@kensio/yulin 1.12.1 → 1.14.0

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.js

@@ -0,0 +1,118 @@
+import { MappedFactory } from "@kensio/part-factory";
+import { simCfFunctionUrlOriginParts, } from "./sim-cf-function-url-origin-fragments.js";
+const assumeRolePolicyDocument = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "lambda.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};
+/**
+ * The ARN of the Distribution the template creates, written the way CDK writes
+ * it.
+ */
+export const simCfDistributionArn = {
+    "Fn::Join": [
+        "",
+        [
+            "arn:aws:cloudfront::",
+            { Ref: "AWS::AccountId" },
+            ":distribution/",
+            { Ref: "SiteDistribution" },
+        ],
+    ],
+};
+/**
+ * Builds the template for a Lambda Function URL served through a Distribution
+ * with an origin access control.
+ *
+ * ```typescript
+ * const stack = await simAws.cloudFormation().deployTemplate({
+ *   stackName: "site-stack",
+ *   template: simCfFunctionUrlOriginTemplateFactory.make({ permitted: false }),
+ * });
+ * ```
+ *
+ * The Function URL authorizes with `AWS_IAM`, which is the whole point of the
+ * shape: the endpoint exists, and only the Distribution may use it.
+ */
+export const simCfFunctionUrlOriginTemplateFactory = new MappedFactory(() => ({
+    signingBehavior: "always",
+    originAccessControl: true,
+    permitted: true,
+    permissionSourceArn: simCfDistributionArn,
+}), (input) => ({
+    Resources: {
+        GreeterRole: {
+            Type: "AWS::IAM::Role",
+            Properties: {
+                RoleName: "GreeterRole",
+                AssumeRolePolicyDocument: assumeRolePolicyDocument,
+            },
+        },
+        GreeterFunction: {
+            Type: "AWS::Lambda::Function",
+            Properties: {
+                FunctionName: "greeter",
+                Role: { "Fn::GetAtt": ["GreeterRole", "Arn"] },
+                Code: {
+                    ZipFile: "exports.handler = async () => " +
+                        "({ statusCode: 200, body: 'Hello from behind CloudFront' });",
+                },
+                Handler: "index.handler",
+                Runtime: "nodejs22.x",
+            },
+        },
+        GreeterUrl: {
+            Type: "AWS::Lambda::Url",
+            Properties: {
+                TargetFunctionArn: { "Fn::GetAtt": ["GreeterFunction", "Arn"] },
+                AuthType: "AWS_IAM",
+            },
+        },
+        ...simCfFunctionUrlOriginParts(input).originAccessControl,
+        SiteDistribution: {
+            Type: "AWS::CloudFront::Distribution",
+            Properties: {
+                DistributionConfig: {
+                    Enabled: true,
+                    Origins: [
+                        {
+                            Id: "FunctionUrlOrigin",
+                            // The Function URL endpoint is a URL, and an Origin takes a
+                            // domain name, so CDK splits the host out of it.
+                            DomainName: {
+                                "Fn::Select": [
+                                    2,
+                                    {
+                                        "Fn::Split": [
+                                            "/",
+                                            { "Fn::GetAtt": ["GreeterUrl", "FunctionUrl"] },
+                                        ],
+                                    },
+                                ],
+                            },
+                            CustomOriginConfig: { OriginProtocolPolicy: "https-only" },
+                            ...simCfFunctionUrlOriginParts(input).originAccessControlId,
+                        },
+                    ],
+                    DefaultCacheBehavior: {
+                        TargetOriginId: "FunctionUrlOrigin",
+                        ViewerProtocolPolicy: "redirect-to-https",
+                    },
+                },
+            },
+        },
+        ...simCfFunctionUrlOriginParts(input).invokePermission,
+    },
+    Outputs: {
+        DistributionDomainName: {
+            Value: { "Fn::GetAtt": ["SiteDistribution", "DomainName"] },
+        },
+        DistributionArn: { Value: simCfDistributionArn },
+    },
+}));
+//# sourceMappingURL=sim-cf-function-url-origin-template.factory.js.map

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-function-url-origin-template.factory.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAEL,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,MAAM,wBAAwB,GAAG;IAC/B,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT;YACE,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;YAC9C,MAAM,EAAE,gBAAgB;SACzB;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,UAAU,EAAE;QACV,EAAE;QACF;YACE,sBAAsB;YACtB,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACzB,gBAAgB;YAChB,EAAE,GAAG,EAAE,kBAAkB,EAAE;SAC5B;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,aAAa,CAIpE,GAAG,EAAE,CAAC,CAAC;IACL,eAAe,EAAE,QAAQ;IACzB,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,IAAI;IACf,mBAAmB,EAAE,oBAAoB;CAC1C,CAAC,EACF,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,SAAS,EAAE;QACT,WAAW,EAAE;YACX,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE;gBACV,QAAQ,EAAE,aAAa;gBACvB,wBAAwB,EAAE,wBAAwB;aACnD;SACF;QACD,eAAe,EAAE;YACf,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE;gBACV,YAAY,EAAE,SAAS;gBACvB,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE;gBAC9C,IAAI,EAAE;oBACJ,OAAO,EACL,gCAAgC;wBAChC,8DAA8D;iBACjE;gBACD,OAAO,EAAE,eAAe;gBACxB,OAAO,EAAE,YAAY;aACtB;SACF;QACD,UAAU,EAAE;YACV,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE;gBACV,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;gBAC/D,QAAQ,EAAE,SAAS;aACpB;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,mBAAmB;QACzD,gBAAgB,EAAE;YAChB,IAAI,EAAE,+BAA+B;YACrC,UAAU,EAAE;gBACV,kBAAkB,EAAE;oBAClB,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,EAAE,EAAE,mBAAmB;4BACvB,4DAA4D;4BAC5D,iDAAiD;4BACjD,UAAU,EAAE;gCACV,YAAY,EAAE;oCACZ,CAAC;oCACD;wCACE,WAAW,EAAE;4CACX,GAAG;4CACH,EAAE,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;yCAChD;qCACF;iCACF;6BACF;4BACD,kBAAkB,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE;4BAC1D,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,qBAAqB;yBAC5D;qBACF;oBACD,oBAAoB,EAAE;wBACpB,cAAc,EAAE,mBAAmB;wBACnC,oBAAoB,EAAE,mBAAmB;qBAC1C;iBACF;aACF;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,gBAAgB;KACvD;IACD,OAAO,EAAE;QACP,sBAAsB,EAAE;YACtB,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;SAC5D;QACD,eAAe,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;KACjD;CACF,CAAC,CACH,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.d.ts

@@ -1,3 +1,4 @@
+import type { SimCloudFrontOriginAccessControl } from "../../origin-access-control/sim-cf-origin-access-control.js";
 import type { SimCloudFrontOrigin } from "../sim-cloudfront-origin.js";
 import type { SimCloudFrontOriginRequest } from "../sim-cloudfront-request-response.js";
 import type { SimCfCustomOriginDispatcher } from "./sim-cf-custom-origin-dispatcher.js";
@@ -6,6 +7,7 @@ interface SimCloudFrontCustomOriginProperties {
     readonly domainName: string;
     readonly originPath?: string | undefined;
     readonly dispatcher: SimCfCustomOriginDispatcher;
+    readonly originAccessControl?: SimCloudFrontOriginAccessControl | undefined;
 }
 /**
  * Simulated CloudFront custom Origin.
@@ -15,15 +17,22 @@ interface SimCloudFrontCustomOriginProperties {
  * with an endpoint of its own: an HTTP API or a Lambda Function URL, or
  * anything a simulated Route53 record points at one of those.
  *
- * The Origin is reached anonymously, as CloudFront reaches an Origin it has no
- * Origin Access Control for, so a Function URL or route that authorizes with
- * `AWS_IAM` refuses the request.
+ * An Origin with no origin access control is reached anonymously, as CloudFront
+ * reaches one it has nothing to sign for, so a Function URL or route that
+ * authorizes with `AWS_IAM` refuses the request. One whose origin access
+ * control signs is reached as the CloudFront service principal instead, which
+ * is what a Function URL behind an origin access control admits.
  */
 export declare class SimCloudFrontCustomOrigin implements SimCloudFrontOrigin {
+    /**
+     * The origin access control this Origin was created with, if any.
+     */
+    readonly originAccessControl: SimCloudFrontOriginAccessControl | undefined;
     private readonly originId;
     private readonly domainName;
     private readonly originPath;
     private readonly dispatcher;
+    private readonly signer;
     constructor(properties: SimCloudFrontCustomOriginProperties);
     /**
      * Fetch the request from the simulated service behind this Origin.

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-custom-origin.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAGxF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;CAClD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAEzD,YAAY,UAAU,EAAE,mCAAmC,EAK1D;IAED;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgBlE;CACF"}
+{"version":3,"file":"sim-cloudfront-custom-origin.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAC;AACpH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAIxF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;CAC7E;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB;IACnE;;OAEG;IACH,SAAgB,mBAAmB,EAC/B,gCAAgC,GAChC,SAAS,CAAC;IAEd,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,YAAY,UAAU,EAAE,mCAAmC,EAO1D;IAED;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiBlE;CACF"}

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.js

@@ -1,4 +1,5 @@
 import { simCfCustomOriginRequest } from "./sim-cf-custom-origin-request.js";
+import { SimCfCustomOriginSigner } from "./sim-cf-custom-origin-signer.js";
 /**
  * Simulated CloudFront custom Origin.
  *
@@ -7,20 +8,29 @@ import { simCfCustomOriginRequest } from "./sim-cf-custom-origin-request.js";
  * with an endpoint of its own: an HTTP API or a Lambda Function URL, or
  * anything a simulated Route53 record points at one of those.
  *
- * The Origin is reached anonymously, as CloudFront reaches an Origin it has no
- * Origin Access Control for, so a Function URL or route that authorizes with
- * `AWS_IAM` refuses the request.
+ * An Origin with no origin access control is reached anonymously, as CloudFront
+ * reaches one it has nothing to sign for, so a Function URL or route that
+ * authorizes with `AWS_IAM` refuses the request. One whose origin access
+ * control signs is reached as the CloudFront service principal instead, which
+ * is what a Function URL behind an origin access control admits.
  */
 export class SimCloudFrontCustomOrigin {
+    /**
+     * The origin access control this Origin was created with, if any.
+     */
+    originAccessControl;
     originId;
     domainName;
     originPath;
     dispatcher;
+    signer;
     constructor(properties) {
         this.originId = properties.originId;
         this.domainName = properties.domainName;
         this.originPath = properties.originPath ?? "";
         this.dispatcher = properties.dispatcher;
+        this.originAccessControl = properties.originAccessControl;
+        this.signer = new SimCfCustomOriginSigner(properties.originAccessControl);
     }
     /**
      * Fetch the request from the simulated service behind this Origin.
@@ -34,6 +44,7 @@ export class SimCloudFrontCustomOrigin {
             domainName: this.domainName,
             originPath: this.originPath,
             request: request.req,
+            signingHeaders: this.signer.forRequest(request),
         });
         const { hostname } = new URL(originRequest.url);
         if (!this.dispatcher.resolves(hostname)) {

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-custom-origin.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAS7E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,UAAU,CAA8B;IAEzD,YAAY,UAA+C;QACzD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAAmC;QAC7C,MAAM,aAAa,GAAG,wBAAwB,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,OAAO,CAAC,GAAG;SACrB,CAAC,CAAC;QAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,QAAQ,gBAAgB,IAAI,CAAC,UAAU,8CAA8C,CACpH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"sim-cloudfront-custom-origin.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAU3E;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACa,mBAAmB,CAErB;IAEG,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,UAAU,CAA8B;IACxC,MAAM,CAA0B;IAEjD,YAAY,UAA+C;QACzD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAAmC;QAC7C,MAAM,aAAa,GAAG,wBAAwB,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,QAAQ,gBAAgB,IAAI,CAAC,UAAU,8CAA8C,CACpH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.d.ts

@@ -0,0 +1,12 @@
+import type { SimCloudFrontOriginAccessControl, SimCloudFrontOriginAccessControlOriginType } from "./sim-cf-origin-access-control.js";
+/**
+ * Refuse an origin access control whose origin type is not the one the Origin
+ * it was named on needs.
+ *
+ * CloudFront refuses that pairing, and it is worth reproducing: an origin
+ * access control signing for an S3 Bucket signs nothing a Function URL will
+ * admit, so a template pairing them wrongly would otherwise deploy here and
+ * fail on the real deployment.
+ */
+export declare function assertSimCfOacOriginType(originId: string, originType: SimCloudFrontOriginAccessControlOriginType, originAccessControl: SimCloudFrontOriginAccessControl | undefined): void;
+//# sourceMappingURL=sim-cf-oac-origin-type.d.ts.map

package/dist/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-oac-origin-type.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC3C,MAAM,mCAAmC,CAAC;AAsB3C;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,0CAA0C,EACtD,mBAAmB,EAAE,gCAAgC,GAAG,SAAS,GAChE,IAAI,CAaN"}

package/dist/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.js

@@ -0,0 +1,37 @@
+import { SimCloudFrontInvalidOriginAccessControl } from "../error/sim-cloudfront.error.js";
+/**
+ * The Origin an origin type belongs on, as a refusal names it.
+ *
+ * An `s3` origin access control signs an S3 Bucket read, and a `lambda` one
+ * signs a request to a Lambda Function URL, which is reached over HTTP and so
+ * is a custom Origin.
+ */
+function originDescription(originType) {
+    switch (originType) {
+        case "s3": {
+            return "S3 Origin";
+        }
+        case "lambda": {
+            return "custom Origin";
+        }
+    }
+}
+/**
+ * Refuse an origin access control whose origin type is not the one the Origin
+ * it was named on needs.
+ *
+ * CloudFront refuses that pairing, and it is worth reproducing: an origin
+ * access control signing for an S3 Bucket signs nothing a Function URL will
+ * admit, so a template pairing them wrongly would otherwise deploy here and
+ * fail on the real deployment.
+ */
+export function assertSimCfOacOriginType(originId, originType, originAccessControl) {
+    if (originAccessControl === undefined ||
+        originAccessControl.originType === originType) {
+        return;
+    }
+    throw new SimCloudFrontInvalidOriginAccessControl(`Sim CloudFront ${originDescription(originType)} ${originId} names ` +
+        `origin access control ${originAccessControl.name}, whose origin type ` +
+        `is ${originAccessControl.originType} rather than ${originType}`);
+}
+//# sourceMappingURL=sim-cf-oac-origin-type.js.map

package/dist/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-oac-origin-type.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAM3F;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,UAAsD;IAEtD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,IAAI,EAAE,CAAC;YACV,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,OAAO,eAAe,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,UAAsD,EACtD,mBAAiE;IAEjE,IACE,mBAAmB,KAAK,SAAS;QACjC,mBAAmB,CAAC,UAAU,KAAK,UAAU,EAC7C,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uCAAuC,CAC/C,kBAAkB,iBAAiB,CAAC,UAAU,CAAC,IAAI,QAAQ,SAAS;QAClE,yBAAyB,mBAAmB,CAAC,IAAI,sBAAsB;QACvE,MAAM,mBAAmB,CAAC,UAAU,gBAAgB,UAAU,EAAE,CACnE,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.d.ts

@@ -8,24 +8,32 @@ export type SimCloudFrontOriginAccessControlId = Brand<string, "SimCloudFrontOri
  * viewer did not already sign, and passes a signed one through.
  */
 export type SimCloudFrontOriginAccessControlSigningBehavior = "always" | "never" | "no-override";
+/**
+ * The kind of Origin an origin access control signs for.
+ *
+ * CloudFront also signs for MediaStore and MediaPackage V2 Origins, neither of
+ * which is modelled, so neither is a value here.
+ */
+export type SimCloudFrontOriginAccessControlOriginType = "s3" | "lambda";
 interface SimCloudFrontOriginAccessControlProperties {
     readonly id?: SimCloudFrontOriginAccessControlId;
     readonly name: string;
     readonly description?: string;
+    readonly originType: SimCloudFrontOriginAccessControlOriginType;
     readonly signingBehavior: SimCloudFrontOriginAccessControlSigningBehavior;
 }
 /**
  * Simulated CloudFront origin access control.
  *
  * An origin access control is attached to an Origin, and it is how a
- * Distribution authenticates to a private S3 Bucket: CloudFront signs the
- * Origin request with SigV4 as the CloudFront service principal, and the Bucket
- * policy grants that principal on the Distribution's ARN.
+ * Distribution authenticates to a private Origin: CloudFront signs the Origin
+ * request with SigV4 as the CloudFront service principal, and the Origin's own
+ * policy grants that principal on the Distribution's ARN. For an S3 Origin that
+ * policy is the Bucket policy, and for a Lambda Function URL it is the
+ * function's resource policy.
  *
- * Only an `s3` origin type signed with `sigv4` is modelled, so those are fixed
- * here rather than stored. Anything else is refused where the origin access
- * control is read, rather than kept and treated as though it behaved like the
- * supported values.
+ * `sigv4` is the only protocol CloudFront offers, so it is fixed here rather
+ * than stored.
  *
  * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
  */
@@ -36,8 +44,12 @@ export declare class SimCloudFrontOriginAccessControl {
     readonly signingBehavior: SimCloudFrontOriginAccessControlSigningBehavior;
     /**
      * The kind of Origin this origin access control signs for.
+     *
+     * CloudFront refuses an origin access control attached to an Origin its
+     * origin type does not match, so this is checked where an Origin names one
+     * rather than only described here.
      */
-    readonly originType = "s3";
+    readonly originType: SimCloudFrontOriginAccessControlOriginType;
     /**
      * The protocol CloudFront signs the Origin request with.
      */

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-origin-access-control.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,MAAM,kCAAkC,GAAG,KAAK,CACpD,MAAM,EACN,oCAAoC,CACrC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+CAA+C,GACvD,QAAQ,GACR,OAAO,GACP,aAAa,CAAC;AAElB,UAAU,0CAA0C;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,kCAAkC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,+CAA+C,CAAC;CAC3E;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,EAAE,EAAE,kCAAkC,CAAC;IACvD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,eAAe,EAAE,+CAA+C,CAAC;IAEjF;;OAEG;IACH,SAAgB,UAAU,QAAQ;IAElC;;OAEG;IACH,SAAgB,eAAe,WAAW;IAE1C,YAAY,UAAU,EAAE,0CAA0C,EAKjE;IAED;;;;;OAKG;IACH,IAAI,KAAK,IAAI,OAAO,CAEnB;CACF;AAED,MAAM,MAAM,mCAAmC,GAAG,GAAG,CACnD,kCAAkC,EAClC,gCAAgC,CACjC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,kCAAkC,CAI9E"}
+{"version":3,"file":"sim-cf-origin-access-control.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,MAAM,kCAAkC,GAAG,KAAK,CACpD,MAAM,EACN,oCAAoC,CACrC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+CAA+C,GACvD,QAAQ,GACR,OAAO,GACP,aAAa,CAAC;AAElB;;;;;GAKG;AACH,MAAM,MAAM,0CAA0C,GAAG,IAAI,GAAG,QAAQ,CAAC;AAEzE,UAAU,0CAA0C;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,kCAAkC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0CAA0C,CAAC;IAChE,QAAQ,CAAC,eAAe,EAAE,+CAA+C,CAAC;CAC3E;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,EAAE,EAAE,kCAAkC,CAAC;IACvD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,eAAe,EAAE,+CAA+C,CAAC;IAEjF;;;;;;OAMG;IACH,SAAgB,UAAU,EAAE,0CAA0C,CAAC;IAEvE;;OAEG;IACH,SAAgB,eAAe,WAAW;IAE1C,YAAY,UAAU,EAAE,0CAA0C,EAMjE;IAED;;;;;OAKG;IACH,IAAI,KAAK,IAAI,OAAO,CAEnB;CACF;AAED,MAAM,MAAM,mCAAmC,GAAG,GAAG,CACnD,kCAAkC,EAClC,gCAAgC,CACjC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,kCAAkC,CAI9E"}

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.js

@@ -3,14 +3,14 @@ import { faker } from "@faker-js/faker";
  * Simulated CloudFront origin access control.
  *
  * An origin access control is attached to an Origin, and it is how a
- * Distribution authenticates to a private S3 Bucket: CloudFront signs the
- * Origin request with SigV4 as the CloudFront service principal, and the Bucket
- * policy grants that principal on the Distribution's ARN.
+ * Distribution authenticates to a private Origin: CloudFront signs the Origin
+ * request with SigV4 as the CloudFront service principal, and the Origin's own
+ * policy grants that principal on the Distribution's ARN. For an S3 Origin that
+ * policy is the Bucket policy, and for a Lambda Function URL it is the
+ * function's resource policy.
  *
- * Only an `s3` origin type signed with `sigv4` is modelled, so those are fixed
- * here rather than stored. Anything else is refused where the origin access
- * control is read, rather than kept and treated as though it behaved like the
- * supported values.
+ * `sigv4` is the only protocol CloudFront offers, so it is fixed here rather
+ * than stored.
  *
  * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
  */
@@ -21,8 +21,12 @@ export class SimCloudFrontOriginAccessControl {
     signingBehavior;
     /**
      * The kind of Origin this origin access control signs for.
+     *
+     * CloudFront refuses an origin access control attached to an Origin its
+     * origin type does not match, so this is checked where an Origin names one
+     * rather than only described here.
      */
-    originType = "s3";
+    originType;
     /**
      * The protocol CloudFront signs the Origin request with.
      */
@@ -31,6 +35,7 @@ export class SimCloudFrontOriginAccessControl {
         this.id = properties.id ?? makeOriginAccessControlId();
         this.name = properties.name;
         this.description = properties.description;
+        this.originType = properties.originType;
         this.signingBehavior = properties.signingBehavior;
     }
     /**

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-origin-access-control.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AA4BxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAgC;IAC3B,EAAE,CAAqC;IACvC,IAAI,CAAS;IACb,WAAW,CAAqB;IAChC,eAAe,CAAkD;IAEjF;;OAEG;IACa,UAAU,GAAG,IAAI,CAAC;IAElC;;OAEG;IACa,eAAe,GAAG,OAAO,CAAC;IAE1C,YAAY,UAAsD;QAChE,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,yBAAyB,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC;IAC1C,CAAC;CACF;AAOD;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAC7B,eAAe,CACsB,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"sim-cf-origin-access-control.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAqCxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAgC;IAC3B,EAAE,CAAqC;IACvC,IAAI,CAAS;IACb,WAAW,CAAqB;IAChC,eAAe,CAAkD;IAEjF;;;;;;OAMG;IACa,UAAU,CAA6C;IAEvE;;OAEG;IACa,eAAe,GAAG,OAAO,CAAC;IAE1C,YAAY,UAAsD;QAChE,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,yBAAyB,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC;IAC1C,CAAC;CACF;AAOD;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAC7B,eAAe,CACsB,CAAC;AAC1C,CAAC"}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.d.ts

@@ -0,0 +1,43 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimEcrRepository } from "../../repository/sim-ecr-repository.js";
+import type { SimEcr } from "../../sim-ecr.js";
+interface SimCfnEcrRepositoryCreatorProperties {
+    readonly ecr: SimEcr;
+}
+/**
+ * Creates simulated repositories from AWS::ECR::Repository Resources.
+ *
+ * A template declares a repository and never an image, which is what real
+ * CloudFormation does too: an image is pushed by whatever built it, long
+ * before any stack that runs it is deployed. So a deployed repository starts
+ * empty unless a test has already registered a handler as its image, and it
+ * keeps that handler if it has, since the repository outlives the stack.
+ */
+export declare class SimCfnEcrRepositoryCreator {
+    private readonly ecr;
+    constructor(properties: SimCfnEcrRepositoryCreatorProperties);
+    /**
+     * Create a repository from an AWS::ECR::Repository Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimEcrRepository;
+    /**
+     * Delete a repository created from an AWS::ECR::Repository Resource.
+     *
+     * A repository holding a simulated image is left where it is, and the
+     * deletion is recorded as skipped. The image is a handler registered outside
+     * any stack, usually in test setup, and it is the whole reason the
+     * repository is the place to say what an image is: it outlives the stack
+     * that declared it. Taking it down with one stack would leave the next
+     * deploy resolving nothing.
+     *
+     * Real ECR refuses to delete a repository that still holds images too,
+     * which fails the stack unless the template says `EmptyOnDelete`. This
+     * records the refusal rather than failing the teardown, because what is
+     * being protected here is a test's own registration rather than anything
+     * CloudFormation put there.
+     */
+    delete(resource: SimCfnResource, repository: SimEcrRepository): void;
+}
+export {};
+//# sourceMappingURL=sim-cfn-ecr-repository-creator.d.ts.map

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-ecr-repository-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,gBAAgB,CAUlB;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAWnE;CACF"}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.js

@@ -0,0 +1,54 @@
+import { SimCfnEcrRepositoryProperties } from "./sim-cfn-ecr-repository-properties.js";
+/**
+ * Creates simulated repositories from AWS::ECR::Repository Resources.
+ *
+ * A template declares a repository and never an image, which is what real
+ * CloudFormation does too: an image is pushed by whatever built it, long
+ * before any stack that runs it is deployed. So a deployed repository starts
+ * empty unless a test has already registered a handler as its image, and it
+ * keeps that handler if it has, since the repository outlives the stack.
+ */
+export class SimCfnEcrRepositoryCreator {
+    ecr;
+    constructor(properties) {
+        this.ecr = properties.ecr;
+    }
+    /**
+     * Create a repository from an AWS::ECR::Repository Resource.
+     */
+    create(resource, properties) {
+        const repositoryProperties = new SimCfnEcrRepositoryProperties({
+            resource,
+            properties,
+        });
+        const repositoryName = repositoryProperties.repositoryName();
+        repositoryProperties.recordIgnoredProperties();
+        return this.ecr.repository(repositoryName);
+    }
+    /**
+     * Delete a repository created from an AWS::ECR::Repository Resource.
+     *
+     * A repository holding a simulated image is left where it is, and the
+     * deletion is recorded as skipped. The image is a handler registered outside
+     * any stack, usually in test setup, and it is the whole reason the
+     * repository is the place to say what an image is: it outlives the stack
+     * that declared it. Taking it down with one stack would leave the next
+     * deploy resolving nothing.
+     *
+     * Real ECR refuses to delete a repository that still holds images too,
+     * which fails the stack unless the template says `EmptyOnDelete`. This
+     * records the refusal rather than failing the teardown, because what is
+     * being protected here is a test's own registration rather than anything
+     * CloudFormation put there.
+     */
+    delete(resource, repository) {
+        if (repository.hasImage) {
+            throw new Error(`Unsupported sim ECR CloudFormation Resource ${resource.logicalId} ` +
+                `deletion: the simulated ECR repository ` +
+                `${repository.repositoryName} holds a simulated image, which ` +
+                `outlives the Stack that declared the repository`);
+        }
+        this.ecr.deleteRepository(repository.repositoryName);
+    }
+}
+//# sourceMappingURL=sim-cfn-ecr-repository-creator.js.map

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-ecr-repository-creator.js","sourceRoot":"","sources":["../../../../../src/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAMvF;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA0B;IACpB,GAAG,CAAS;IAE7B,YAAY,UAAgD;QAC1D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,QAAwB,EACxB,UAAqC;QAErC,MAAM,oBAAoB,GAAG,IAAI,6BAA6B,CAAC;YAC7D,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,oBAAoB,CAAC,cAAc,EAAE,CAAC;QAE7D,oBAAoB,CAAC,uBAAuB,EAAE,CAAC;QAE/C,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,QAAwB,EAAE,UAA4B;QAC3D,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,CAAC,SAAS,GAAG;gBAClE,yCAAyC;gBACzC,GAAG,UAAU,CAAC,cAAc,kCAAkC;gBAC9D,iDAAiD,CACpD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-name.d.ts

@@ -0,0 +1,22 @@
+interface SimCfnEcrRepositoryNameProperties {
+    readonly stackName: string | undefined;
+    readonly logicalId: string;
+}
+/**
+ * The name CloudFormation gives a repository whose template does not name it.
+ *
+ * A repository name is at most 256 characters, so a long stack name and
+ * logical ID together are trimmed to fit, the same way every other service's
+ * generated name is. It is lower cased because ECR repository names are, and a
+ * logical ID is usually not.
+ */
+export declare class SimCfnEcrRepositoryName {
+    private readonly generated;
+    constructor(properties: SimCfnEcrRepositoryNameProperties);
+    /**
+     * The generated repository name.
+     */
+    get value(): string;
+}
+export {};
+//# sourceMappingURL=sim-cfn-ecr-repository-name.d.ts.map

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-ecr-repository-name.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecr/cfn/repository/sim-cfn-ecr-repository-name.ts"],"names":[],"mappings":"AAIA,UAAU,iCAAiC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;IAExD,YAAY,UAAU,EAAE,iCAAiC,EAMxD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,MAAM,CAElB;CACF"}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-name.js

@@ -0,0 +1,27 @@
+import { SimCfnGeneratedResourceName } from "../../../cloudformation/resource/name/sim-cfn-generated-resource-name.js";
+const maximumNameLength = 256;
+/**
+ * The name CloudFormation gives a repository whose template does not name it.
+ *
+ * A repository name is at most 256 characters, so a long stack name and
+ * logical ID together are trimmed to fit, the same way every other service's
+ * generated name is. It is lower cased because ECR repository names are, and a
+ * logical ID is usually not.
+ */
+export class SimCfnEcrRepositoryName {
+    generated;
+    constructor(properties) {
+        this.generated = new SimCfnGeneratedResourceName({
+            stackName: properties.stackName,
+            logicalId: properties.logicalId,
+            maximumLength: maximumNameLength,
+        });
+    }
+    /**
+     * The generated repository name.
+     */
+    get value() {
+        return this.generated.value.toLowerCase();
+    }
+}
+//# sourceMappingURL=sim-cfn-ecr-repository-name.js.map

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-ecr-repository-name.js","sourceRoot":"","sources":["../../../../../src/service/ecr/cfn/repository/sim-cfn-ecr-repository-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,0EAA0E,CAAC;AAEvH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAO9B;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,SAAS,CAA8B;IAExD,YAAY,UAA6C;QACvD,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-properties.d.ts

@@ -0,0 +1,36 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * A refusal naming the Resource whose properties could not be read.
+ */
+export declare function ecrRepositoryPropertyError(logicalId: string, reason: string): Error;
+interface SimCfnEcrRepositoryPropertiesProperties {
+    readonly resource: SimCfnResource;
+    readonly properties: SimCfnTemplateValueRecord;
+}
+/**
+ * Reads AWS::ECR::Repository CloudFormation properties.
+ *
+ * A repository declares only a name that this simulation acts on. Everything
+ * else a template can put on one describes image content, which nothing here
+ * reads, so it is recorded as ignored by the property rules.
+ */
+export declare class SimCfnEcrRepositoryProperties {
+    private readonly resource;
+    private readonly properties;
+    private readonly rules;
+    constructor(properties: SimCfnEcrRepositoryPropertiesProperties);
+    /**
+     * The repository name.
+     *
+     * An unnamed repository is named after the stack and the logical ID, as real
+     * CloudFormation names one.
+     */
+    repositoryName(): string;
+    /**
+     * Record the properties the repository is created without acting on.
+     */
+    recordIgnoredProperties(): void;
+}
+export {};
+//# sourceMappingURL=sim-cfn-ecr-repository-properties.d.ts.map

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-ecr-repository-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecr/cfn/repository/sim-cfn-ecr-repository-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAIlH;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,KAAK,CAIP;AAED,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;GAMG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IAEzD,YAAY,UAAU,EAAE,uCAAuC,EAO9D;IAED;;;;;OAKG;IACH,cAAc,IAAI,MAAM,CAkBvB;IAED;;OAEG;IACH,uBAAuB,IAAI,IAAI,CAE9B;CACF"}