written as anything but a block of triggers is refused rather than
+ * replaced, since adding to it would drop what it holds. A `LambdaConfig`
+ * written as an intrinsic is a block as far as this can tell, and the event's
+ * triggers go on beside it for the pool to refuse the unresolved key by name.
+ */
+function declaredLambdaConfig(event, properties) {
+    const declared = properties["LambdaConfig"];
+    if (declared !== undefined && !isSamTemplateRecord(declared)) {
+        throw triggerError(event, "UserPool", "the pool's LambdaConfig is not a block of triggers by name, and a " +
+            "Cognito event has no way to add a trigger to one");
+    }
+    return samRecordAt(properties, "LambdaConfig");
+}
+/**
+ * The function the trigger runs, refusing a trigger the pool already names a
+ * function for.
+ */
+function functionArn(event, declared, name) {
+    // oxlint-disable-next-line security/detect-object-injection -- a template record read by a trigger name the event stated.
+    if (declared[name] !== undefined) {
+        throw triggerError(event, "Trigger", `the pool already names a function for ${name}, and it runs one ` +
+            "function per trigger");
+    }
+    return { "Fn::GetAtt": [event.functionLogicalId, "Arn"] };
+}
+function triggerError(event, property, reason) {
+    return samPropertyError({
+        resourceType: samFunctionType,
+        logicalId: event.functionLogicalId,
+        property: `Events.${event.eventName}.${property}`,
+        reason,
+    });
+}

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-template.factory.d.ts

@@ -20,6 +20,11 @@ export interface SimCfnSamFunctionTemplateInput {
      * `Api` event takes from them. A test stating none gets no section.
      */
     readonly apiGlobals: SimCfnTemplateValueRecord;
+    /**
+     * The `Globals.HttpApi` defaults the template states, for a test about what
+     * an `HttpApi` event takes from them. A test stating none gets no section.
+     */
+    readonly httpApiGlobals: SimCfnTemplateValueRecord;
     /**
      * Resources the template carries beside the function, such as the API an
      * event names or a second function sharing one.

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-template.factory.js

@@ -1,6 +1,6 @@
 import { MappedFactory } from "@kensio/part-factory";
 import { samTransformName } from "../sim-cfn-sam-transform.js";
-import { samFunctionType } from "./sim-cfn-sam-function.js";
+import { samFunctionType } from "./sim-cfn-sam-function-type.js";
 /**
  * The logical ID the function carries, and so the name the Lambda function and
  * its execution Role are expanded under.
@@ -31,6 +31,7 @@ export const simCfnSamFunctionTemplateFactory = new MappedFactory(() => ({
     functionProperties: {},
     globals: {},
     apiGlobals: {},
+    httpApiGlobals: {},
     resources: {},
 }), (input) => ({
     Transform: samTransformName,
@@ -50,6 +51,7 @@ function globalsSection(input) {
     const globals = {
         ...section("Function", input.globals),
         ...section("Api", input.apiGlobals),
+        ...section("HttpApi", input.httpApiGlobals),
     };
     return Object.keys(globals).length === 0 ? {} : { Globals: globals };
 }

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-type.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The SAM Resource type a function is declared as.
+ *
+ * It sits on its own so that what a function's events expand into can name the
+ * Resource they were declared on without importing the expansion they are part
+ * of.
+ */
+export declare const samFunctionType = "AWS::Serverless::Function";

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-type.js

@@ -0,0 +1,8 @@
+/**
+ * The SAM Resource type a function is declared as.
+ *
+ * It sits on its own so that what a function's events expand into can name the
+ * Resource they were declared on without importing the expansion they are part
+ * of.
+ */
+export const samFunctionType = "AWS::Serverless::Function";

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function-url.js

@@ -2,11 +2,8 @@ import { isSamTemplateRecord } from "../sim-cfn-sam-record.js";
 import { samConditionAttribute } from "./sim-cfn-sam-function-properties.js";
 /**
  * The `FunctionUrlConfig` properties the AWS::Lambda::Url carries over.
- *
- * `Cors` is left out. The simulated Function URL answers no preflight request,
- * and carrying the property over would say it did.
  */
-const carriedNames = new Set(["AuthType", "InvokeMode"]);
+const carriedNames = new Set(["AuthType", "InvokeMode", "Cors"]);
 /**
  * The AWS::Lambda::Url a function's `FunctionUrlConfig` is expanded into.
  *

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function.d.ts

@@ -1,4 +1,5 @@
 import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+import type { SamTemplateApiAuth } from "../api/auth/sim-cfn-sam-template-api-auth.js";
 import type { SamTemplateGlobals } from "../sim-cfn-sam-globals.js";
 import type { SamResourceEdit } from "./event/sim-cfn-sam-resource-edit.js";
 interface SamFunctionExpansionProperties {
@@ -9,11 +10,12 @@ interface SamFunctionExpansionProperties {
      * `Function`, and its `Api` events take theirs from `Api`.
      */
     readonly globals: SamTemplateGlobals;
+    /**
+     * The `Auth` of every API of the template, for the function's `Api` and
+     * `HttpApi` events.
+     */
+    readonly apiAuth: SamTemplateApiAuth;
 }
-/**
- * The SAM Resource type this expansion covers.
- */
-export declare const samFunctionType = "AWS::Serverless::Function";
 /**
  * Expand one AWS::Serverless::Function into the Resources CloudFormation
  * deploys for it.

package/dist/service/cloudformation/sam/function/sim-cfn-sam-function.js

@@ -3,10 +3,6 @@ import { samFunctionEventEdits, samFunctionEventResources, } from "./event/sim-c
 import { samCarriedAttributes, samCarriedProperties, samResourceProperties, } from "./sim-cfn-sam-function-properties.js";
 import { samFunctionRoleResource } from "./sim-cfn-sam-function-role.js";
 import { samFunctionUrlResources } from "./sim-cfn-sam-function-url.js";
-/**
- * The SAM Resource type this expansion covers.
- */
-export const samFunctionType = "AWS::Serverless::Function";
 /**
  * Expand one AWS::Serverless::Function into the Resources CloudFormation
  * deploys for it.
@@ -56,6 +52,7 @@ export function samFunctionResources(properties) {
             functionProperties,
             condition,
             apiGlobals: globals.forApi,
+            apiAuth: properties.apiAuth,
         }),
     };
 }
@@ -75,5 +72,6 @@ export function samFunctionResourceEdits(properties) {
         functionProperties: samMergedFunctionProperties(globals.forFunction, samResourceProperties(resource)),
         condition: resource["Condition"],
         apiGlobals: globals.forApi,
+        apiAuth: properties.apiAuth,
     });
 }

package/dist/service/cloudformation/sam/sim-cfn-sam-error.d.ts

@@ -0,0 +1,31 @@
+/**
+ * What a refusal names. The property comes first, then the SAM Resource that
+ * declared it.
+ */
+export interface SamPropertyRefusal {
+    /** The SAM Resource type the property was declared on. */
+    readonly resourceType: string;
+    /**
+     * The logical ID of the SAM Resource. An implicit API carries the logical ID
+     * SAM gives it, since that is the name a template reaches it by.
+     */
+    readonly logicalId: string;
+    /** The property, written the way a template writes it. */
+    readonly property: string;
+    /** Why the expansion will not take it. */
+    readonly reason: string;
+}
+/**
+ * Build the error a property of a SAM Resource is refused with.
+ *
+ * The wording matters. Sim CloudFormation downgrades a failure whose message
+ * reads as an unsupported Resource type into a skip, and a skipped `Auth` is
+ * the dangerous case. The API is still deployed, the Stack looks right, and
+ * every request reaches the function. So this says `Invalid`, and never says
+ * `Unsupported sim`.
+ *
+ * The property is named separately from the Resource because an `Auth` block
+ * is read several levels deep, and a refusal saying only which API failed
+ * leaves the Stack owner hunting for the level that was wrong.
+ */
+export declare function samPropertyError(refusal: SamPropertyRefusal): Error;

package/dist/service/cloudformation/sam/sim-cfn-sam-error.js

@@ -0,0 +1,17 @@
+/**
+ * Build the error a property of a SAM Resource is refused with.
+ *
+ * The wording matters. Sim CloudFormation downgrades a failure whose message
+ * reads as an unsupported Resource type into a skip, and a skipped `Auth` is
+ * the dangerous case. The API is still deployed, the Stack looks right, and
+ * every request reaches the function. So this says `Invalid`, and never says
+ * `Unsupported sim`.
+ *
+ * The property is named separately from the Resource because an `Auth` block
+ * is read several levels deep, and a refusal saying only which API failed
+ * leaves the Stack owner hunting for the level that was wrong.
+ */
+export function samPropertyError(refusal) {
+    return new Error(`Invalid ${refusal.property} on ${refusal.resourceType} Resource ` +
+        `${refusal.logicalId}: ${refusal.reason}`);
+}

package/dist/service/cloudformation/sam/sim-cfn-sam-expansion.js

@@ -1,8 +1,10 @@
 import { isRecord } from "../../../util/type-guard/record.js";
 import { samHttpApiResources, samHttpApiType, } from "./api/sim-cfn-sam-http-api.js";
 import { samRestApiResources, samRestApiType, } from "./api/sim-cfn-sam-rest-api.js";
+import { samTemplateApiAuth } from "./api/auth/sim-cfn-sam-template-api-auth.js";
 import { samEditedResources } from "./function/event/sim-cfn-sam-resource-edit.js";
-import { samFunctionResourceEdits, samFunctionResources, samFunctionType, } from "./function/sim-cfn-sam-function.js";
+import { samFunctionResourceEdits, samFunctionResources, } from "./function/sim-cfn-sam-function.js";
+import { samFunctionType } from "./function/sim-cfn-sam-function-type.js";
 import { samSimpleTableResources, samSimpleTableType, } from "./table/sim-cfn-sam-simple-table.js";
 import { samTemplateGlobals } from "./sim-cfn-sam-globals.js";
 import { isSamTemplateRecord } from "./sim-cfn-sam-record.js";
@@ -30,10 +32,11 @@ export function samExpandedTemplate(template) {
         return template;
     }
     const globals = samTemplateGlobals(template);
+    const apiAuth = samTemplateApiAuth(template, globals);
     const resources = Object.entries(template.Resources);
     return {
         ...withoutSamSections(template),
-        Resources: samEditedResources(Object.fromEntries(resources.flatMap(([logicalId, resource]) => Object.entries(expandedResource(logicalId, resource, globals)))), resources.flatMap(([logicalId, resource]) => resourceEdits(logicalId, resource, globals))),
+        Resources: samEditedResources(Object.fromEntries(resources.flatMap(([logicalId, resource]) => Object.entries(expandedResource({ logicalId, resource, globals, apiAuth })))), resources.flatMap(([logicalId, resource]) => resourceEdits({ logicalId, resource, globals, apiAuth }))),
     };
 }
 /**
@@ -43,23 +46,25 @@ export function samExpandedTemplate(template) {
  * Resources afterwards, because a Resource being edited may be expanded from a
  * SAM Resource of its own and may not have been read yet.
  */
-function resourceEdits(logicalId, resource, globals) {
+function resourceEdits(properties) {
+    const { logicalId, resource, globals, apiAuth } = properties;
     if (!isSamTemplateRecord(resource) || resource["Type"] !== samFunctionType) {
         return [];
     }
-    return samFunctionResourceEdits({ logicalId, resource, globals });
+    return samFunctionResourceEdits({ logicalId, resource, globals, apiAuth });
 }
 /**
  * The Resources one template Resource is deployed as. Anything the expansion
  * does not cover is deployed as itself.
  */
-function expandedResource(logicalId, resource, globals) {
+function expandedResource(properties) {
+    const { logicalId, resource, globals, apiAuth } = properties;
     if (!isSamTemplateRecord(resource)) {
         return { [logicalId]: resource };
     }
     const type = resource["Type"];
     if (type === samFunctionType) {
-        return samFunctionResources({ logicalId, resource, globals });
+        return samFunctionResources({ logicalId, resource, globals, apiAuth });
     }
     if (type === samHttpApiType) {
         return samHttpApiResources({

package/dist/service/cloudformation/sdk/sim-cloudformation-sdk-command-router.js

@@ -19,6 +19,26 @@ export class SimCloudFormationSdkCommandRouter {
                 "UpdateStackCommand",
                 async (command, context) => await simCloudFormation.updateStack(command, simSdkCallerOptions(context)),
             ],
+            [
+                "CreateChangeSetCommand",
+                async (command, context) => await simCloudFormation.createChangeSet(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DescribeChangeSetCommand",
+                async (command, context) => await simCloudFormation.describeChangeSet(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ExecuteChangeSetCommand",
+                async (command, context) => await simCloudFormation.executeChangeSet(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteChangeSetCommand",
+                async (command, context) => await simCloudFormation.deleteChangeSet(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ListChangeSetsCommand",
+                async (command, context) => await simCloudFormation.listChangeSets(command, simSdkCallerOptions(context)),
+            ],
             [
                 "DescribeStacksCommand",
                 async (command, context) => await simCloudFormation.describeStacks(command, simSdkCallerOptions(context)),

package/dist/service/cloudformation/serve/sim-cloudformation-api.d.ts

@@ -3,8 +3,9 @@ import { SimQueryApiEndpoint } from "../../../serve/http/api/query/sim-query-end
 /**
  * Serve the CloudFormation Query API to a client given an endpoint URL.
  *
- * The operations served are the four simulated CloudFormation implements:
- * `CreateStack`, `UpdateStack`, `DeleteStack` and `DescribeStacks`. Anything
- * else is refused as `NotImplemented`.
+ * The operations served are the Stack operations simulated CloudFormation
+ * implements, `CreateStack`, `UpdateStack`, `DeleteStack` and `DescribeStacks`,
+ * together with the five change set operations. Anything else is refused as
+ * `NotImplemented`.
  */
 export declare function simCloudFormationApiEndpoint(simAws: SimAws): SimQueryApiEndpoint;

package/dist/service/cloudformation/serve/sim-cloudformation-api.js

@@ -1,5 +1,6 @@
 import { SimQueryApiEndpoint } from "../../../serve/http/api/query/sim-query-endpoint.js";
 import { queryList, queryMembers, } from "../../../serve/http/api/query/sim-query-result.js";
+import { simCfnChangeSetQueryOperations } from "./sim-cloudformation-change-set-api.js";
 /**
  * The XML namespace real CloudFormation stamps on every response it sends.
  */
@@ -16,9 +17,10 @@ const stackOutputMembers = [
 /**
  * Serve the CloudFormation Query API to a client given an endpoint URL.
  *
- * The operations served are the four simulated CloudFormation implements:
- * `CreateStack`, `UpdateStack`, `DeleteStack` and `DescribeStacks`. Anything
- * else is refused as `NotImplemented`.
+ * The operations served are the Stack operations simulated CloudFormation
+ * implements, `CreateStack`, `UpdateStack`, `DeleteStack` and `DescribeStacks`,
+ * together with the five change set operations. Anything else is refused as
+ * `NotImplemented`.
  */
 export function simCloudFormationApiEndpoint(simAws) {
     return new SimQueryApiEndpoint({
@@ -30,6 +32,7 @@ export function simCloudFormationApiEndpoint(simAws) {
 }
 function simCloudFormationQueryOperations() {
     return new Map([
+        ...simCfnChangeSetQueryOperations(),
         [
             "CreateStack",
             {

package/dist/service/cloudformation/serve/sim-cloudformation-change-set-api.d.ts

@@ -0,0 +1,10 @@
+import type { SimQueryOperations } from "../../../serve/http/api/query/sim-query-operation.js";
+/**
+ * The change set half of the CloudFormation Query API.
+ *
+ * Held apart from the Stack operations because the two halves share nothing
+ * but the service they belong to. Every operation here reaches the same Command
+ * an SDK caller sends, so a CLI deployment runs the code an in-process caller
+ * runs.
+ */
+export declare function simCfnChangeSetQueryOperations(): SimQueryOperations;

package/dist/service/cloudformation/serve/sim-cloudformation-change-set-api.js

@@ -0,0 +1,94 @@
+import { queryList, queryMembers, queryStructure, } from "../../../serve/http/api/query/sim-query-result.js";
+/**
+ * The members CloudFormation describes one change set with.
+ */
+const changeSetMembers = [
+    "ChangeSetId",
+    "ChangeSetName",
+    "StackId",
+    "StackName",
+    "Description",
+    "Status",
+    "StatusReason",
+    "ExecutionStatus",
+];
+/**
+ * The members CloudFormation summarises one change set with in ListChangeSets.
+ */
+const changeSetSummaryMembers = [
+    "ChangeSetId",
+    "ChangeSetName",
+    "StackId",
+    "StackName",
+    "Description",
+    "Status",
+    "StatusReason",
+    "ExecutionStatus",
+];
+/**
+ * The members CloudFormation describes one Resource change with.
+ */
+const resourceChangeMembers = [
+    "Action",
+    "LogicalResourceId",
+    "ResourceType",
+    "Replacement",
+];
+/**
+ * The change set half of the CloudFormation Query API.
+ *
+ * Held apart from the Stack operations because the two halves share nothing
+ * but the service they belong to. Every operation here reaches the same Command
+ * an SDK caller sends, so a CLI deployment runs the code an in-process caller
+ * runs.
+ */
+export function simCfnChangeSetQueryOperations() {
+    return new Map([
+        [
+            "CreateChangeSet",
+            {
+                input: (fields) => ({
+                    StackName: fields.text("StackName"),
+                    ChangeSetName: fields.text("ChangeSetName"),
+                    ChangeSetType: fields.text("ChangeSetType"),
+                    Description: fields.text("Description"),
+                    TemplateBody: fields.text("TemplateBody"),
+                    Parameters: fields.list("Parameters", (parameter) => ({
+                        ParameterKey: parameter.text("ParameterKey"),
+                        ParameterValue: parameter.text("ParameterValue"),
+                    })),
+                }),
+                result: (output) => queryMembers(output, ["Id", "StackId"]),
+            },
+        ],
+        [
+            "DescribeChangeSet",
+            {
+                input: changeSetInput,
+                result: (output) => queryMembers(output, changeSetMembers) +
+                    queryList(output, "Changes", (change) => queryMembers(change, ["Type"]) +
+                        queryStructure(change, "ResourceChange", (resourceChange) => queryMembers(resourceChange, resourceChangeMembers))),
+            },
+        ],
+        ["ExecuteChangeSet", { input: changeSetInput, result: () => "" }],
+        ["DeleteChangeSet", { input: changeSetInput, result: () => "" }],
+        [
+            "ListChangeSets",
+            {
+                input: (fields) => ({
+                    StackName: fields.text("StackName"),
+                }),
+                result: (output) => queryList(output, "Summaries", (summary) => queryMembers(summary, changeSetSummaryMembers)),
+            },
+        ],
+    ]);
+}
+/**
+ * The input every operation naming one change set sends.
+ */
+function changeSetInput(fields) {
+    return {
+        StackName: fields.text("StackName"),
+        ChangeSetName: fields.text("ChangeSetName"),
+    };
+}