@kensio/yulin 1.21.3 → 1.21.5

package/dist/service/cloudformation/authorize/sim-cloudformation-authorization.d.ts

@@ -33,10 +33,33 @@ export declare class SimCloudFormationAuthorization {
      * Ensure the caller may delete the named Stack.
      */
     deleteStack(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may create a change set against the named Stack.
+     */
+    createChangeSet(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may describe a change set against the named Stack.
+     */
+    describeChangeSet(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may execute a change set against the named Stack.
+     */
+    executeChangeSet(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may delete a change set against the named Stack.
+     */
+    deleteChangeSet(stackName: string | undefined, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may list the change sets against the named Stack.
+     */
+    listChangeSets(stackName: string | undefined, caller?: SimAwsCaller): void;
     private authorize;
     /**
      * The Stack ARN a command operates on. A command naming no Stack, which
      * DescribeStacks allows, is asking about every Stack in the scope.
+     *
+     * A command that named the Stack by its ID named the ARN itself, so that is
+     * what gets authorized rather than an ARN built around it.
      */
     private stackArn;
 }

package/dist/service/cloudformation/authorize/sim-cloudformation-authorization.js

@@ -1,4 +1,5 @@
 import { SimIamActionAuthorizer } from "../../iam/authorize/sim-iam-action-authorizer.js";
+import { isSimCfnStackId } from "../stack/sim-cfn-stack-id.js";
 /**
  * Who may do what to a simulated CloudFormation Stack.
  *
@@ -38,14 +39,50 @@ export class SimCloudFormationAuthorization {
     deleteStack(stackName, caller) {
         this.authorize("cloudformation:DeleteStack", stackName, caller);
     }
+    /**
+     * Ensure the caller may create a change set against the named Stack.
+     */
+    createChangeSet(stackName, caller) {
+        this.authorize("cloudformation:CreateChangeSet", stackName, caller);
+    }
+    /**
+     * Ensure the caller may describe a change set against the named Stack.
+     */
+    describeChangeSet(stackName, caller) {
+        this.authorize("cloudformation:DescribeChangeSet", stackName, caller);
+    }
+    /**
+     * Ensure the caller may execute a change set against the named Stack.
+     */
+    executeChangeSet(stackName, caller) {
+        this.authorize("cloudformation:ExecuteChangeSet", stackName, caller);
+    }
+    /**
+     * Ensure the caller may delete a change set against the named Stack.
+     */
+    deleteChangeSet(stackName, caller) {
+        this.authorize("cloudformation:DeleteChangeSet", stackName, caller);
+    }
+    /**
+     * Ensure the caller may list the change sets against the named Stack.
+     */
+    listChangeSets(stackName, caller) {
+        this.authorize("cloudformation:ListChangeSets", stackName, caller);
+    }
     authorize(action, stackName, caller) {
         this.authorizer.authorize(action, this.stackArn(stackName), caller);
     }
     /**
      * The Stack ARN a command operates on. A command naming no Stack, which
      * DescribeStacks allows, is asking about every Stack in the scope.
+     *
+     * A command that named the Stack by its ID named the ARN itself, so that is
+     * what gets authorized rather than an ARN built around it.
      */
     stackArn(stackName) {
+        if (stackName !== undefined && isSimCfnStackId(stackName)) {
+            return stackName;
+        }
         const { accountId, regionName } = this.accountRegionScope;
         return `arn:aws:cloudformation:${regionName}:${accountId}:stack/${stackName ?? "*"}/*`;
     }

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.d.ts

@@ -8,12 +8,16 @@ interface SimCdkAssetsPublisherProperties {
     readonly stackName?: string | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     /**
-     * The principal the deployment runs as, which the staging Bucket is created
-     * and written to as. A real `cdk deploy` publishes assets before
-     * CloudFormation sees the template, and it publishes them as somebody; a
-     * deployment that names a caller is what says who.
+     * The principal the assets are published as.
+     *
+     * A real `cdk deploy` publishes assets before CloudFormation sees the
+     * template, as the file publishing Role the assets manifest names in each
+     * destination's `assumeRoleArn`. CloudFormation then processes the template
+     * as the execution Role. A deployment that names an assets caller is what
+     * tells the two apart here, and one that names none publishes as whoever
+     * deploys.
      */
-    readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
 }
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.
@@ -25,7 +29,7 @@ interface SimCdkAssetsPublisherProperties {
  * Lambda function resolves its code through the ordinary sim S3 fetch with no
  * Lambda-specific asset handling.
  *
- * Publishing is byte movement only; nothing here runs asset code. Functions
+ * Publishing is byte movement only. Nothing here runs asset code. Functions
  * sim Lambda cannot run, such as a CDK BucketDeployment provider written in
  * Python, are declined later by the Lambda resource creator on their Runtime.
  */
@@ -42,15 +46,16 @@ export declare class SimCdkAssetsPublisher {
     publish(): Promise<void>;
     private publishAsset;
     /**
-     * Create the staging Bucket if this is the first asset published into it,
+     * Make the staging Bucket if this is the first asset published into it,
      * standing in for the CDK bootstrap stack that provisions it for real.
      *
-     * Stacks deployed concurrently share one staging Bucket, and creating it is
-     * not atomic: sim S3 reaches a sequencing point before registering the
-     * Bucket, so both can pass the check above and the loser is refused. A
-     * Bucket that exists by the time the failure lands is the outcome this
-     * wanted, whoever created it. Anything else, such as the name already being
-     * taken in another scope, is a real failure and is reported.
+     * The bootstrap stack runs long before the deployment, and neither the file
+     * publishing Role nor the execution Role creates this Bucket. It comes
+     * through `makeSimBucket` for that reason, which asks IAM nothing. A
+     * deployment scoped to the permissions its real execution Role holds would
+     * otherwise be refused `s3:CreateBucket` before creating a Resource.
+     *
+     * A name already taken in another scope is a real failure, and is reported.
      */
     private ensureBucket;
     private stagingS3;

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.js

@@ -1,7 +1,7 @@
 import { SimCfnPseudoParameters } from "../../parameters/pseudo/sim-cfn-pseudo-parameters.js";
 import { SimCdkAssetPublications, } from "./sim-cdk-asset-publications.js";
 import { readSimCdkAssetBytes } from "./sim-cdk-asset-bytes.js";
-import { simCfnResourceCallerOptions, } from "../../resource/caller/sim-cfn-resource-caller-options.js";
+import { simCfnResourceCallerOptions } from "../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.
  *
@@ -12,7 +12,7 @@ import { simCfnResourceCallerOptions, } from "../../resource/caller/sim-cfn-reso
  * Lambda function resolves its code through the ordinary sim S3 fetch with no
  * Lambda-specific asset handling.
  *
- * Publishing is byte movement only; nothing here runs asset code. Functions
+ * Publishing is byte movement only. Nothing here runs asset code. Functions
  * sim Lambda cannot run, such as a CDK BucketDeployment provider written in
  * Python, are declined later by the Lambda resource creator on their Runtime.
  */
@@ -42,7 +42,7 @@ export class SimCdkAssetsPublisher {
             }),
         }).resolve(cdkOutContext.assetsManifest);
         for (const publication of publications) {
-            // oxlint-disable-next-line no-await-in-loop -- assets sharing a staging Bucket must not race to create it
+            // oxlint-disable-next-line no-await-in-loop -- published in manifest order, as cdk-assets publishes them
             await this.publishAsset(publication);
         }
     }
@@ -52,38 +52,30 @@ export class SimCdkAssetsPublisher {
             return;
         }
         const s3 = this.stagingS3();
-        const options = simCfnResourceCallerOptions(this.properties.caller);
-        await this.ensureBucket(s3, publication.bucketName, options);
+        this.ensureBucket(s3, publication.bucketName);
         await s3.putObject({
             input: {
                 Bucket: publication.bucketName,
                 Key: publication.objectKey,
                 Body: assetBytes,
             },
-        }, options);
+        }, simCfnResourceCallerOptions(this.properties.assetsCaller));
     }
     /**
-     * Create the staging Bucket if this is the first asset published into it,
+     * Make the staging Bucket if this is the first asset published into it,
      * standing in for the CDK bootstrap stack that provisions it for real.
      *
-     * Stacks deployed concurrently share one staging Bucket, and creating it is
-     * not atomic: sim S3 reaches a sequencing point before registering the
-     * Bucket, so both can pass the check above and the loser is refused. A
-     * Bucket that exists by the time the failure lands is the outcome this
-     * wanted, whoever created it. Anything else, such as the name already being
-     * taken in another scope, is a real failure and is reported.
+     * The bootstrap stack runs long before the deployment, and neither the file
+     * publishing Role nor the execution Role creates this Bucket. It comes
+     * through `makeSimBucket` for that reason, which asks IAM nothing. A
+     * deployment scoped to the permissions its real execution Role holds would
+     * otherwise be refused `s3:CreateBucket` before creating a Resource.
+     *
+     * A name already taken in another scope is a real failure, and is reported.
      */
-    async ensureBucket(s3, bucketName, options) {
-        if (s3.getSimBucketByName(bucketName) !== undefined) {
-            return;
-        }
-        try {
-            await s3.createBucket({ input: { Bucket: bucketName } }, options);
-        }
-        catch (error) {
-            if (s3.getSimBucketByName(bucketName) === undefined) {
-                throw error;
-            }
+    ensureBucket(s3, bucketName) {
+        if (s3.getSimBucketByName(bucketName) === undefined) {
+            s3.makeSimBucket(bucketName);
         }
     }
     stagingS3() {

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-copier.d.ts

@@ -1,8 +1,10 @@
 import type { SimS3Bucket } from "../../../../../s3/bucket/sim-s3-bucket.js";
+import type { SimCdkBucketDeployNotifier } from "../notify/sim-cdk-bucket-deploy-notifier.js";
 import type { SimCdkBucketDeployProperties } from "../property/sim-cdk-bucket-deploy-properties.js";
 interface SimCdkBucketDeployCopierProperties {
     readonly bucket: SimS3Bucket;
     readonly properties: SimCdkBucketDeployProperties;
+    readonly notifier: SimCdkBucketDeployNotifier;
 }
 /**
  * Copies a staged CDK asset into a simulated destination Bucket.

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-copier.js

@@ -31,6 +31,7 @@ export class SimCdkBucketDeployCopier {
             bucket: properties.bucket,
             filter: this.filter,
             keyPrefix: this.properties.destinationKeyPrefix,
+            notifier: properties.notifier,
         });
     }
     /**

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-file.d.ts

@@ -1,8 +1,10 @@
 import type { SimS3Bucket } from "../../../../../s3/bucket/sim-s3-bucket.js";
+import type { SimCdkBucketDeployNotifier } from "../notify/sim-cdk-bucket-deploy-notifier.js";
 import type { SimCdkBucketDeployProperties } from "../property/sim-cdk-bucket-deploy-properties.js";
 interface SimCdkBucketDeployFileProperties {
     readonly bucket: SimS3Bucket;
     readonly properties: SimCdkBucketDeployProperties;
+    readonly notifier: SimCdkBucketDeployNotifier;
 }
 /**
  * Copies one file from a staged CDK asset into a simulated Bucket.
@@ -13,9 +15,14 @@ interface SimCdkBucketDeployFileProperties {
 export declare class SimCdkBucketDeployFile {
     private readonly bucket;
     private readonly properties;
+    private readonly notifier;
     constructor(properties: SimCdkBucketDeployFileProperties);
     /**
      * Store one file as an Object, and answer with the key it went under.
+     *
+     * The Object goes into the Bucket rather than through PutObject, so the
+     * event a Put would have raised is raised here, once the write has happened
+     * and carrying the version it was given.
      */
     copy(sourceDirectoryPath: string, relativePath: string): Promise<string>;
     /**

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-file.js

@@ -11,18 +11,30 @@ import { metadataForFilesystemS3ObjectKey } from "../../../../../s3/storage/file
 export class SimCdkBucketDeployFile {
     bucket;
     properties;
+    notifier;
     constructor(properties) {
         this.bucket = properties.bucket;
         this.properties = properties.properties;
+        this.notifier = properties.notifier;
     }
     /**
      * Store one file as an Object, and answer with the key it went under.
+     *
+     * The Object goes into the Bucket rather than through PutObject, so the
+     * event a Put would have raised is raised here, once the write has happened
+     * and carrying the version it was given.
      */
     async copy(sourceDirectoryPath, relativePath) {
         const key = this.properties.objectKey(relativePath);
         // oxlint-disable-next-line security/detect-non-literal-fs-filename
         const body = await readFile(path.join(sourceDirectoryPath, relativePath));
-        await this.bucket.putObject(new SimS3Object({ key, body, metadata: this.metadata(relativePath) }));
+        const object = new SimS3Object({
+            key,
+            body,
+            metadata: this.metadata(relativePath),
+        });
+        const version = await this.bucket.putObject(object);
+        this.notifier.deployed(object, version?.versionId);
         return key;
     }
     /**

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-pruner.d.ts

@@ -1,9 +1,11 @@
 import type { SimS3Bucket } from "../../../../../s3/bucket/sim-s3-bucket.js";
 import type { SimCdkBucketDeployFilter } from "../filter/sim-cdk-bucket-deploy-filter.js";
+import type { SimCdkBucketDeployNotifier } from "../notify/sim-cdk-bucket-deploy-notifier.js";
 interface SimCdkBucketDeployPrunerProperties {
     readonly bucket: SimS3Bucket;
     readonly filter: SimCdkBucketDeployFilter;
     readonly keyPrefix: string;
+    readonly notifier: SimCdkBucketDeployNotifier;
 }
 /**
  * Removes the Objects a deployment covers but no longer holds.
@@ -19,9 +21,13 @@ export declare class SimCdkBucketDeployPruner {
     private readonly bucket;
     private readonly filter;
     private readonly keyPrefix;
+    private readonly notifier;
     constructor(properties: SimCdkBucketDeployPrunerProperties);
     /**
      * Remove everything this deployment would have copied and did not.
+     *
+     * Each removal raises what a DeleteObject would have raised, since the sync
+     * this stands in for deletes through the API like any other caller.
      */
     prune(deployedKeys: ReadonlySet<string>): Promise<void>;
     private isStale;

package/dist/service/cloudformation/cdk/s3/bucket-deployment/copy/sim-cdk-bucket-deploy-pruner.js

@@ -12,19 +12,25 @@ export class SimCdkBucketDeployPruner {
     bucket;
     filter;
     keyPrefix;
+    notifier;
     constructor(properties) {
         this.bucket = properties.bucket;
         this.filter = properties.filter;
         this.keyPrefix = properties.keyPrefix;
+        this.notifier = properties.notifier;
     }
     /**
      * Remove everything this deployment would have copied and did not.
+     *
+     * Each removal raises what a DeleteObject would have raised, since the sync
+     * this stands in for deletes through the API like any other caller.
      */
     async prune(deployedKeys) {
         const existing = await this.bucket.listObjects(this.keyPrefix);
         const stale = existing.filter((object) => this.isStale(object.key, deployedKeys));
         await Promise.all(stale.map(async (object) => {
-            await this.bucket.deleteObject(object.key);
+            const deletion = await this.bucket.deleteObject(object.key);
+            this.notifier.pruned(object.key, deletion);
         }));
     }
     isStale(key, deployedKeys) {

package/dist/service/cloudformation/cdk/s3/bucket-deployment/notify/sim-cdk-bucket-deploy-notifier.d.ts

@@ -0,0 +1,50 @@
+import type { SimAwsResolvedCaller } from "../../../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimS3Bucket } from "../../../../../s3/bucket/sim-s3-bucket.js";
+import type { SimS3ObjectDeletion } from "../../../../../s3/bucket/sim-s3-object-deletion.js";
+import type { SimS3ObjectNotifier } from "../../../../../s3/notification/sim-s3-object-notifier.js";
+import type { SimS3Object } from "../../../../../s3/object/s3-object.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../../../resource/sim-cfn-resource.js";
+interface SimCdkBucketDeployNotifierProperties {
+    readonly bucket: SimS3Bucket;
+    readonly notifications: SimS3ObjectNotifier;
+    readonly caller: SimAwsResolvedCaller;
+}
+/**
+ * Raises the S3 Object events a deployment into a Bucket earns.
+ *
+ * A deployment writes Objects rather than sending S3 commands, so it says here
+ * what a command would have said for it. Real CDK runs a provider function
+ * that syncs the staged asset into the Bucket, one PutObject per file and one
+ * DeleteObject per Object the sync deletes, and a Bucket with a notification
+ * configuration hears all of them.
+ */
+export declare class SimCdkBucketDeployNotifier {
+    private readonly bucket;
+    private readonly notifications;
+    private readonly caller;
+    constructor(properties: SimCdkBucketDeployNotifierProperties);
+    /**
+     * Say that the deployment wrote an Object.
+     */
+    deployed(object: SimS3Object, versionId: string | undefined): void;
+    /**
+     * Say that the deployment pruned a key, as far as the delete got.
+     *
+     * A pruning deployment deletes rather than removes. A versioned Bucket keeps
+     * what it held behind a marker, and the event says so. That is the same
+     * three-way answer a DeleteObject command gets, so the same reading of it
+     * serves here.
+     */
+    pruned(key: string, deletion: SimS3ObjectDeletion): void;
+}
+/**
+ * The notifier for one deployment, reaching the Bucket's own simulated S3.
+ *
+ * The events are attributed to the Account root rather than to the deployment's
+ * caller. Real S3 names the identity that wrote the Object, which for a CDK
+ * BucketDeployment is the provider function's execution role, and neither that
+ * function nor its role is simulated. Root is what simulated AWS attributes an
+ * unstated caller to everywhere else.
+ */
+export declare function simCdkBucketDeployNotifier(resource: SimCfnResource, bucket: SimS3Bucket, context: SimCloudFormationResourceCreateContext): SimCdkBucketDeployNotifier;
+export {};

package/dist/service/cloudformation/cdk/s3/bucket-deployment/notify/sim-cdk-bucket-deploy-notifier.js

@@ -0,0 +1,71 @@
+import { makeSimAwsAccountRootPrincipal } from "../../../../../aws/caller/sim-aws-account-root-principal.js";
+import { simAwsResolvedCallerOf } from "../../../../../aws/caller/sim-aws-resolved-caller.js";
+import { simS3NotifyDeleted } from "../../../../../s3/command/delete-object/sim-s3-notify-deleted.js";
+/**
+ * Raises the S3 Object events a deployment into a Bucket earns.
+ *
+ * A deployment writes Objects rather than sending S3 commands, so it says here
+ * what a command would have said for it. Real CDK runs a provider function
+ * that syncs the staged asset into the Bucket, one PutObject per file and one
+ * DeleteObject per Object the sync deletes, and a Bucket with a notification
+ * configuration hears all of them.
+ */
+export class SimCdkBucketDeployNotifier {
+    bucket;
+    notifications;
+    caller;
+    constructor(properties) {
+        this.bucket = properties.bucket;
+        this.notifications = properties.notifications;
+        this.caller = properties.caller;
+    }
+    /**
+     * Say that the deployment wrote an Object.
+     */
+    deployed(object, versionId) {
+        this.notifications.objectCreated({
+            bucket: this.bucket,
+            object,
+            caller: this.caller,
+            eventName: "s3:ObjectCreated:Put",
+            versionId,
+        });
+    }
+    /**
+     * Say that the deployment pruned a key, as far as the delete got.
+     *
+     * A pruning deployment deletes rather than removes. A versioned Bucket keeps
+     * what it held behind a marker, and the event says so. That is the same
+     * three-way answer a DeleteObject command gets, so the same reading of it
+     * serves here.
+     */
+    pruned(key, deletion) {
+        simS3NotifyDeleted({
+            notifications: this.notifications,
+            bucket: this.bucket,
+            key,
+            caller: this.caller,
+            deletion,
+        });
+    }
+}
+/**
+ * The notifier for one deployment, reaching the Bucket's own simulated S3.
+ *
+ * The events are attributed to the Account root rather than to the deployment's
+ * caller. Real S3 names the identity that wrote the Object, which for a CDK
+ * BucketDeployment is the provider function's execution role, and neither that
+ * function nor its role is simulated. Root is what simulated AWS attributes an
+ * unstated caller to everywhere else.
+ */
+export function simCdkBucketDeployNotifier(resource, bucket, context) {
+    const { accountId, regionName } = resource.accountRegionScope;
+    return new SimCdkBucketDeployNotifier({
+        bucket,
+        notifications: context.simAws
+            .accountRegionScope(accountId, regionName)
+            .s3()
+            .objectNotifier(),
+        caller: simAwsResolvedCallerOf(makeSimAwsAccountRootPrincipal(accountId)),
+    });
+}

package/dist/service/cloudformation/cdk/s3/bucket-deployment/sim-cdk-bucket-deployment.js

@@ -2,6 +2,7 @@ import { SimCdkBucketDeploySource } from "./source/sim-cdk-bucket-deploy-source.
 import { SimCdkBucketDeployCopier } from "./copy/sim-cdk-bucket-deploy-copier.js";
 import { SimCdkBucketDeployProperties } from "./property/sim-cdk-bucket-deploy-properties.js";
 import { declareSimCdkBucketDeployMetadata } from "./metadata/sim-cdk-bucket-deploy-metadata.js";
+import { simCdkBucketDeployNotifier } from "./notify/sim-cdk-bucket-deploy-notifier.js";
 import { simCdkBucketDeployDestination } from "./destination/sim-cdk-bucket-deploy-destination.js";
 /**
  * CloudFormation Resource factory for CDK BucketDeployment compatibility.
@@ -36,10 +37,14 @@ export class SimCdkBucketDeploymentResourceFactory {
     async createCdkBucketDeployment(resource, context) {
         const properties = new SimCdkBucketDeployProperties(resource, context.resolvedProperties ?? resource.properties);
         const bucket = simCdkBucketDeployDestination(resource, properties, context);
-        const sourceDirectoryPaths = properties.sourceObjectKeys.map((sourceObjectKey) => this.sourceResolver.sourceDirectoryPathForObjectKey(resource, sourceObjectKey, context.cdkOutContext));
+        const sourceDirectoryPaths = this.sourceResolver.sourceDirectoryPaths(resource, properties.sourceObjectKeys, context.cdkOutContext);
+        // The copier writes Objects into the Bucket instead of sending PutObject,
+        // and a Bucket configured to notify still hears about every file it writes
+        // and every Object it prunes.
         const publishedKeys = await new SimCdkBucketDeployCopier({
             bucket,
             properties,
+            notifier: simCdkBucketDeployNotifier(resource, bucket, context),
         }).copy(sourceDirectoryPaths);
         // Said as well as set. The Objects above carry these headers themselves,
         // and a directory mounted over them later cannot, so the Bucket keeps what

package/dist/service/cloudformation/cdk/s3/bucket-deployment/source/sim-cdk-bucket-deploy-source.d.ts

@@ -4,6 +4,11 @@ import type { SimCdkOutContext } from "../../../sim-cdk-out-context.js";
  * Resolves the filesystem source directory for a CDK BucketDeployment asset.
  */
 export declare class SimCdkBucketDeploySource {
+    /**
+     * Find the local source directory for every source object key a deployment
+     * names, in the order it names them.
+     */
+    sourceDirectoryPaths(resource: SimCfnResource, sourceObjectKeys: readonly string[], cdkOutContext: SimCdkOutContext | undefined): string[];
     /**
      * Find the local source directory for a CDK BucketDeployment source object key.
      */

package/dist/service/cloudformation/cdk/s3/bucket-deployment/source/sim-cdk-bucket-deploy-source.js

@@ -4,6 +4,13 @@ import { SimCdkBucketDeployErrorMessage } from "../error-message/sim-cdk-bucket-
  * Resolves the filesystem source directory for a CDK BucketDeployment asset.
  */
 export class SimCdkBucketDeploySource {
+    /**
+     * Find the local source directory for every source object key a deployment
+     * names, in the order it names them.
+     */
+    sourceDirectoryPaths(resource, sourceObjectKeys, cdkOutContext) {
+        return sourceObjectKeys.map((objectKey) => this.sourceDirectoryPathForObjectKey(resource, objectKey, cdkOutContext));
+    }
     /**
      * Find the local source directory for a CDK BucketDeployment source object key.
      */

package/dist/service/cloudformation/cdk/sim-cdk-cloud-assembly.factory.d.ts

@@ -1,6 +1,7 @@
 import { AsyncMappedFactory } from "@kensio/part-factory";
 import { TemporaryDirectory } from "../../../util/filesystem/temporary-directory.js";
 import type { SimCfnTemplateValueRecord } from "../template/value/sim-cfn-template-value.js";
+import type { SimCdkAssetsManifest } from "./sim-cdk-out-context.js";
 /**
  * One synthesized Stack in a cloud assembly a test writes.
  */
@@ -25,9 +26,20 @@ export interface SimCdkCloudAssemblyStackInput {
     readonly resources?: SimCfnTemplateValueRecord | undefined;
     /** The template's Outputs, which a Stack sharing a value needs. */
     readonly outputs?: SimCfnTemplateValueRecord | undefined;
+    /**
+     * The assets manifest `cdk synth` writes beside the template, for a Stack
+     * that stages file assets. A Stack given none has no manifest file at all,
+     * which is what a Stack with nothing to stage synthesizes.
+     */
+    readonly assets?: SimCdkAssetsManifest | undefined;
 }
 export interface SimCdkCloudAssemblyInput {
     readonly stacks: readonly SimCdkCloudAssemblyStackInput[];
+    /**
+     * Staged asset files to write into the assembly, keyed by the path an assets
+     * manifest source names.
+     */
+    readonly assetFiles?: Record<string, string> | undefined;
 }
 /** The Bucket a Stack in a written assembly creates, unless it is given others. */
 export declare function assemblyStackBucketName(artifactId: string): string;

package/dist/service/cloudformation/cdk/sim-cdk-cloud-assembly.factory.js

@@ -23,13 +23,19 @@ export function assemblyStackBucketName(artifactId) {
 export const simCdkCloudAssemblyFactory = new AsyncMappedFactory(() => ({ stacks: [{ artifactId: "SiteStack", regionName: "eu-west-2" }] }), async (input) => {
     const directory = new TemporaryDirectory();
     await directory.writeFile(["cdk.out", "manifest.json"], jsonStringify(assemblyManifest(input.stacks)));
-    await Promise.all(input.stacks.map(async (stack) => directory.writeFile(["cdk.out", templateFileName(stack)], 
-    // JSON.stringify drops an undefined value, so a Stack given no
-    // Outputs writes a template with none rather than a null one.
-    jsonStringify({
-        Resources: stackResources(stack),
-        Outputs: stack.outputs,
-    }))));
+    await Promise.all([
+        ...input.stacks.map(async (stack) => directory.writeFile(["cdk.out", templateFileName(stack)], 
+        // JSON.stringify drops an undefined value, so a Stack given no
+        // Outputs writes a template with none rather than a null one.
+        jsonStringify({
+            Resources: stackResources(stack),
+            Outputs: stack.outputs,
+        }))),
+        ...input.stacks
+            .filter((stack) => stack.assets !== undefined)
+            .map(async (stack) => directory.writeFile(["cdk.out", assetsFileName(stack)], jsonStringify(stack.assets))),
+        ...Object.entries(input.assetFiles ?? {}).map(async ([assetPath, content]) => directory.writeFile(["cdk.out", assetPath], content)),
+    ]);
     return directory;
 });
 function assemblyManifest(stacks) {
@@ -56,6 +62,9 @@ function assemblyManifest(stacks) {
 function templateFileName(stack) {
     return `${stack.artifactId}.template.json`;
 }
+function assetsFileName(stack) {
+    return `${stack.artifactId}.assets.json`;
+}
 function stackResources(stack) {
     return (stack.resources ?? {
         [`${stack.artifactId}Bucket`]: {

package/dist/service/cloudformation/changeset/sim-cfn-change-set-arn.d.ts

@@ -0,0 +1,9 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+/**
+ * The ARN CloudFormation gives one change set.
+ *
+ * The unique part is a UUID, as it is for a Stack ID, so two change sets
+ * created under the same name against different Stacks are still told apart by
+ * their ARN alone.
+ */
+export declare function simCfnChangeSetArn(scope: SimAwsAccountRegionScope, changeSetName: string): string;

package/dist/service/cloudformation/changeset/sim-cfn-change-set-arn.js

@@ -0,0 +1,12 @@
+import { randomUUID } from "node:crypto";
+/**
+ * The ARN CloudFormation gives one change set.
+ *
+ * The unique part is a UUID, as it is for a Stack ID, so two change sets
+ * created under the same name against different Stacks are still told apart by
+ * their ARN alone.
+ */
+export function simCfnChangeSetArn(scope, changeSetName) {
+    const { regionName, accountId } = scope;
+    return `arn:aws:cloudformation:${regionName}:${accountId}:changeSet/${changeSetName}/${randomUUID()}`;
+}