fix(lambda): reject empty code-source fields instead of ignoring them

The mutual-exclusivity check used truthiness, so `imageUri` alongside
`s3Bucket: ''` read as image-only while the create operation still forwarded the
defined empty field to AWS.

An empty string is meaningless for every code-source field, so each is now
`.min(1)` at the contract rather than special-cased in the refinement.

Author: waleedlatif1

apps/sim/lib/api/contracts/tools/aws/lambda-create-function.ts

@@ -21,11 +21,11 @@ const CreateFunctionSchema = z
     runtime: z.string().optional(),
     handler: z.string().optional(),
     packageType: z.enum(['Zip', 'Image']).optional(),
-    s3Bucket: z.string().optional(),
-    s3Key: z.string().optional(),
-    s3ObjectVersion: z.string().optional(),
-    imageUri: z.string().optional(),
-    sourceKmsKeyArn: z.string().optional(),
+    s3Bucket: z.string().min(1, 's3Bucket cannot be empty').optional(),
+    s3Key: z.string().min(1, 's3Key cannot be empty').optional(),
+    s3ObjectVersion: z.string().min(1, 's3ObjectVersion cannot be empty').optional(),
+    imageUri: z.string().min(1, 'imageUri cannot be empty').optional(),
+    sourceKmsKeyArn: z.string().min(1, 'sourceKmsKeyArn cannot be empty').optional(),
     description: z.string().max(256, 'description cannot exceed 256 characters').optional(),
     functionTimeout: z.number().int().min(1).max(900).optional(),
     memorySize: z.number().int().min(128).max(32768).optional(),

apps/sim/lib/api/contracts/tools/aws/lambda-update-function-code.ts

@@ -17,11 +17,11 @@ const UpdateFunctionCodeSchema = z
       .string()
       .min(1, 'functionName is required')
       .max(256, 'functionName cannot exceed 256 characters'),
-    s3Bucket: z.string().optional(),
-    s3Key: z.string().optional(),
-    s3ObjectVersion: z.string().optional(),
-    imageUri: z.string().optional(),
-    sourceKmsKeyArn: z.string().optional(),
+    s3Bucket: z.string().min(1, 's3Bucket cannot be empty').optional(),
+    s3Key: z.string().min(1, 's3Key cannot be empty').optional(),
+    s3ObjectVersion: z.string().min(1, 's3ObjectVersion cannot be empty').optional(),
+    imageUri: z.string().min(1, 'imageUri cannot be empty').optional(),
+    sourceKmsKeyArn: z.string().min(1, 'sourceKmsKeyArn cannot be empty').optional(),
     architectures: z
       .array(z.enum(['x86_64', 'arm64']))
       .length(1, 'architectures takes exactly one value')

apps/sim/lib/internal/lambda/execute-tool.test.ts

@@ -528,6 +528,25 @@ describe('executeLambdaTool', () => {
     expect(JSON.stringify(await response.json())).toContain('not both')
   })
 
+  it('rejects an empty code-source field rather than treating it as absent', async () => {
+    const response = await executeLambdaTool(
+      createRequest({
+        toolId: 'lambda_create_function',
+        input: {
+          ...CONNECTION,
+          functionName: 'alpha',
+          role: 'arn:aws:iam::1:role/exec',
+          imageUri: 'ecr/alpha:1',
+          packageType: 'Image',
+          s3Bucket: '',
+        },
+      })
+    )
+
+    expect(response.status).toBe(400)
+    expect(mockOperations.executeLambdaCreateFunction).not.toHaveBeenCalled()
+  })
+
   it('rejects a partial S3 pair alongside an image URI', async () => {
     const response = await executeLambdaTool(
       createRequest({