@kensio/yulin 1.21.32 → 1.21.34

package/dist/sdk/wire/sim-sdk-wire-response.d.ts

@@ -12,6 +12,11 @@ export declare function simSdkWireOutputResponse(output: unknown, contentType?:
  * AWS exception name and the status real AWS answers with, so a handler
  * catching `ResourceNotFoundException` catches the same thing here as in
  * production.
+ *
+ * The body also carries the exception's modelled members, such as the
+ * `CancellationReasons` of a DynamoDB `TransactionCanceledException`. The SDK
+ * maps those from the body onto the exception it throws, so a member left out
+ * here is undefined on the caller's side.
  */
 export declare function simSdkWireErrorResponse(error: unknown, contentType?: string): SimSdkWireResponse;
 /**

package/dist/sdk/wire/sim-sdk-wire-response.js

@@ -24,6 +24,11 @@ export function simSdkWireOutputResponse(output, contentType = defaultContentTyp
  * AWS exception name and the status real AWS answers with, so a handler
  * catching `ResourceNotFoundException` catches the same thing here as in
  * production.
+ *
+ * The body also carries the exception's modelled members, such as the
+ * `CancellationReasons` of a DynamoDB `TransactionCanceledException`. The SDK
+ * maps those from the body onto the exception it throws, so a member left out
+ * here is undefined on the caller's side.
  */
 export function simSdkWireErrorResponse(error, contentType = defaultContentType) {
     const errorType = error instanceof Error ? error.name : "InternalFailure";
@@ -35,11 +40,26 @@ export function simSdkWireErrorResponse(error, contentType = defaultContentType)
             ...Object.fromEntries([["x-amzn-errortype", errorType]]),
         },
         body: simSdkWireJsonBody(Object.fromEntries([
+            ...errorMembers(error),
             ["__type", errorType],
             ["message", message],
         ])),
     };
 }
+/**
+ * The modelled members a simulated service error carries.
+ *
+ * AWS names the members of its exception shapes in PascalCase, as it names
+ * the members of every other shape. The lower-case properties of an Error are
+ * either JavaScript's own or the simulator's diagnostics, such as the
+ * principal an IAM denial names, and none of them is part of the response.
+ */
+function errorMembers(error) {
+    if (!(error instanceof Error)) {
+        return [];
+    }
+    return Object.entries(error).filter(([name]) => /^[A-Z]/u.test(name));
+}
 /**
  * The status a simulated service error is answered with.
  *

package/dist/service/glue/expression/sim-glue-partition-comparisons.js

@@ -3,7 +3,7 @@ import { simGlueAtLeast, simGlueAtMost, simGlueColumnValue, simGlueEqual, simGlu
 export function simGlueComparisonFilter(column, holds, literal) {
     return (values) => {
         const placed = simGluePartitionOrder(column, simGlueColumnValue(column, values), literal);
-        return placed === undefined ? false : holds(placed);
+        return placed !== undefined && holds(placed);
     };
 }
 /** A filter holding for a key between two literals, both ends included. */

package/dist/service/iam/authorize/match/condition/null/sim-iam-null.js

@@ -13,7 +13,10 @@ function expectsAbsentKey(expected) {
     if (expected === "true") {
         return true;
     }
-    return expected === "false" ? false : undefined;
+    if (expected === "false") {
+        return false;
+    }
+    return undefined;
 }
 /**
  * Whether a request value counts as present for a `Null` check.

package/dist/service/lambda/command/create-function/create-function.handler.js

@@ -70,6 +70,7 @@ export class CreateFunctionCommandHandler {
             ...input,
             code,
             environment,
+            environmentConflicts: this.environmentConflicts,
             accountRegionScope: this.accountRegionScope,
             runAsOwner: this.runAsOwner,
             clock: this.background,

package/dist/service/lambda/function/environment/sim-lambda-environment-conflict.d.ts

@@ -0,0 +1,22 @@
+import type { SimLambdaEnvironment } from "./sim-lambda-environment.js";
+/**
+ * A difference between declared values that matters once the name is read
+ * outside an invocation.
+ *
+ * The key says which kind of difference it is and for which name, and is
+ * what a warning is printed once for.
+ */
+export interface SimLambdaEnvironmentConflict {
+    readonly key: string;
+    readonly name: string;
+    readonly message: string;
+}
+/**
+ * The conflict of a function declaring a name the host process also sets,
+ * with a different value.
+ */
+export declare function simLambdaHostConflict(environment: SimLambdaEnvironment, name: string): SimLambdaEnvironmentConflict;
+/**
+ * The conflict of two functions declaring different values for one name.
+ */
+export declare function simLambdaFunctionConflict(existing: SimLambdaEnvironment, environment: SimLambdaEnvironment, name: string): SimLambdaEnvironmentConflict;

package/dist/service/lambda/function/environment/sim-lambda-environment-conflict.js

@@ -0,0 +1,33 @@
+/**
+ * The advice that follows each warning, given the name that was read early.
+ */
+function moveTheReadAdvice(name) {
+    return (`Code read process.env.${name} outside any invocation, as a read at ` +
+        "module scope does when the module is imported, and saw the host value " +
+        "instead. Move the read inside the handler function.");
+}
+/**
+ * The conflict of a function declaring a name the host process also sets,
+ * with a different value.
+ */
+export function simLambdaHostConflict(environment, name) {
+    return {
+        key: `host:${name}`,
+        name,
+        message: `Sim Lambda function "${environment.functionName}" declares ` +
+            `environment variable ${name}, which the host process also sets ` +
+            `with a different value. ${moveTheReadAdvice(name)}`,
+    };
+}
+/**
+ * The conflict of two functions declaring different values for one name.
+ */
+export function simLambdaFunctionConflict(existing, environment, name) {
+    return {
+        key: `function:${name}`,
+        name,
+        message: `Sim Lambda functions "${existing.functionName}" and ` +
+            `"${environment.functionName}" declare different values for ` +
+            `environment variable ${name}. ${moveTheReadAdvice(name)}`,
+    };
+}

package/dist/service/lambda/function/environment/sim-lambda-environment-conflicts.d.ts

@@ -1,15 +1,32 @@
 import type { SimLambdaEnvironment } from "./sim-lambda-environment.js";
+interface SimLambdaEnvironmentConflictsProperties {
+    /**
+     * The environments of the functions the simulated Lambda holds when it is
+     * asked, which a held name is checked against again once it is read. A
+     * check built standalone has none.
+     */
+    readonly currentEnvironments?: () => Iterable<SimLambdaEnvironment>;
+}
 /**
  * Warns about declared environment variables whose value a handler module
- * might not actually see.
+ * did not actually see.
  *
  * A sim Lambda function backed by a real in-process handler only gets its own
  * process.env while the handler runs, so a variable read at module scope is
  * read too early (see SimLambdaProcessEnv). That only changes what the code
- * sees when the value read at module scope differs from the declared one, so
- * these are the two conditions worth reporting: the host process sets the
- * same name with a different value, or another simulated function declares
- * the same name with a different value.
+ * sees when the value read at module scope differs from the declared one.
+ * There are two ways for it to differ. The host process sets the same name
+ * with a different value, or another simulated function declares the same
+ * name with a different value.
+ *
+ * A difference is reported only once code has read the name from process.env
+ * outside any invocation, which SimProcessEnvironment records. The name of a
+ * difference with no such read yet is held. If the read turns up before a
+ * later invocation (a handler module imported after the function was
+ * created), the name is checked again against the functions that exist then,
+ * so a function deleted or reconfigured in between leaves nothing stale to
+ * report. A read made before Yulin was imported is not on record, and leaves
+ * the difference unreported.
  *
  * Staying quiet when the values agree matters as much as warning when they do
  * not. Test suites commonly export the same variables they configure their
@@ -18,30 +35,55 @@ import type { SimLambdaEnvironment } from "./sim-lambda-environment.js";
  */
 export declare class SimLambdaEnvironmentConflicts {
     /**
-     * Variable names already reported, so repeated function creation does not
+     * The environments of the functions that exist now.
+     */
+    private readonly currentEnvironments;
+    /**
+     * Conflict keys already reported, so repeated function creation does not
      * repeat the same warning.
      */
     private readonly warned;
+    /**
+     * Names in conflict that had not been read outside an invocation when the
+     * conflict was found.
+     */
+    private readonly held;
+    constructor(properties?: SimLambdaEnvironmentConflictsProperties);
     /**
      * Check a new function's environment against the host process and against
      * the functions that already exist.
      */
     check(environment: SimLambdaEnvironment, existingEnvironments: Iterable<SimLambdaEnvironment>): void;
     /**
-     * Warn when the host process sets the same name with a different value.
+     * Check the held names that have since been read outside an invocation
+     * again, against the functions that exist now, and report what conflicts.
+     *
+     * Called as a function is invoked, before the handler runs.
      */
-    private checkHostProcess;
+    reportReads(): void;
+    /**
+     * Check one name across the given environments, each against the host
+     * process and against the environments before it.
+     */
+    private checkName;
     /**
-     * Warn when another simulated function declares the same name with a
+     * Find a conflict when the host process sets the same name with a
      * different value.
      */
+    private checkHostProcess;
+    /**
+     * Find a conflict when another simulated function declares the same name
+     * with a different value.
+     */
     private checkOtherFunctions;
     /**
-     * Report a conflict once per variable name.
+     * Warn about a conflict once per key if its name has been read outside an
+     * invocation, and hold the name otherwise.
      *
      * Warnings go to the console because that is where a test runner surfaces
      * them next to the failing expectation they explain; the simulator has no
      * logger of its own to route them through.
      */
-    private warn;
+    private report;
 }
+export {};

package/dist/service/lambda/function/environment/sim-lambda-environment-conflicts.js

@@ -1,18 +1,25 @@
+import { simLambdaFunctionConflict, simLambdaHostConflict, } from "./sim-lambda-environment-conflict.js";
 import { simProcessEnvironment } from "../../../../util/process/sim-process-environment.js";
-const moveTheReadAdvice = "A read of process.env at module scope happens when the module is " +
-    "imported, before any invocation, so it sees the host value instead. " +
-    "Move the read inside the handler function.";
 /**
  * Warns about declared environment variables whose value a handler module
- * might not actually see.
+ * did not actually see.
  *
  * A sim Lambda function backed by a real in-process handler only gets its own
  * process.env while the handler runs, so a variable read at module scope is
  * read too early (see SimLambdaProcessEnv). That only changes what the code
- * sees when the value read at module scope differs from the declared one, so
- * these are the two conditions worth reporting: the host process sets the
- * same name with a different value, or another simulated function declares
- * the same name with a different value.
+ * sees when the value read at module scope differs from the declared one.
+ * There are two ways for it to differ. The host process sets the same name
+ * with a different value, or another simulated function declares the same
+ * name with a different value.
+ *
+ * A difference is reported only once code has read the name from process.env
+ * outside any invocation, which SimProcessEnvironment records. The name of a
+ * difference with no such read yet is held. If the read turns up before a
+ * later invocation (a handler module imported after the function was
+ * created), the name is checked again against the functions that exist then,
+ * so a function deleted or reconfigured in between leaves nothing stale to
+ * report. A read made before Yulin was imported is not on record, and leaves
+ * the difference unreported.
  *
  * Staying quiet when the values agree matters as much as warning when they do
  * not. Test suites commonly export the same variables they configure their
@@ -21,22 +28,68 @@ const moveTheReadAdvice = "A read of process.env at module scope happens when th
  */
 export class SimLambdaEnvironmentConflicts {
     /**
-     * Variable names already reported, so repeated function creation does not
+     * The environments of the functions that exist now.
+     */
+    currentEnvironments;
+    /**
+     * Conflict keys already reported, so repeated function creation does not
      * repeat the same warning.
      */
     warned = new Set();
+    /**
+     * Names in conflict that had not been read outside an invocation when the
+     * conflict was found.
+     */
+    held = new Set();
+    constructor(properties = {}) {
+        this.currentEnvironments =
+            properties.currentEnvironments ?? (() => []);
+    }
     /**
      * Check a new function's environment against the host process and against
      * the functions that already exist.
      */
     check(environment, existingEnvironments) {
+        const existing = [...existingEnvironments];
         for (const [name, value] of environment.declaredVariables) {
             this.checkHostProcess(environment, name, value);
-            this.checkOtherFunctions(environment, name, value, existingEnvironments);
+            this.checkOtherFunctions(environment, name, value, existing);
+        }
+    }
+    /**
+     * Check the held names that have since been read outside an invocation
+     * again, against the functions that exist now, and report what conflicts.
+     *
+     * Called as a function is invoked, before the handler runs.
+     */
+    reportReads() {
+        const read = [...this.held].filter((name) => simProcessEnvironment.wasReadOutsideRun(name));
+        if (read.length === 0) {
+            return;
+        }
+        const environments = [...this.currentEnvironments()];
+        for (const name of read) {
+            this.held.delete(name);
+            this.checkName(name, environments);
+        }
+    }
+    /**
+     * Check one name across the given environments, each against the host
+     * process and against the environments before it.
+     */
+    checkName(name, environments) {
+        for (const [index, environment] of environments.entries()) {
+            const value = environment.declaredVariables.get(name);
+            if (value === undefined) {
+                continue;
+            }
+            this.checkHostProcess(environment, name, value);
+            this.checkOtherFunctions(environment, name, value, environments.slice(0, index));
         }
     }
     /**
-     * Warn when the host process sets the same name with a different value.
+     * Find a conflict when the host process sets the same name with a
+     * different value.
      */
     checkHostProcess(environment, name, value) {
         // Read-only lookup of a name the function itself declared.
@@ -45,13 +98,11 @@ export class SimLambdaEnvironmentConflicts {
         if (hostValue === undefined || hostValue === value) {
             return;
         }
-        this.warn(`host:${name}`, `Sim Lambda function "${environment.functionName}" declares ` +
-            `environment variable ${name}, which the host process also sets ` +
-            `with a different value. ${moveTheReadAdvice}`);
+        this.report(simLambdaHostConflict(environment, name));
     }
     /**
-     * Warn when another simulated function declares the same name with a
-     * different value.
+     * Find a conflict when another simulated function declares the same name
+     * with a different value.
      */
     checkOtherFunctions(environment, name, value, existingEnvironments) {
         for (const existing of existingEnvironments) {
@@ -59,25 +110,28 @@ export class SimLambdaEnvironmentConflicts {
             if (existingValue === undefined || existingValue === value) {
                 continue;
             }
-            this.warn(`function:${name}`, `Sim Lambda functions "${existing.functionName}" and ` +
-                `"${environment.functionName}" declare different values for ` +
-                `environment variable ${name}. ${moveTheReadAdvice}`);
+            this.report(simLambdaFunctionConflict(existing, environment, name));
             return;
         }
     }
     /**
-     * Report a conflict once per variable name.
+     * Warn about a conflict once per key if its name has been read outside an
+     * invocation, and hold the name otherwise.
      *
      * Warnings go to the console because that is where a test runner surfaces
      * them next to the failing expectation they explain; the simulator has no
      * logger of its own to route them through.
      */
-    warn(key, message) {
-        if (this.warned.has(key)) {
+    report(conflict) {
+        if (this.warned.has(conflict.key)) {
+            return;
+        }
+        if (!simProcessEnvironment.wasReadOutsideRun(conflict.name)) {
+            this.held.add(conflict.name);
             return;
         }
-        this.warned.add(key);
+        this.warned.add(conflict.key);
         // oxlint-disable-next-line no-console
-        console.warn(message);
+        console.warn(conflict.message);
     }
 }

package/dist/service/lambda/function/sim-lambda-function.js

@@ -194,6 +194,7 @@ export class SimLambdaFunction {
             logStreamName: this.logging.logStreamName(),
         });
         this.logging.recordFrom(this.#code);
+        this.properties.environmentConflicts?.reportReads();
         return await this.metrics.around(String(this.name), async () => simAwsRunAsContext.run(this.runAsOwner, { kind: "arn", arn: this.roleArn }, async () => await this.environment.runWith(async () => await this.runInHostScope(async () => await this.logging.around(async () => await invocation.run(this.#code.handlerFunction(), event))))));
     }
     /**

package/dist/service/lambda/function/sim-lambda-function.type.d.ts

@@ -8,6 +8,7 @@ import type { SimLambdaOutput } from "./logging/sim-lambda-output.js";
 import type { SimLogsServiceWriter } from "../../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaExecutableCode } from "./code/sim-lambda-executable-code.js";
 import type { SimLambdaEnvironment } from "./environment/sim-lambda-environment.js";
+import type { SimLambdaEnvironmentConflicts } from "./environment/sim-lambda-environment-conflicts.js";
 import type { SimLambdaOutboundHttp } from "./outbound/sim-lambda-outbound-http.js";
 import type { SimLambdaFunctionState } from "./sim-lambda-function-configuration.js";
 import type { SimLambdaHandler } from "./sim-lambda-handler.type.js";
@@ -27,6 +28,13 @@ export interface SimLambdaFunctionProperties {
     timeoutSeconds?: number | undefined;
     memorySizeMb?: number | undefined;
     environment?: SimLambdaEnvironment | undefined;
+    /**
+     * The check that warns about declared variables read too early, shared with
+     * every other function of the same simulated Lambda. It reports, as this
+     * function is invoked, a difference found earlier whose name has since been
+     * read outside an invocation. A function built standalone has none.
+     */
+    environmentConflicts?: SimLambdaEnvironmentConflicts | undefined;
     /**
      * The queue or topic this function's abandoned asynchronous events are sent
      * to, which is what `DeadLetterConfig.TargetArn` names.

package/dist/service/lambda/sim-lambda-commands.js

@@ -146,7 +146,9 @@ export class SimLambdaCommands {
             runAsOwner: properties.runAsOwner,
             // Shared across function creations so a conflicting environment variable
             // is only reported once for this simulated Lambda.
-            environmentConflicts: new SimLambdaEnvironmentConflicts(),
+            environmentConflicts: new SimLambdaEnvironmentConflicts({
+                currentEnvironments: () => properties.functions.values().map((existing) => existing.environment),
+            }),
             eventInvokeConfigs: this.eventInvokeConfigStore,
             destinations,
             codeStore,

package/dist/util/process/sim-process-environment-reads.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Records the names code reads from the host process.env.
+ *
+ * SimLambdaEnvironmentConflicts warns that a module-scope read sees the host
+ * value of a variable instead of the function's own. Whether that matters
+ * depends on a read having happened at all, which configuration cannot tell.
+ * This keeps the evidence: the host environment is handed out behind a Proxy
+ * that notes each name read through it.
+ *
+ * Enumerating the whole environment is not counted as reading every name in
+ * it. Node.js copies process.env key by key when it spawns a child process,
+ * and so does any tool that snapshots it, and none of that is handler code
+ * capturing a value it later depends on. An enumeration is recognised by its
+ * shape: the property reads that follow a listing of the keys, in the order
+ * the listing gave them. Its reads are recorded as they happen and taken off
+ * the record again once every key has been read, so a listing that is not
+ * followed by a complete copy hides nothing. A module copying the environment
+ * with a spread at module scope is missed as a result.
+ */
+export declare class SimProcessEnvironmentReads {
+    private readonly names;
+    /**
+     * The environment objects each watching Proxy stands in front of, so that
+     * assigning one back to process.env does not stack a Proxy on a Proxy.
+     */
+    private readonly targets;
+    /**
+     * The keys of an enumeration in progress, and how far its reads have got.
+     */
+    private enumeration;
+    /**
+     * Whether code has read the name through a watched environment.
+     */
+    wasRead(name: string): boolean;
+    /**
+     * A view of the environment that records the names read through it.
+     *
+     * Writes and deletes go straight to the environment, so a value assigned
+     * through the view is coerced to a string as process.env would coerce it.
+     */
+    watch(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+    /**
+     * The environment behind a watching view, or the environment itself when it
+     * is not one.
+     */
+    unwrap(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+    /**
+     * Note a read, and take an enumeration's reads off the record once it has
+     * read every key.
+     */
+    private recordRead;
+}

package/dist/util/process/sim-process-environment-reads.js

@@ -0,0 +1,94 @@
+/**
+ * Records the names code reads from the host process.env.
+ *
+ * SimLambdaEnvironmentConflicts warns that a module-scope read sees the host
+ * value of a variable instead of the function's own. Whether that matters
+ * depends on a read having happened at all, which configuration cannot tell.
+ * This keeps the evidence: the host environment is handed out behind a Proxy
+ * that notes each name read through it.
+ *
+ * Enumerating the whole environment is not counted as reading every name in
+ * it. Node.js copies process.env key by key when it spawns a child process,
+ * and so does any tool that snapshots it, and none of that is handler code
+ * capturing a value it later depends on. An enumeration is recognised by its
+ * shape: the property reads that follow a listing of the keys, in the order
+ * the listing gave them. Its reads are recorded as they happen and taken off
+ * the record again once every key has been read, so a listing that is not
+ * followed by a complete copy hides nothing. A module copying the environment
+ * with a spread at module scope is missed as a result.
+ */
+export class SimProcessEnvironmentReads {
+    names = new Set();
+    /**
+     * The environment objects each watching Proxy stands in front of, so that
+     * assigning one back to process.env does not stack a Proxy on a Proxy.
+     */
+    targets = new WeakMap();
+    /**
+     * The keys of an enumeration in progress, and how far its reads have got.
+     */
+    enumeration;
+    /**
+     * Whether code has read the name through a watched environment.
+     */
+    wasRead(name) {
+        return this.names.has(name);
+    }
+    /**
+     * A view of the environment that records the names read through it.
+     *
+     * Writes and deletes go straight to the environment, so a value assigned
+     * through the view is coerced to a string as process.env would coerce it.
+     */
+    watch(environment) {
+        const target = this.unwrap(environment);
+        const view = new Proxy(target, {
+            get: (watched, key) => {
+                if (typeof key === "string") {
+                    this.recordRead(key);
+                }
+                return Reflect.get(watched, key);
+            },
+            set: (watched, key, value) => Reflect.set(watched, key, value),
+            ownKeys: (watched) => {
+                const keys = Reflect.ownKeys(watched);
+                this.enumeration = { keys, next: 0, added: [] };
+                return keys;
+            },
+        });
+        this.targets.set(view, target);
+        return view;
+    }
+    /**
+     * The environment behind a watching view, or the environment itself when it
+     * is not one.
+     */
+    unwrap(environment) {
+        return this.targets.get(environment) ?? environment;
+    }
+    /**
+     * Note a read, and take an enumeration's reads off the record once it has
+     * read every key.
+     */
+    recordRead(name) {
+        const enumeration = this.enumeration;
+        if (enumeration === undefined ||
+            enumeration.keys[enumeration.next] !== name) {
+            this.enumeration = undefined;
+            this.names.add(name);
+            return;
+        }
+        enumeration.next += 1;
+        if (!this.names.has(name)) {
+            this.names.add(name);
+            enumeration.added.push(name);
+        }
+        if (enumeration.next < enumeration.keys.length) {
+            return;
+        }
+        for (const added of enumeration.added) {
+            this.names.delete(added);
+        }
+        this.enumeration = undefined;
+    }
+}

package/dist/util/process/sim-process-environment.d.ts

@@ -20,19 +20,33 @@
  *
  * The one thing this cannot reach is a read that already happened. A handler
  * module doing `const TABLE = process.env.TABLE_NAME` at module scope is
- * evaluated when the test file imports it, long before any run, so it captures
+ * evaluated when the test file imports it, long before any run, and captures
  * the host value. Reads inside the handler body see the run's own variables.
- * See SimLambdaEnvironmentConflicts, which warns when that distinction
- * actually changes what the code sees.
+ *
+ * Outside a run, process.env is the host environment behind a
+ * SimProcessEnvironmentReads view, which records the names read. The patch is
+ * installed when this module loads, which is when Yulin is imported, so a
+ * module-scope read in a handler imported after Yulin is on record.
+ * SimLambdaEnvironmentConflicts warns from that record, and only for a name
+ * whose early read changed what the code saw. A read made before Yulin was
+ * imported is invisible to it.
  */
 declare class SimProcessEnvironment {
     private readonly storage;
+    private readonly reads;
     private hostEnvironment;
-    private installed;
+    private hostView;
+    constructor();
     /**
      * Run something with the given variables as its process.env.
      */
     run<T>(variables: Record<string, string>, run: () => Promise<T>): Promise<T>;
+    /**
+     * Whether code read the name from process.env while no run was active.
+     *
+     * Reads made before this module loaded are not on record.
+     */
+    wasReadOutsideRun(name: string): boolean;
     /**
      * The host process environment, ignoring any run in progress.
      */
@@ -51,14 +65,23 @@ declare class SimProcessEnvironment {
      *
      * process.env is a plain configurable data property on process, so it can
      * be replaced with a getter. Outside a simulated run the getter hands back
-     * the untouched host environment object, so the patch is inert: anything
-     * that reads, writes, or stubs process.env normally is unaffected.
+     * the host environment behind a view that records the names read, and
+     * passes every read, write and delete through to it. Anything that reads,
+     * writes, or stubs process.env normally is unaffected.
      *
-     * Installed once and never removed. Removing it would be unsafe while
-     * another run is in flight, and there is nothing to gain: an installed patch
-     * with no run in progress behaves exactly like no patch at all.
+     * Installed once, at construction, and never removed. Removing it would be
+     * unsafe while another run is in flight, and there is nothing to gain. With
+     * no run in progress, the patch passes everything through to the host
+     * environment.
      */
     private install;
+    /**
+     * Make the environment the host environment, and watch reads of it.
+     *
+     * Code saving process.env and assigning it back hands over the watching
+     * view, which is unwrapped so that views do not nest.
+     */
+    private useHostEnvironment;
     /**
      * Apply an assignment to process.env as a whole.
      *

package/dist/util/process/sim-process-environment.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { SimProcessEnvironmentReads } from "./sim-process-environment-reads.js";
 /**
  * The process.env in-process handler code sees while a simulated run lasts.
  *
@@ -21,22 +22,39 @@ import { AsyncLocalStorage } from "node:async_hooks";
  *
  * The one thing this cannot reach is a read that already happened. A handler
  * module doing `const TABLE = process.env.TABLE_NAME` at module scope is
- * evaluated when the test file imports it, long before any run, so it captures
+ * evaluated when the test file imports it, long before any run, and captures
  * the host value. Reads inside the handler body see the run's own variables.
- * See SimLambdaEnvironmentConflicts, which warns when that distinction
- * actually changes what the code sees.
+ *
+ * Outside a run, process.env is the host environment behind a
+ * SimProcessEnvironmentReads view, which records the names read. The patch is
+ * installed when this module loads, which is when Yulin is imported, so a
+ * module-scope read in a handler imported after Yulin is on record.
+ * SimLambdaEnvironmentConflicts warns from that record, and only for a name
+ * whose early read changed what the code saw. A read made before Yulin was
+ * imported is invisible to it.
  */
 class SimProcessEnvironment {
     storage = new AsyncLocalStorage();
+    reads = new SimProcessEnvironmentReads();
     hostEnvironment = process.env;
-    installed = false;
+    hostView = process.env;
+    constructor() {
+        this.install();
+    }
     /**
      * Run something with the given variables as its process.env.
      */
     async run(variables, run) {
-        this.install();
         return await this.storage.run(variables, run);
     }
+    /**
+     * Whether code read the name from process.env while no run was active.
+     *
+     * Reads made before this module loaded are not on record.
+     */
+    wasReadOutsideRun(name) {
+        return this.reads.wasRead(name);
+    }
     /**
      * The host process environment, ignoring any run in progress.
      */
@@ -65,27 +83,35 @@ class SimProcessEnvironment {
      *
      * process.env is a plain configurable data property on process, so it can
      * be replaced with a getter. Outside a simulated run the getter hands back
-     * the untouched host environment object, so the patch is inert: anything
-     * that reads, writes, or stubs process.env normally is unaffected.
+     * the host environment behind a view that records the names read, and
+     * passes every read, write and delete through to it. Anything that reads,
+     * writes, or stubs process.env normally is unaffected.
      *
-     * Installed once and never removed. Removing it would be unsafe while
-     * another run is in flight, and there is nothing to gain: an installed patch
-     * with no run in progress behaves exactly like no patch at all.
+     * Installed once, at construction, and never removed. Removing it would be
+     * unsafe while another run is in flight, and there is nothing to gain. With
+     * no run in progress, the patch passes everything through to the host
+     * environment.
      */
     install() {
-        if (this.installed) {
-            return;
-        }
-        this.hostEnvironment = process.env;
+        this.useHostEnvironment(process.env);
         Object.defineProperty(process, "env", {
             configurable: true,
             enumerable: true,
-            get: () => this.storage.getStore() ?? this.hostEnvironment,
+            get: () => this.storage.getStore() ?? this.hostView,
             set: (replacement) => {
                 this.replaceVariables(replacement);
             },
         });
-        this.installed = true;
+    }
+    /**
+     * Make the environment the host environment, and watch reads of it.
+     *
+     * Code saving process.env and assigning it back hands over the watching
+     * view, which is unwrapped so that views do not nest.
+     */
+    useHostEnvironment(environment) {
+        this.hostEnvironment = this.reads.unwrap(environment);
+        this.hostView = this.reads.watch(this.hostEnvironment);
     }
     /**
      * Apply an assignment to process.env as a whole.
@@ -104,7 +130,7 @@ class SimProcessEnvironment {
     replaceVariables(replacement) {
         const store = this.storage.getStore();
         if (store === undefined) {
-            this.hostEnvironment = replacement;
+            this.useHostEnvironment(replacement);
             return;
         }
         const replacing = Object.entries(replacement);

package/docs/services/lambda/README.md

@@ -3355,6 +3355,12 @@ console in the two situations where the difference changes what your code sees:
 - a declared variable whose name the host process also sets, with a different value
 - two simulated functions declaring the same variable name with different values
 
+Either one is reported only once code has read that name from `process.env` with no invocation
+running. Yulin records those reads from the moment it is imported. A read made earlier is invisible
+to it (a handler module imported ahead of Yulin, or a setup file that loads first), and so is a copy
+of the whole environment such as `{ ...process.env }`. Neither produces a warning. A handler that
+reads its variables inside the handler function produces none either.
+
 ## The time inside a handler
 
 A function runs on its simulation's clock, and so does the function code. `Date.now()` and

package/docs/services/s3/README.md

@@ -3317,6 +3317,22 @@ The `getBucketWebsiteUrl(...)` method returns the simulated S3 website URL for t
 `localUrl(...)` method on the localhost server adapts that URL so the request is sent to the local
 server while preserving the simulated S3 website hostname.
 
+### AWS CLI uploads
+
+Set `preferred_transfer_client` to `classic` in the AWS config file used for the simulated
+endpoint:
+
+```ini
+[default]
+s3 =
+    preferred_transfer_client = classic
+```
+
+The CLI's [automatic transfer-client selection](https://docs.aws.amazon.com/cli/latest/topic/s3-config.html#preferred-transfer-client)
+can choose CRT. Its uploads use streaming payload trailers, which Yulin's signature verifier
+does not support. Those requests fail with `403`. The classic client supports the single-file
+and multipart uploads exercised by Yulin's CLI tests.
+
 ## Presigned URLs
 
 Sim S3 serves a REST API endpoint alongside the website endpoint, and it accepts presigned URLs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.21.32",
+  "version": "1.21.34",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -293,13 +293,13 @@
     "eslint-plugin-jsdoc": "^64.0.1",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-security": "^4.0.1",
-    "eslint-plugin-unicorn": "^75.0.0",
+    "eslint-plugin-unicorn": "^76.0.0",
     "execa": "^10.0.0",
     "fta-cli": "^3.0.0",
     "hyparquet": "^1.29.2",
     "hyparquet-writer": "^0.16.9",
     "node-sql-parser": "^5.4.0",
-    "oxfmt": "^0.72.0",
+    "oxfmt": "^0.73.0",
     "oxlint": "^1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "semantic-release": "25.0.9",