feat(lambda): add AWS Lambda integration with 50 operations

[waleedlatif1]

Summary

• Adds an AWS Lambda block with 50 operations covering invocation, function CRUD, versions and aliases, resource-based permissions, event source mappings, reserved and provisioned concurrency, function URLs, async invocation configs, layers, tags, account settings, recursion detection, and runtime management
• Tools run in-process through the shared internal tool-operation boundary using @aws-sdk/client-lambda; every request and response is contract-bound, with shared response projections for the FunctionConfiguration, alias, event source mapping, function URL, provisioned concurrency, and layer types
• Contracts carry the documented AWS bounds and enums, plus cross-field guards so a missing code source or a Manual runtime policy without a version ARN fails at the boundary with a named field instead of an opaque AWS error
• Deployment packages come from Amazon S3 or a container image URI — inline .zip upload is not supported, and the docs page says so

Type of Change

• New feature

Testing

• 145 new tests across the block, the SDK client mappers, the operations, and the tool-operation adapter
• bun run type-check clean; all 38 check:audits pass, including check:api-validation:strict, docs:check, integration-catalog:check, check:tool-request-boundary, and check:bare-icons
• 7,635 tests pass across the blocks, tools, contracts, and tool-operation registry suites
• Verified every operation's request fields, response shapes, numeric bounds, and enum sets against the AWS Lambda API Reference
• Mutation-checked the params guard: reverted it, watched the test go red, restored it

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 28, 2026 10:12am

[waleedlatif1]

@greptile-apps

[waleedlatif1]

@greptile-apps

[greptile-apps]

Greptile Summary

The PR adds an in-process AWS Lambda integration with workflow-block configuration, validated operation contracts, SDK command mapping, generated registry/catalog metadata, documentation, and broad test coverage.

• Adds 50 Lambda operations spanning invocation, function lifecycle, aliases, permissions, event sources, concurrency, URLs, async configuration, layers, tags, and runtime controls.
• Preserves explicit empty-array clearing while treating blank optional update fields as unchanged.
• Separates Lambda’s function timeout from the shared tool executor’s request deadline.
• Normalizes and validates VPC updates so both subnet and security-group lists are supplied together.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported Lambda update, VPC, and timeout failures are resolved at the current head.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/lambda.ts	Defines the Lambda workflow block and now distinguishes explicit empty-array clearing from blank fields while using functionTimeout.
apps/sim/lib/internal/lambda/operations.ts	Maps validated operation inputs to AWS SDK commands, including complete VPC normalization and the renamed function timeout.
apps/sim/lib/internal/lambda/execute-tool.ts	Enforces contract parsing before dispatching Lambda operations through the internal execution boundary.
apps/sim/lib/api/contracts/tools/aws/lambda-update-function-configuration.ts	Validates update configuration bounds and requires VPC subnet and security-group lists to be supplied together.
apps/sim/tools/lambda/update_function_configuration.ts	Declares user-facing update parameters and forwards explicit empty collections and functionTimeout to the validated operation.
apps/sim/tools/lambda/supplied.ts	Preserves intentionally supplied empty arrays while omitting nullish values.
apps/sim/blocks/blocks/lambda.test.ts	Covers explicit collection clearing, blank-field preservation, and block parameter transformation.
apps/sim/lib/internal/lambda/operations.test.ts	Exercises SDK command mappings, including complete VPC detach objects.
apps/sim/lib/internal/lambda/execute-tool.test.ts	Verifies contract rejection of one-sided VPC updates before operation dispatch.

Sequence Diagram

sequenceDiagram
  participant W as Workflow Block
  participant T as Tool Boundary
  participant C as Lambda Contract
  participant O as Lambda Operation
  participant A as AWS Lambda
  W->>T: Operation and transformed parameters
  T->>C: Validate request contract
  alt Invalid input
    C-->>T: Structured validation error
    T-->>W: Failed tool result
  else Valid input
    C->>O: Validated operation input
    O->>A: AWS SDK command
    A-->>O: Lambda response
    O-->>T: Contract-shaped output
    T-->>W: Successful tool result
  end

Loading

_{Reviews (5): Last reviewed commit: "fix(lambda): never send a half-configure..." | Re-trigger Greptile}

[cubic-dev-ai]

Review completed against the latest diff

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[waleedlatif1]

@greptile-apps

[waleedlatif1]

@greptile-apps

[waleedlatif1]

Confirmed and fixed in ec9d37e — this was a real follow-on from the previous round, not a stale read.

The counterexample was exact: an empty array is truthy, so toVpcConfig([], undefined) fell past the if (!subnetIds && !securityGroupIds) guard and then included each list independently, emitting VpcConfig: { SubnetIds: [] } with no security groups. Once the previous round made clearing possible at all, that one-sided path became reachable.

A Lambda VPC attachment is a unit, so the fix is at both levels:

• The contract now requires vpcSubnetIds and vpcSecurityGroupIds to be supplied together on Create Function and Update Function Configuration, reporting on whichever side is missing.
• toVpcConfig defaults the other list to [], so it cannot emit a one-sided config even if called directly.

Covered by four tests: a one-sided update is rejected at the boundary, a both-empty detach is accepted, and the mapper emits both keys in each direction.

[waleedlatif1]

@greptile-apps