@kensio/yulin 1.13.0 → 1.14.0

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-custom-origin-signer.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAE9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAG1F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,uBAAuB;IACjB,mBAAmB,CAEtB;IAEd,YAAY,mBAAsD;QAChE,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,OAAmC;QAC5C,IAAI,IAAI,CAAC,mBAAmB,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAChD,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,6BAA6B;aACvC,CAAC;YACF,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CACvD,OAAO,CAAC,YAAY,CACrB;YACD,CAAC,6BAA6B,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS;SAChE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.d.ts

@@ -0,0 +1,43 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+/**
+ * What a test asks for when it wants the template CDK synthesizes for
+ * `origins.FunctionUrlOrigin.withOriginAccessControl()`.
+ *
+ * Five Resources stand between a test and a Function URL served through a
+ * Distribution, and each test about that shape is about one of them being
+ * wrong, so each field here is one thing a template can get wrong on its own.
+ */
+export interface SimCfFunctionUrlOriginTemplateInput {
+    /** How the origin access control signs, which is `always` in what CDK emits. */
+    readonly signingBehavior: string;
+    /**
+     * Whether the Origin has an origin access control at all, since an Origin
+     * without one is reached anonymously.
+     */
+    readonly originAccessControl: boolean;
+    /**
+     * Whether the template grants CloudFront the Function URL, which CDK always
+     * does alongside the Distribution.
+     */
+    readonly permitted: boolean;
+    /** The Distribution the permission is granted for. */
+    readonly permissionSourceArn: SimCfnTemplateValue;
+}
+/**
+ * The parts of the template a template can leave out.
+ *
+ * Each is a Resource, or a property of one, that CDK always writes and that a
+ * hand-written template can forget. The origin access control contributes two,
+ * which are both there or both absent, since an Origin naming one nothing
+ * created would be refused rather than reached.
+ */
+export interface SimCfFunctionUrlOriginParts {
+    readonly originAccessControl: SimCfnTemplateValueRecord;
+    readonly originAccessControlId: SimCfnTemplateValueRecord;
+    readonly invokePermission: SimCfnTemplateValueRecord;
+}
+/**
+ * Build the optional parts of a Function URL Origin template.
+ */
+export declare function simCfFunctionUrlOriginParts(input: SimCfFunctionUrlOriginTemplateInput): SimCfFunctionUrlOriginParts;
+//# sourceMappingURL=sim-cf-function-url-origin-fragments.d.ts.map

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-function-url-origin-fragments.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,kEAAkE,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,mCAAmC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;IACxD,QAAQ,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;CACtD;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mCAAmC,GACzC,2BAA2B,CAgC7B"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.js

@@ -0,0 +1,46 @@
+/**
+ * Build the optional parts of a Function URL Origin template.
+ */
+export function simCfFunctionUrlOriginParts(input) {
+    return {
+        originAccessControl: included(input.originAccessControl, {
+            SiteOac: {
+                Type: "AWS::CloudFront::OriginAccessControl",
+                Properties: {
+                    OriginAccessControlConfig: {
+                        Name: "site-oac",
+                        OriginAccessControlOriginType: "lambda",
+                        SigningBehavior: input.signingBehavior,
+                        SigningProtocol: "sigv4",
+                    },
+                },
+            },
+        }),
+        originAccessControlId: included(input.originAccessControl, {
+            OriginAccessControlId: { Ref: "SiteOac" },
+        }),
+        // The permission CDK writes beside the Distribution, letting CloudFront
+        // invoke the Function URL for that Distribution alone.
+        invokePermission: included(input.permitted, {
+            InvokeFromCloudFront: {
+                Type: "AWS::Lambda::Permission",
+                Properties: {
+                    FunctionName: { "Fn::GetAtt": ["GreeterFunction", "Arn"] },
+                    Action: "lambda:InvokeFunctionUrl",
+                    Principal: "cloudfront.amazonaws.com",
+                    SourceArn: input.permissionSourceArn,
+                },
+            },
+        }),
+    };
+}
+/**
+ * One fragment of the template, or nothing where the template omits it.
+ */
+function included(present, fragment) {
+    if (!present) {
+        return {};
+    }
+    return fragment;
+}
+//# sourceMappingURL=sim-cf-function-url-origin-fragments.js.map

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-function-url-origin-fragments.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.ts"],"names":[],"mappings":"AA4CA;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAA0C;IAE1C,OAAO;QACL,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACvD,OAAO,EAAE;gBACP,IAAI,EAAE,sCAAsC;gBAC5C,UAAU,EAAE;oBACV,yBAAyB,EAAE;wBACzB,IAAI,EAAE,UAAU;wBAChB,6BAA6B,EAAE,QAAQ;wBACvC,eAAe,EAAE,KAAK,CAAC,eAAe;wBACtC,eAAe,EAAE,OAAO;qBACzB;iBACF;aACF;SACF,CAAC;QACF,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACzD,qBAAqB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAC1C,CAAC;QACF,wEAAwE;QACxE,uDAAuD;QACvD,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1C,oBAAoB,EAAE;gBACpB,IAAI,EAAE,yBAAyB;gBAC/B,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;oBAC1D,MAAM,EAAE,0BAA0B;oBAClC,SAAS,EAAE,0BAA0B;oBACrC,SAAS,EAAE,KAAK,CAAC,mBAAmB;iBACrC;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CACf,OAAgB,EAChB,QAAmC;IAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.d.ts

@@ -0,0 +1,25 @@
+import { MappedFactory } from "@kensio/part-factory";
+import type { CfnTemplateBodyRecord } from "../../../cloudformation/template/sim-cfn-template.js";
+import type { SimCfnTemplateValue } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import { type SimCfFunctionUrlOriginTemplateInput } from "./sim-cf-function-url-origin-fragments.js";
+/**
+ * The ARN of the Distribution the template creates, written the way CDK writes
+ * it.
+ */
+export declare const simCfDistributionArn: SimCfnTemplateValue;
+/**
+ * Builds the template for a Lambda Function URL served through a Distribution
+ * with an origin access control.
+ *
+ * ```typescript
+ * const stack = await simAws.cloudFormation().deployTemplate({
+ *   stackName: "site-stack",
+ *   template: simCfFunctionUrlOriginTemplateFactory.make({ permitted: false }),
+ * });
+ * ```
+ *
+ * The Function URL authorizes with `AWS_IAM`, which is the whole point of the
+ * shape: the endpoint exists, and only the Distribution may use it.
+ */
+export declare const simCfFunctionUrlOriginTemplateFactory: MappedFactory<SimCfFunctionUrlOriginTemplateInput, CfnTemplateBodyRecord, undefined>;
+//# sourceMappingURL=sim-cf-function-url-origin-template.factory.d.ts.map

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-function-url-origin-template.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,2CAA2C,CAAC;AAanD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,mBAUlC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,sFAkFjD,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.js

@@ -0,0 +1,118 @@
+import { MappedFactory } from "@kensio/part-factory";
+import { simCfFunctionUrlOriginParts, } from "./sim-cf-function-url-origin-fragments.js";
+const assumeRolePolicyDocument = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "lambda.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};
+/**
+ * The ARN of the Distribution the template creates, written the way CDK writes
+ * it.
+ */
+export const simCfDistributionArn = {
+    "Fn::Join": [
+        "",
+        [
+            "arn:aws:cloudfront::",
+            { Ref: "AWS::AccountId" },
+            ":distribution/",
+            { Ref: "SiteDistribution" },
+        ],
+    ],
+};
+/**
+ * Builds the template for a Lambda Function URL served through a Distribution
+ * with an origin access control.
+ *
+ * ```typescript
+ * const stack = await simAws.cloudFormation().deployTemplate({
+ *   stackName: "site-stack",
+ *   template: simCfFunctionUrlOriginTemplateFactory.make({ permitted: false }),
+ * });
+ * ```
+ *
+ * The Function URL authorizes with `AWS_IAM`, which is the whole point of the
+ * shape: the endpoint exists, and only the Distribution may use it.
+ */
+export const simCfFunctionUrlOriginTemplateFactory = new MappedFactory(() => ({
+    signingBehavior: "always",
+    originAccessControl: true,
+    permitted: true,
+    permissionSourceArn: simCfDistributionArn,
+}), (input) => ({
+    Resources: {
+        GreeterRole: {
+            Type: "AWS::IAM::Role",
+            Properties: {
+                RoleName: "GreeterRole",
+                AssumeRolePolicyDocument: assumeRolePolicyDocument,
+            },
+        },
+        GreeterFunction: {
+            Type: "AWS::Lambda::Function",
+            Properties: {
+                FunctionName: "greeter",
+                Role: { "Fn::GetAtt": ["GreeterRole", "Arn"] },
+                Code: {
+                    ZipFile: "exports.handler = async () => " +
+                        "({ statusCode: 200, body: 'Hello from behind CloudFront' });",
+                },
+                Handler: "index.handler",
+                Runtime: "nodejs22.x",
+            },
+        },
+        GreeterUrl: {
+            Type: "AWS::Lambda::Url",
+            Properties: {
+                TargetFunctionArn: { "Fn::GetAtt": ["GreeterFunction", "Arn"] },
+                AuthType: "AWS_IAM",
+            },
+        },
+        ...simCfFunctionUrlOriginParts(input).originAccessControl,
+        SiteDistribution: {
+            Type: "AWS::CloudFront::Distribution",
+            Properties: {
+                DistributionConfig: {
+                    Enabled: true,
+                    Origins: [
+                        {
+                            Id: "FunctionUrlOrigin",
+                            // The Function URL endpoint is a URL, and an Origin takes a
+                            // domain name, so CDK splits the host out of it.
+                            DomainName: {
+                                "Fn::Select": [
+                                    2,
+                                    {
+                                        "Fn::Split": [
+                                            "/",
+                                            { "Fn::GetAtt": ["GreeterUrl", "FunctionUrl"] },
+                                        ],
+                                    },
+                                ],
+                            },
+                            CustomOriginConfig: { OriginProtocolPolicy: "https-only" },
+                            ...simCfFunctionUrlOriginParts(input).originAccessControlId,
+                        },
+                    ],
+                    DefaultCacheBehavior: {
+                        TargetOriginId: "FunctionUrlOrigin",
+                        ViewerProtocolPolicy: "redirect-to-https",
+                    },
+                },
+            },
+        },
+        ...simCfFunctionUrlOriginParts(input).invokePermission,
+    },
+    Outputs: {
+        DistributionDomainName: {
+            Value: { "Fn::GetAtt": ["SiteDistribution", "DomainName"] },
+        },
+        DistributionArn: { Value: simCfDistributionArn },
+    },
+}));
+//# sourceMappingURL=sim-cf-function-url-origin-template.factory.js.map

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-function-url-origin-template.factory.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAEL,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,MAAM,wBAAwB,GAAG;IAC/B,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT;YACE,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;YAC9C,MAAM,EAAE,gBAAgB;SACzB;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,UAAU,EAAE;QACV,EAAE;QACF;YACE,sBAAsB;YACtB,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACzB,gBAAgB;YAChB,EAAE,GAAG,EAAE,kBAAkB,EAAE;SAC5B;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,aAAa,CAIpE,GAAG,EAAE,CAAC,CAAC;IACL,eAAe,EAAE,QAAQ;IACzB,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,IAAI;IACf,mBAAmB,EAAE,oBAAoB;CAC1C,CAAC,EACF,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,SAAS,EAAE;QACT,WAAW,EAAE;YACX,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE;gBACV,QAAQ,EAAE,aAAa;gBACvB,wBAAwB,EAAE,wBAAwB;aACnD;SACF;QACD,eAAe,EAAE;YACf,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE;gBACV,YAAY,EAAE,SAAS;gBACvB,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE;gBAC9C,IAAI,EAAE;oBACJ,OAAO,EACL,gCAAgC;wBAChC,8DAA8D;iBACjE;gBACD,OAAO,EAAE,eAAe;gBACxB,OAAO,EAAE,YAAY;aACtB;SACF;QACD,UAAU,EAAE;YACV,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE;gBACV,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;gBAC/D,QAAQ,EAAE,SAAS;aACpB;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,mBAAmB;QACzD,gBAAgB,EAAE;YAChB,IAAI,EAAE,+BAA+B;YACrC,UAAU,EAAE;gBACV,kBAAkB,EAAE;oBAClB,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,EAAE,EAAE,mBAAmB;4BACvB,4DAA4D;4BAC5D,iDAAiD;4BACjD,UAAU,EAAE;gCACV,YAAY,EAAE;oCACZ,CAAC;oCACD;wCACE,WAAW,EAAE;4CACX,GAAG;4CACH,EAAE,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;yCAChD;qCACF;iCACF;6BACF;4BACD,kBAAkB,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE;4BAC1D,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,qBAAqB;yBAC5D;qBACF;oBACD,oBAAoB,EAAE;wBACpB,cAAc,EAAE,mBAAmB;wBACnC,oBAAoB,EAAE,mBAAmB;qBAC1C;iBACF;aACF;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,gBAAgB;KACvD;IACD,OAAO,EAAE;QACP,sBAAsB,EAAE;YACtB,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;SAC5D;QACD,eAAe,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;KACjD;CACF,CAAC,CACH,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.d.ts

@@ -1,3 +1,4 @@
+import type { SimCloudFrontOriginAccessControl } from "../../origin-access-control/sim-cf-origin-access-control.js";
 import type { SimCloudFrontOrigin } from "../sim-cloudfront-origin.js";
 import type { SimCloudFrontOriginRequest } from "../sim-cloudfront-request-response.js";
 import type { SimCfCustomOriginDispatcher } from "./sim-cf-custom-origin-dispatcher.js";
@@ -6,6 +7,7 @@ interface SimCloudFrontCustomOriginProperties {
     readonly domainName: string;
     readonly originPath?: string | undefined;
     readonly dispatcher: SimCfCustomOriginDispatcher;
+    readonly originAccessControl?: SimCloudFrontOriginAccessControl | undefined;
 }
 /**
  * Simulated CloudFront custom Origin.
@@ -15,15 +17,22 @@ interface SimCloudFrontCustomOriginProperties {
  * with an endpoint of its own: an HTTP API or a Lambda Function URL, or
  * anything a simulated Route53 record points at one of those.
  *
- * The Origin is reached anonymously, as CloudFront reaches an Origin it has no
- * Origin Access Control for, so a Function URL or route that authorizes with
- * `AWS_IAM` refuses the request.
+ * An Origin with no origin access control is reached anonymously, as CloudFront
+ * reaches one it has nothing to sign for, so a Function URL or route that
+ * authorizes with `AWS_IAM` refuses the request. One whose origin access
+ * control signs is reached as the CloudFront service principal instead, which
+ * is what a Function URL behind an origin access control admits.
  */
 export declare class SimCloudFrontCustomOrigin implements SimCloudFrontOrigin {
+    /**
+     * The origin access control this Origin was created with, if any.
+     */
+    readonly originAccessControl: SimCloudFrontOriginAccessControl | undefined;
     private readonly originId;
     private readonly domainName;
     private readonly originPath;
     private readonly dispatcher;
+    private readonly signer;
     constructor(properties: SimCloudFrontCustomOriginProperties);
     /**
      * Fetch the request from the simulated service behind this Origin.

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-custom-origin.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAGxF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;CAClD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAEzD,YAAY,UAAU,EAAE,mCAAmC,EAK1D;IAED;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgBlE;CACF"}
+{"version":3,"file":"sim-cloudfront-custom-origin.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAC;AACpH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAIxF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;CAC7E;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB;IACnE;;OAEG;IACH,SAAgB,mBAAmB,EAC/B,gCAAgC,GAChC,SAAS,CAAC;IAEd,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,YAAY,UAAU,EAAE,mCAAmC,EAO1D;IAED;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiBlE;CACF"}

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.js

@@ -1,4 +1,5 @@
 import { simCfCustomOriginRequest } from "./sim-cf-custom-origin-request.js";
+import { SimCfCustomOriginSigner } from "./sim-cf-custom-origin-signer.js";
 /**
  * Simulated CloudFront custom Origin.
  *
@@ -7,20 +8,29 @@ import { simCfCustomOriginRequest } from "./sim-cf-custom-origin-request.js";
  * with an endpoint of its own: an HTTP API or a Lambda Function URL, or
  * anything a simulated Route53 record points at one of those.
  *
- * The Origin is reached anonymously, as CloudFront reaches an Origin it has no
- * Origin Access Control for, so a Function URL or route that authorizes with
- * `AWS_IAM` refuses the request.
+ * An Origin with no origin access control is reached anonymously, as CloudFront
+ * reaches one it has nothing to sign for, so a Function URL or route that
+ * authorizes with `AWS_IAM` refuses the request. One whose origin access
+ * control signs is reached as the CloudFront service principal instead, which
+ * is what a Function URL behind an origin access control admits.
  */
 export class SimCloudFrontCustomOrigin {
+    /**
+     * The origin access control this Origin was created with, if any.
+     */
+    originAccessControl;
     originId;
     domainName;
     originPath;
     dispatcher;
+    signer;
     constructor(properties) {
         this.originId = properties.originId;
         this.domainName = properties.domainName;
         this.originPath = properties.originPath ?? "";
         this.dispatcher = properties.dispatcher;
+        this.originAccessControl = properties.originAccessControl;
+        this.signer = new SimCfCustomOriginSigner(properties.originAccessControl);
     }
     /**
      * Fetch the request from the simulated service behind this Origin.
@@ -34,6 +44,7 @@ export class SimCloudFrontCustomOrigin {
             domainName: this.domainName,
             originPath: this.originPath,
             request: request.req,
+            signingHeaders: this.signer.forRequest(request),
         });
         const { hostname } = new URL(originRequest.url);
         if (!this.dispatcher.resolves(hostname)) {

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-custom-origin.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAS7E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yBAAyB;IACnB,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,UAAU,CAA8B;IAEzD,YAAY,UAA+C;QACzD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAAmC;QAC7C,MAAM,aAAa,GAAG,wBAAwB,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,OAAO,CAAC,GAAG;SACrB,CAAC,CAAC;QAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,QAAQ,gBAAgB,IAAI,CAAC,UAAU,8CAA8C,CACpH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"sim-cloudfront-custom-origin.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAU3E;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACa,mBAAmB,CAErB;IAEG,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,UAAU,CAA8B;IACxC,MAAM,CAA0B;IAEjD,YAAY,UAA+C;QACzD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAAmC;QAC7C,MAAM,aAAa,GAAG,wBAAwB,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,QAAQ,gBAAgB,IAAI,CAAC,UAAU,8CAA8C,CACpH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.d.ts

@@ -0,0 +1,12 @@
+import type { SimCloudFrontOriginAccessControl, SimCloudFrontOriginAccessControlOriginType } from "./sim-cf-origin-access-control.js";
+/**
+ * Refuse an origin access control whose origin type is not the one the Origin
+ * it was named on needs.
+ *
+ * CloudFront refuses that pairing, and it is worth reproducing: an origin
+ * access control signing for an S3 Bucket signs nothing a Function URL will
+ * admit, so a template pairing them wrongly would otherwise deploy here and
+ * fail on the real deployment.
+ */
+export declare function assertSimCfOacOriginType(originId: string, originType: SimCloudFrontOriginAccessControlOriginType, originAccessControl: SimCloudFrontOriginAccessControl | undefined): void;
+//# sourceMappingURL=sim-cf-oac-origin-type.d.ts.map

package/dist/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-oac-origin-type.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC3C,MAAM,mCAAmC,CAAC;AAsB3C;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,0CAA0C,EACtD,mBAAmB,EAAE,gCAAgC,GAAG,SAAS,GAChE,IAAI,CAaN"}

package/dist/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.js

@@ -0,0 +1,37 @@
+import { SimCloudFrontInvalidOriginAccessControl } from "../error/sim-cloudfront.error.js";
+/**
+ * The Origin an origin type belongs on, as a refusal names it.
+ *
+ * An `s3` origin access control signs an S3 Bucket read, and a `lambda` one
+ * signs a request to a Lambda Function URL, which is reached over HTTP and so
+ * is a custom Origin.
+ */
+function originDescription(originType) {
+    switch (originType) {
+        case "s3": {
+            return "S3 Origin";
+        }
+        case "lambda": {
+            return "custom Origin";
+        }
+    }
+}
+/**
+ * Refuse an origin access control whose origin type is not the one the Origin
+ * it was named on needs.
+ *
+ * CloudFront refuses that pairing, and it is worth reproducing: an origin
+ * access control signing for an S3 Bucket signs nothing a Function URL will
+ * admit, so a template pairing them wrongly would otherwise deploy here and
+ * fail on the real deployment.
+ */
+export function assertSimCfOacOriginType(originId, originType, originAccessControl) {
+    if (originAccessControl === undefined ||
+        originAccessControl.originType === originType) {
+        return;
+    }
+    throw new SimCloudFrontInvalidOriginAccessControl(`Sim CloudFront ${originDescription(originType)} ${originId} names ` +
+        `origin access control ${originAccessControl.name}, whose origin type ` +
+        `is ${originAccessControl.originType} rather than ${originType}`);
+}
+//# sourceMappingURL=sim-cf-oac-origin-type.js.map

package/dist/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-oac-origin-type.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-oac-origin-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAM3F;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,UAAsD;IAEtD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,IAAI,EAAE,CAAC;YACV,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,OAAO,eAAe,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,UAAsD,EACtD,mBAAiE;IAEjE,IACE,mBAAmB,KAAK,SAAS;QACjC,mBAAmB,CAAC,UAAU,KAAK,UAAU,EAC7C,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uCAAuC,CAC/C,kBAAkB,iBAAiB,CAAC,UAAU,CAAC,IAAI,QAAQ,SAAS;QAClE,yBAAyB,mBAAmB,CAAC,IAAI,sBAAsB;QACvE,MAAM,mBAAmB,CAAC,UAAU,gBAAgB,UAAU,EAAE,CACnE,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.d.ts

@@ -8,24 +8,32 @@ export type SimCloudFrontOriginAccessControlId = Brand<string, "SimCloudFrontOri
  * viewer did not already sign, and passes a signed one through.
  */
 export type SimCloudFrontOriginAccessControlSigningBehavior = "always" | "never" | "no-override";
+/**
+ * The kind of Origin an origin access control signs for.
+ *
+ * CloudFront also signs for MediaStore and MediaPackage V2 Origins, neither of
+ * which is modelled, so neither is a value here.
+ */
+export type SimCloudFrontOriginAccessControlOriginType = "s3" | "lambda";
 interface SimCloudFrontOriginAccessControlProperties {
     readonly id?: SimCloudFrontOriginAccessControlId;
     readonly name: string;
     readonly description?: string;
+    readonly originType: SimCloudFrontOriginAccessControlOriginType;
     readonly signingBehavior: SimCloudFrontOriginAccessControlSigningBehavior;
 }
 /**
  * Simulated CloudFront origin access control.
  *
  * An origin access control is attached to an Origin, and it is how a
- * Distribution authenticates to a private S3 Bucket: CloudFront signs the
- * Origin request with SigV4 as the CloudFront service principal, and the Bucket
- * policy grants that principal on the Distribution's ARN.
+ * Distribution authenticates to a private Origin: CloudFront signs the Origin
+ * request with SigV4 as the CloudFront service principal, and the Origin's own
+ * policy grants that principal on the Distribution's ARN. For an S3 Origin that
+ * policy is the Bucket policy, and for a Lambda Function URL it is the
+ * function's resource policy.
  *
- * Only an `s3` origin type signed with `sigv4` is modelled, so those are fixed
- * here rather than stored. Anything else is refused where the origin access
- * control is read, rather than kept and treated as though it behaved like the
- * supported values.
+ * `sigv4` is the only protocol CloudFront offers, so it is fixed here rather
+ * than stored.
  *
  * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
  */
@@ -36,8 +44,12 @@ export declare class SimCloudFrontOriginAccessControl {
     readonly signingBehavior: SimCloudFrontOriginAccessControlSigningBehavior;
     /**
      * The kind of Origin this origin access control signs for.
+     *
+     * CloudFront refuses an origin access control attached to an Origin its
+     * origin type does not match, so this is checked where an Origin names one
+     * rather than only described here.
      */
-    readonly originType = "s3";
+    readonly originType: SimCloudFrontOriginAccessControlOriginType;
     /**
      * The protocol CloudFront signs the Origin request with.
      */

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-origin-access-control.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,MAAM,kCAAkC,GAAG,KAAK,CACpD,MAAM,EACN,oCAAoC,CACrC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+CAA+C,GACvD,QAAQ,GACR,OAAO,GACP,aAAa,CAAC;AAElB,UAAU,0CAA0C;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,kCAAkC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,+CAA+C,CAAC;CAC3E;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,EAAE,EAAE,kCAAkC,CAAC;IACvD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,eAAe,EAAE,+CAA+C,CAAC;IAEjF;;OAEG;IACH,SAAgB,UAAU,QAAQ;IAElC;;OAEG;IACH,SAAgB,eAAe,WAAW;IAE1C,YAAY,UAAU,EAAE,0CAA0C,EAKjE;IAED;;;;;OAKG;IACH,IAAI,KAAK,IAAI,OAAO,CAEnB;CACF;AAED,MAAM,MAAM,mCAAmC,GAAG,GAAG,CACnD,kCAAkC,EAClC,gCAAgC,CACjC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,kCAAkC,CAI9E"}
+{"version":3,"file":"sim-cf-origin-access-control.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,MAAM,kCAAkC,GAAG,KAAK,CACpD,MAAM,EACN,oCAAoC,CACrC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+CAA+C,GACvD,QAAQ,GACR,OAAO,GACP,aAAa,CAAC;AAElB;;;;;GAKG;AACH,MAAM,MAAM,0CAA0C,GAAG,IAAI,GAAG,QAAQ,CAAC;AAEzE,UAAU,0CAA0C;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,kCAAkC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0CAA0C,CAAC;IAChE,QAAQ,CAAC,eAAe,EAAE,+CAA+C,CAAC;CAC3E;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,EAAE,EAAE,kCAAkC,CAAC;IACvD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,eAAe,EAAE,+CAA+C,CAAC;IAEjF;;;;;;OAMG;IACH,SAAgB,UAAU,EAAE,0CAA0C,CAAC;IAEvE;;OAEG;IACH,SAAgB,eAAe,WAAW;IAE1C,YAAY,UAAU,EAAE,0CAA0C,EAMjE;IAED;;;;;OAKG;IACH,IAAI,KAAK,IAAI,OAAO,CAEnB;CACF;AAED,MAAM,MAAM,mCAAmC,GAAG,GAAG,CACnD,kCAAkC,EAClC,gCAAgC,CACjC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,kCAAkC,CAI9E"}

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.js

@@ -3,14 +3,14 @@ import { faker } from "@faker-js/faker";
  * Simulated CloudFront origin access control.
  *
  * An origin access control is attached to an Origin, and it is how a
- * Distribution authenticates to a private S3 Bucket: CloudFront signs the
- * Origin request with SigV4 as the CloudFront service principal, and the Bucket
- * policy grants that principal on the Distribution's ARN.
+ * Distribution authenticates to a private Origin: CloudFront signs the Origin
+ * request with SigV4 as the CloudFront service principal, and the Origin's own
+ * policy grants that principal on the Distribution's ARN. For an S3 Origin that
+ * policy is the Bucket policy, and for a Lambda Function URL it is the
+ * function's resource policy.
  *
- * Only an `s3` origin type signed with `sigv4` is modelled, so those are fixed
- * here rather than stored. Anything else is refused where the origin access
- * control is read, rather than kept and treated as though it behaved like the
- * supported values.
+ * `sigv4` is the only protocol CloudFront offers, so it is fixed here rather
+ * than stored.
  *
  * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
  */
@@ -21,8 +21,12 @@ export class SimCloudFrontOriginAccessControl {
     signingBehavior;
     /**
      * The kind of Origin this origin access control signs for.
+     *
+     * CloudFront refuses an origin access control attached to an Origin its
+     * origin type does not match, so this is checked where an Origin names one
+     * rather than only described here.
      */
-    originType = "s3";
+    originType;
     /**
      * The protocol CloudFront signs the Origin request with.
      */
@@ -31,6 +35,7 @@ export class SimCloudFrontOriginAccessControl {
         this.id = properties.id ?? makeOriginAccessControlId();
         this.name = properties.name;
         this.description = properties.description;
+        this.originType = properties.originType;
         this.signingBehavior = properties.signingBehavior;
     }
     /**

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-origin-access-control.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AA4BxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAgC;IAC3B,EAAE,CAAqC;IACvC,IAAI,CAAS;IACb,WAAW,CAAqB;IAChC,eAAe,CAAkD;IAEjF;;OAEG;IACa,UAAU,GAAG,IAAI,CAAC;IAElC;;OAEG;IACa,eAAe,GAAG,OAAO,CAAC;IAE1C,YAAY,UAAsD;QAChE,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,yBAAyB,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC;IAC1C,CAAC;CACF;AAOD;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAC7B,eAAe,CACsB,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"sim-cf-origin-access-control.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAqCxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAgC;IAC3B,EAAE,CAAqC;IACvC,IAAI,CAAS;IACb,WAAW,CAAqB;IAChC,eAAe,CAAkD;IAEjF;;;;;;OAMG;IACa,UAAU,CAA6C;IAEvE;;OAEG;IACa,eAAe,GAAG,OAAO,CAAC;IAE1C,YAAY,UAAsD;QAChE,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,yBAAyB,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC;IAC1C,CAAC;CACF;AAOD;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAC7B,eAAe,CACsB,CAAC;AAC1C,CAAC"}

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.d.ts

@@ -0,0 +1,43 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimEcrRepository } from "../../repository/sim-ecr-repository.js";
+import type { SimEcr } from "../../sim-ecr.js";
+interface SimCfnEcrRepositoryCreatorProperties {
+    readonly ecr: SimEcr;
+}
+/**
+ * Creates simulated repositories from AWS::ECR::Repository Resources.
+ *
+ * A template declares a repository and never an image, which is what real
+ * CloudFormation does too: an image is pushed by whatever built it, long
+ * before any stack that runs it is deployed. So a deployed repository starts
+ * empty unless a test has already registered a handler as its image, and it
+ * keeps that handler if it has, since the repository outlives the stack.
+ */
+export declare class SimCfnEcrRepositoryCreator {
+    private readonly ecr;
+    constructor(properties: SimCfnEcrRepositoryCreatorProperties);
+    /**
+     * Create a repository from an AWS::ECR::Repository Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimEcrRepository;
+    /**
+     * Delete a repository created from an AWS::ECR::Repository Resource.
+     *
+     * A repository holding a simulated image is left where it is, and the
+     * deletion is recorded as skipped. The image is a handler registered outside
+     * any stack, usually in test setup, and it is the whole reason the
+     * repository is the place to say what an image is: it outlives the stack
+     * that declared it. Taking it down with one stack would leave the next
+     * deploy resolving nothing.
+     *
+     * Real ECR refuses to delete a repository that still holds images too,
+     * which fails the stack unless the template says `EmptyOnDelete`. This
+     * records the refusal rather than failing the teardown, because what is
+     * being protected here is a test's own registration rather than anything
+     * CloudFormation put there.
+     */
+    delete(resource: SimCfnResource, repository: SimEcrRepository): void;
+}
+export {};
+//# sourceMappingURL=sim-cfn-ecr-repository-creator.d.ts.map

package/dist/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-ecr-repository-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/ecr/cfn/repository/sim-cfn-ecr-repository-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,gBAAgB,CAUlB;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAWnE;CACF"}