fix(lambda): reject empty optional strings across the Lambda contracts

An empty `eventSourceArn` alongside bootstrap servers slipped past the
mutual-exclusivity check for the same reason the code-source fields did: the
guard tests truthiness, so a defined-but-empty value reads as absent while the
operation still forwards it.

Rather than patch each field as it surfaces, every optional string field now
rejects an empty value. The tool layer already drops `''` before it reaches a
contract, so an empty value can only arrive from a malformed direct call, and
forwarding it to AWS is never right.

`description` is exempt: AWS documents it as "Minimum length of 0", so an empty
value legitimately clears it. Both behaviours are covered by tests.

Author: waleedlatif1

apps/sim/lib/api/contracts/tools/aws/lambda-add-permission.ts

@@ -29,17 +29,17 @@ const AddPermissionSchema = z.object({
       'action must be a Lambda action such as lambda:InvokeFunction'
     ),
   principal: z.string().min(1, 'principal is required'),
-  sourceArn: z.string().optional(),
-  sourceAccount: z.string().optional(),
-  principalOrgId: z.string().optional(),
-  eventSourceToken: z.string().optional(),
+  sourceArn: z.string().min(1, 'sourceArn cannot be empty').optional(),
+  sourceAccount: z.string().min(1, 'sourceAccount cannot be empty').optional(),
+  principalOrgId: z.string().min(1, 'principalOrgId cannot be empty').optional(),
+  eventSourceToken: z.string().min(1, 'eventSourceToken cannot be empty').optional(),
   functionUrlAuthType: z.enum(['NONE', 'AWS_IAM']).optional(),
   qualifier: z
     .string()
     .min(1, 'qualifier cannot be empty')
     .max(128, 'qualifier cannot exceed 128 characters')
     .optional(),
-  revisionId: z.string().optional(),
+  revisionId: z.string().min(1, 'revisionId cannot be empty').optional(),
 })
 
 const AddPermissionResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/lambda-create-event-source-mapping.ts

@@ -18,7 +18,7 @@ const CreateEventSourceMappingSchema = z
       .string()
       .min(1, 'functionName is required')
       .max(256, 'functionName cannot exceed 256 characters'),
-    eventSourceArn: z.string().optional(),
+    eventSourceArn: z.string().min(1, 'eventSourceArn cannot be empty').optional(),
     enabled: z.boolean().optional(),
     batchSize: z.number().int().min(1).max(10000).optional(),
     maximumBatchingWindowInSeconds: z.number().int().min(0).max(300).optional(),
@@ -36,9 +36,9 @@ const CreateEventSourceMappingSchema = z
     queues: z.array(z.string()).optional(),
     functionResponseTypes: z.array(z.enum(['ReportBatchItemFailures'])).optional(),
     filterPatterns: z.array(z.string()).optional(),
-    onSuccessDestination: z.string().optional(),
-    onFailureDestination: z.string().optional(),
-    kmsKeyArn: z.string().optional(),
+    onSuccessDestination: z.string().min(1, 'onSuccessDestination cannot be empty').optional(),
+    onFailureDestination: z.string().min(1, 'onFailureDestination cannot be empty').optional(),
+    kmsKeyArn: z.string().min(1, 'kmsKeyArn cannot be empty').optional(),
     tags: z.record(z.string(), z.string()).optional(),
     sourceAccessConfigurations: z
       .array(
@@ -49,11 +49,20 @@ const CreateEventSourceMappingSchema = z
       )
       .max(22, 'sourceAccessConfigurations accepts at most 22 entries')
       .optional(),
-    documentDbDatabaseName: z.string().optional(),
-    documentDbCollectionName: z.string().optional(),
+    documentDbDatabaseName: z.string().min(1, 'documentDbDatabaseName cannot be empty').optional(),
+    documentDbCollectionName: z
+      .string()
+      .min(1, 'documentDbCollectionName cannot be empty')
+      .optional(),
     documentDbFullDocument: z.enum(['UpdateLookup', 'Default']).optional(),
-    amazonManagedKafkaConsumerGroupId: z.string().optional(),
-    selfManagedKafkaConsumerGroupId: z.string().optional(),
+    amazonManagedKafkaConsumerGroupId: z
+      .string()
+      .min(1, 'amazonManagedKafkaConsumerGroupId cannot be empty')
+      .optional(),
+    selfManagedKafkaConsumerGroupId: z
+      .string()
+      .min(1, 'selfManagedKafkaConsumerGroupId cannot be empty')
+      .optional(),
     selfManagedKafkaBootstrapServers: z
       .array(z.string().min(1, 'a bootstrap server cannot be empty'))
       .optional(),

apps/sim/lib/api/contracts/tools/aws/lambda-create-function.ts

@@ -18,8 +18,8 @@ const CreateFunctionSchema = z
       .min(1, 'functionName is required')
       .max(256, 'functionName cannot exceed 256 characters'),
     role: z.string().min(1, 'role is required'),
-    runtime: z.string().optional(),
-    handler: z.string().optional(),
+    runtime: z.string().min(1, 'runtime cannot be empty').optional(),
+    handler: z.string().min(1, 'handler cannot be empty').optional(),
     packageType: z.enum(['Zip', 'Image']).optional(),
     s3Bucket: z.string().min(1, 's3Bucket cannot be empty').optional(),
     s3Key: z.string().min(1, 's3Key cannot be empty').optional(),
@@ -41,11 +41,11 @@ const CreateFunctionSchema = z
     vpcSubnetIds: z.array(z.string()).optional(),
     vpcSecurityGroupIds: z.array(z.string()).optional(),
     tracingMode: z.enum(['Active', 'PassThrough']).optional(),
-    deadLetterTargetArn: z.string().optional(),
-    kmsKeyArn: z.string().optional(),
+    deadLetterTargetArn: z.string().min(1, 'deadLetterTargetArn cannot be empty').optional(),
+    kmsKeyArn: z.string().min(1, 'kmsKeyArn cannot be empty').optional(),
     snapStartApplyOn: z.enum(['PublishedVersions', 'None']).optional(),
     logFormat: z.enum(['JSON', 'Text']).optional(),
-    logGroup: z.string().optional(),
+    logGroup: z.string().min(1, 'logGroup cannot be empty').optional(),
   })
   .superRefine((value, ctx) => {
     const hasAnyZipField = Boolean(

apps/sim/lib/api/contracts/tools/aws/lambda-invoke.ts

@@ -18,6 +18,7 @@ const InvokeSchema = z.object({
   logType: z.enum(['None', 'Tail']).optional(),
   clientContext: z
     .string()
+    .min(1, 'clientContext cannot be empty')
     .max(3583, 'clientContext cannot exceed 3583 bytes of base64 data')
     .optional(),
   qualifier: z

apps/sim/lib/api/contracts/tools/aws/lambda-list-aliases.ts

@@ -18,7 +18,7 @@ const ListAliasesSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  aliasFunctionVersion: z.string().optional(),
+  aliasFunctionVersion: z.string().min(1, 'aliasFunctionVersion cannot be empty').optional(),
 })
 
 const ListAliasesResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/lambda-list-event-source-mappings.ts

@@ -19,7 +19,7 @@ const ListEventSourceMappingsSchema = z.object({
     .min(1, 'functionName cannot be empty')
     .max(256, 'functionName cannot exceed 256 characters')
     .optional(),
-  eventSourceArn: z.string().optional(),
+  eventSourceArn: z.string().min(1, 'eventSourceArn cannot be empty').optional(),
 })
 
 const ListEventSourceMappingsResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/lambda-list-functions.ts

@@ -16,7 +16,7 @@ const ListFunctionsSchema = z
     ...lambdaConnectionFields,
     ...lambdaPaginationFields,
     functionVersion: z.literal('ALL').optional(),
-    masterRegion: z.string().optional(),
+    masterRegion: z.string().min(1, 'masterRegion cannot be empty').optional(),
   })
   .superRefine((value, ctx) => {
     if (value.masterRegion && value.functionVersion !== 'ALL') {

apps/sim/lib/api/contracts/tools/aws/lambda-list-layer-versions.ts

@@ -22,7 +22,7 @@ const ListLayerVersionsSchema = z.object({
       /^(arn:[a-zA-Z0-9-]+:lambda:[a-zA-Z0-9-]+:\d{12}:layer:[a-zA-Z0-9-_]+)$|^[a-zA-Z0-9-_]+$/,
       'layerName must be a layer name or a layer ARN'
     ),
-  compatibleRuntime: z.string().optional(),
+  compatibleRuntime: z.string().min(1, 'compatibleRuntime cannot be empty').optional(),
   compatibleArchitecture: z.enum(['x86_64', 'arm64']).optional(),
 })
 

apps/sim/lib/api/contracts/tools/aws/lambda-list-layers.ts

@@ -14,7 +14,7 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 const ListLayersSchema = z.object({
   ...lambdaConnectionFields,
   ...lambdaSmallPaginationFields,
-  compatibleRuntime: z.string().optional(),
+  compatibleRuntime: z.string().min(1, 'compatibleRuntime cannot be empty').optional(),
   compatibleArchitecture: z.enum(['x86_64', 'arm64']).optional(),
 })
 

apps/sim/lib/api/contracts/tools/aws/lambda-publish-version.ts

@@ -16,9 +16,9 @@ const PublishVersionSchema = z.object({
     .string()
     .min(1, 'functionName is required')
     .max(256, 'functionName cannot exceed 256 characters'),
-  codeSha256: z.string().optional(),
+  codeSha256: z.string().min(1, 'codeSha256 cannot be empty').optional(),
   description: z.string().max(256, 'description cannot exceed 256 characters').optional(),
-  revisionId: z.string().optional(),
+  revisionId: z.string().min(1, 'revisionId cannot be empty').optional(),
 })
 
 const PublishVersionResponseSchema = z.object({