@kensio/yulin 1.20.13 → 1.20.15

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-batch-creator.js

@@ -17,12 +17,14 @@ export class SimCfnStackResourceBatchCreator {
     resources;
     cdkOutContext;
     bindings;
+    caller;
     constructor(properties) {
-        const { simAws, resources, cdkOutContext, bindings } = properties;
+        const { simAws, resources, cdkOutContext, bindings, caller } = properties;
         this.simAws = simAws;
         this.resources = resources;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
+        this.caller = caller;
     }
     /**
      * Create the supplied Resources concurrently.
@@ -37,6 +39,7 @@ export class SimCfnStackResourceBatchCreator {
                 resources: this.resources,
                 cdkOutContext: this.cdkOutContext,
                 bindings: this.bindings,
+                caller: this.caller,
             });
         }));
     }

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-creator.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../../bind/sim-cfn-binding.js";
@@ -8,6 +9,7 @@ interface SimCfnStackResourceCreatorProperties {
     readonly stackName: string;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Orchestrates dependency-ordered creation of a Stack's simulated Resources.

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-creator.js

@@ -21,7 +21,7 @@ export class SimCfnStackResourceCreator {
     stackName;
     batchCreator;
     constructor(properties) {
-        const { simAws, resources, stackName, cdkOutContext, bindings } = properties;
+        const { simAws, resources, stackName, cdkOutContext, bindings, caller } = properties;
         this.resources = resources;
         this.stackName = stackName;
         this.batchCreator = new SimCfnStackResourceBatchCreator({
@@ -29,6 +29,7 @@ export class SimCfnStackResourceCreator {
             resources,
             cdkOutContext,
             bindings,
+            caller,
         });
     }
     /**

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.d.ts

@@ -1,5 +1,6 @@
 import type { BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
@@ -19,6 +20,11 @@ interface SimCfnStackResourceOperationsProperties {
     readonly stackName: SimCloudFormationStackName;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal the Stack's Resource work is authorized as. An omitted
+     * caller leaves each service to decide the request as the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * What a Stack can ask simulated AWS to do with its Resources.
@@ -39,16 +45,25 @@ export declare class SimCfnStackResourceOperations {
     private readonly stackName;
     private readonly bindings;
     private cdkOutContext;
+    private caller;
     constructor(properties: SimCfnStackResourceOperationsProperties);
     /**
-     * Read Resources from a different CDK cloud assembly from now on.
+     * Take on what an update brings with it, for this and every later operation.
      *
      * A synthesis writes the template and the assets manifest beside it together,
      * so a Stack updated from a re-synthesized template needs the manifest that
      * came with it. Keeping the one the Stack was deployed from would look up the
      * asset a replaced Resource names in a manifest written before it existed.
+     *
+     * An update naming a caller runs as that one, and the Stack is torn down as
+     * it afterwards. An update that names none keeps the deployment's caller, so
+     * a Stack updated from a plain template path goes on running as whoever
+     * deployed it.
      */
-    useCdkOutContext(cdkOutContext: SimCdkOutContext): void;
+    useUpdate(properties: {
+        readonly cdkOutContext?: SimCdkOutContext | undefined;
+        readonly caller?: SimAwsCaller | undefined;
+    }): void;
     /**
      * Create every Resource in the given Stack Resource map.
      */

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.js

@@ -21,24 +21,32 @@ export class SimCfnStackResourceOperations {
     stackName;
     bindings;
     cdkOutContext;
+    caller;
     constructor(properties) {
-        const { simAws, accountRegionScope, stackName, cdkOutContext, bindings } = properties;
+        const { simAws, accountRegionScope, stackName, cdkOutContext, bindings, caller, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stackName = stackName;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
+        this.caller = caller;
     }
     /**
-     * Read Resources from a different CDK cloud assembly from now on.
+     * Take on what an update brings with it, for this and every later operation.
      *
      * A synthesis writes the template and the assets manifest beside it together,
      * so a Stack updated from a re-synthesized template needs the manifest that
      * came with it. Keeping the one the Stack was deployed from would look up the
      * asset a replaced Resource names in a manifest written before it existed.
+     *
+     * An update naming a caller runs as that one, and the Stack is torn down as
+     * it afterwards. An update that names none keeps the deployment's caller, so
+     * a Stack updated from a plain template path goes on running as whoever
+     * deployed it.
      */
-    useCdkOutContext(cdkOutContext) {
-        this.cdkOutContext = cdkOutContext;
+    useUpdate(properties) {
+        this.cdkOutContext = properties.cdkOutContext ?? this.cdkOutContext;
+        this.caller = properties.caller ?? this.caller;
     }
     /**
      * Create every Resource in the given Stack Resource map.
@@ -87,6 +95,7 @@ export class SimCfnStackResourceOperations {
             accountRegionScope: this.accountRegionScope,
             stackName: this.stackName,
             cdkOutContext: this.cdkOutContext,
+            caller: this.caller,
         }).publish();
     }
     creator(resources) {
@@ -96,6 +105,7 @@ export class SimCfnStackResourceOperations {
             stackName: this.stackName,
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
+            caller: this.caller,
         });
     }
     deleter(resources) {
@@ -103,6 +113,7 @@ export class SimCfnStackResourceOperations {
             simAws: this.simAws,
             resources,
             stackName: this.stackName,
+            caller: this.caller,
         });
     }
 }

package/dist/service/cloudformation/stack/sim-cfn-stack.js

@@ -38,7 +38,7 @@ export class SimCfnStack {
     stackOutputs;
     cfnTemplate;
     constructor(properties) {
-        const { simAws, accountRegionScope, background, stackName, template, cdkOutContext, bindings, exports, } = properties;
+        const { simAws, accountRegionScope, background, stackName, template, cdkOutContext, bindings, caller, exports, } = properties;
         this.background = background;
         this.stackName = stackName;
         this.stackOutputs = new SimCfnStackOutputs({ stackName, exports });
@@ -60,6 +60,7 @@ export class SimCfnStack {
             stackName,
             cdkOutContext,
             bindings,
+            caller,
         });
         this.lifecycle = new SimCfnStackDeploymentLifecycle({
             background,
@@ -128,10 +129,9 @@ export class SimCfnStack {
         });
         updater.assertHasChanges();
         // Only once the update is going ahead, so a refused update leaves the Stack
-        // reading the cloud assembly it was deployed from.
-        if (properties.cdkOutContext !== undefined) {
-            this.operations.useCdkOutContext(properties.cdkOutContext);
-        }
+        // reading the cloud assembly it was deployed from and running as whoever
+        // deployed it.
+        this.operations.useUpdate(properties);
         this.cfnTemplate = template;
         this.template = template.template;
         await this.updating.update(async () => {

package/dist/service/cloudformation/stack/sim-cfn-stack.type.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { Brand } from "../../../util/brand.type.js";
 import type { BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
@@ -16,6 +17,11 @@ export interface SimCfnStackUpdateProperties {
      * describes the assembly the previous template came from.
      */
     readonly cdkOutContext?: SimCdkOutContext | undefined;
+    /**
+     * The principal to apply the new template as, for an update that names one.
+     * The Stack goes on using it, as it does the cloud assembly.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 export interface SimCloudFormationStackProperties {
     readonly simAws: SimAws;
@@ -25,6 +31,12 @@ export interface SimCloudFormationStackProperties {
     readonly template: SimCfnTemplate;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
+    /**
+     * The principal this Stack's Resources are created, updated and deleted as.
+     * An omitted caller is the Account root, as it is everywhere else in the
+     * simulation.
+     */
+    readonly caller?: SimAwsCaller | undefined;
     /**
      * The export names published in the Account and Region this Stack deploys
      * into. This Stack publishes its own Outputs here and reads the ones its

package/dist/service/cloudformation/stack/teardown/sim-cfn-stack-resource-batch-deleter.d.ts

@@ -1,8 +1,10 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 interface SimCfnStackResourceBatchDeleterProperties {
     readonly simAws: SimAws;
     readonly resources: ReadonlyMap<string, SimCfnResource>;
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Deletes one batch of Stack Resources nothing still depends on.
@@ -17,6 +19,7 @@ interface SimCfnStackResourceBatchDeleterProperties {
 export declare class SimCfnStackResourceBatchDeleter {
     private readonly simAws;
     private readonly resources;
+    private readonly caller;
     constructor(properties: SimCfnStackResourceBatchDeleterProperties);
     /**
      * Delete the supplied Resources concurrently.

package/dist/service/cloudformation/stack/teardown/sim-cfn-stack-resource-batch-deleter.js

@@ -11,9 +11,11 @@
 export class SimCfnStackResourceBatchDeleter {
     simAws;
     resources;
+    caller;
     constructor(properties) {
         this.simAws = properties.simAws;
         this.resources = properties.resources;
+        this.caller = properties.caller;
     }
     /**
      * Delete the supplied Resources concurrently.
@@ -25,6 +27,7 @@ export class SimCfnStackResourceBatchDeleter {
             await resource.delete({
                 simAws: this.simAws,
                 resources: this.resources,
+                caller: this.caller,
             });
         }));
     }

package/dist/service/cloudformation/stack/teardown/sim-cfn-stack-resource-deleter.d.ts

@@ -1,9 +1,11 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 interface SimCfnStackResourceDeleterProperties {
     readonly simAws: SimAws;
     readonly resources: ReadonlyMap<string, SimCfnResource>;
     readonly stackName: string;
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * Orchestrates reverse-dependency-ordered deletion of a Stack's Resources.

package/dist/service/cloudformation/stack/teardown/sim-cfn-stack-resource-deleter.js

@@ -20,12 +20,13 @@ export class SimCfnStackResourceDeleter {
     stackName;
     batchDeleter;
     constructor(properties) {
-        const { simAws, resources, stackName } = properties;
+        const { simAws, resources, stackName, caller } = properties;
         this.resources = resources;
         this.stackName = stackName;
         this.batchDeleter = new SimCfnStackResourceBatchDeleter({
             simAws,
             resources,
+            caller,
         });
     }
     /**

package/dist/service/cloudformation/template/dynamic/make-sim-cfn-dynamic-references.d.ts

@@ -1,10 +1,12 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnPropertyIgnorer } from "../../resource/ignore/sim-cfn-ignored-property.type.js";
 import { SimCfnDynamicReferences } from "./sim-cfn-dynamic-references.js";
 interface MakeSimCfnDynamicReferencesProperties {
     readonly simAws: SimAws;
     readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly caller?: SimAwsCaller | undefined;
     readonly propertyIgnorer?: SimCfnPropertyIgnorer | undefined;
     readonly resourceType?: string | undefined;
 }

package/dist/service/cloudformation/template/dynamic/make-sim-cfn-dynamic-references.js

@@ -4,7 +4,7 @@ import { simCfnDynamicReferenceResolvers } from "./sim-cfn-dynamic-reference-res
  * Build the dynamic reference resolvers for one Account and Region scope.
  */
 export function makeSimCfnDynamicReferences(properties) {
-    const { simAws, accountRegionScope, propertyIgnorer, resourceType } = properties;
+    const { simAws, accountRegionScope, caller, propertyIgnorer, resourceType } = properties;
     const scopedAws = simAws.accountRegionScope(accountRegionScope.accountId, accountRegionScope.regionName);
     return new SimCfnDynamicReferences({
         propertyIgnorer,
@@ -13,7 +13,7 @@ export function makeSimCfnDynamicReferences(properties) {
             .entries()
             .map(([service, resolver]) => [
             service,
-            resolver({ simAws, scopedAws }),
+            resolver({ simAws, scopedAws, caller }),
         ])),
     });
 }

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-reference-resolvers.d.ts

@@ -1,4 +1,5 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionContainer } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCfnDynamicReferenceResolver } from "./sim-cfn-dynamic-reference.type.js";
 /**
@@ -12,6 +13,15 @@ import type { SimCfnDynamicReferenceResolver } from "./sim-cfn-dynamic-reference
 interface SimCfnDynamicReferenceSimulation {
     readonly simAws: SimAws;
     readonly scopedAws: SimAwsAccountRegionContainer;
+    /**
+     * The principal the deployment runs as, which the reference is read as. Real
+     * CloudFormation resolves a dynamic reference under the Stack's execution
+     * role, so a Stack deployed as a Role reads what that Role may read.
+     *
+     * Left out unless the deployment named one, which leaves each service to its
+     * own omitted-caller default of the Account root.
+     */
+    readonly caller?: SimAwsCaller | undefined;
 }
 /**
  * How one simulated service hands over its dynamic reference resolver, given

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-reference-resolvers.js

@@ -10,19 +10,20 @@ import { SimCfnSecretsManagerDynamicReferenceResolver } from "../../../secretsma
 export const simCfnDynamicReferenceResolvers = new Map([
     [
         "ssm",
-        ({ scopedAws }) => scopedAws.ssm().cfnDynamicReferenceResolver(),
+        ({ scopedAws, caller }) => scopedAws.ssm().cfnDynamicReferenceResolver(caller),
     ],
     [
         "ssm-secure",
-        ({ scopedAws }) => scopedAws.ssm().cfnSecureDynamicReferenceResolver(),
+        ({ scopedAws, caller }) => scopedAws.ssm().cfnSecureDynamicReferenceResolver(caller),
     ],
     [
         "secretsmanager",
-        ({ simAws, scopedAws }) => new SimCfnSecretsManagerDynamicReferenceResolver({
+        ({ simAws, scopedAws, caller }) => new SimCfnSecretsManagerDynamicReferenceResolver({
             secretsManager: scopedAws.secretsManager(),
             secretsManagerIn: (scope) => simAws
                 .accountRegionScope(scope.accountId, scope.regionName)
                 .secretsManager(),
+            caller,
         }),
     ],
 ]);

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-reference-scan.d.ts

@@ -1,3 +1,4 @@
+import type { SimCfnTemplateValue } from "../value/sim-cfn-template-value.js";
 import type { SimCfnDynamicReference } from "./sim-cfn-dynamic-reference.type.js";
 /**
  * What a caller answers each reference with.
@@ -10,6 +11,16 @@ type SimCfnDynamicReferenceSubstitution = (reference: SimCfnDynamicReference) =>
  * Whether a string holds anything worth scanning.
  */
 export declare function hasSimCfnDynamicReference(text: string): boolean;
+/**
+ * Whether anything in a template value was written as a dynamic reference.
+ *
+ * The opening is written literally in every template but a contrived one, so
+ * this answers whether a Resource's properties are worth reading references
+ * out of before they are resolved. A template building the opening itself,
+ * out of an `Fn::Join` over its characters, is answered no and reads its
+ * references while resolving instead.
+ */
+export declare function hasSimCfnDynamicReferenceIn(value: SimCfnTemplateValue): boolean;
 /**
  * Replace every dynamic reference in a string with what the caller answers.
  *

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-reference-scan.js

@@ -17,6 +17,27 @@ const dynamicReferencePattern = /\{\{resolve:([A-Za-z][\w-]*):([^{}]*)\}\}/g;
 export function hasSimCfnDynamicReference(text) {
     return text.includes(dynamicReferenceOpening);
 }
+/**
+ * Whether anything in a template value was written as a dynamic reference.
+ *
+ * The opening is written literally in every template but a contrived one, so
+ * this answers whether a Resource's properties are worth reading references
+ * out of before they are resolved. A template building the opening itself,
+ * out of an `Fn::Join` over its characters, is answered no and reads its
+ * references while resolving instead.
+ */
+export function hasSimCfnDynamicReferenceIn(value) {
+    if (typeof value === "string") {
+        return hasSimCfnDynamicReference(value);
+    }
+    if (Array.isArray(value)) {
+        return value.some((entry) => hasSimCfnDynamicReferenceIn(entry));
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.values(value).some((entry) => hasSimCfnDynamicReferenceIn(entry));
+    }
+    return false;
+}
 /**
  * Replace every dynamic reference in a string with what the caller answers.
  *

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-references.d.ts

@@ -19,15 +19,33 @@ interface SimCfnDynamicReferencesProperties {
  * what the ones this simulation has yet to implement do.
  *
  * One of these belongs to a single Resource's property resolution. That is
- * what lets it hold the references still being read. `substitute` runs while
- * the properties resolve, and `settle` finishes them afterwards.
+ * what lets it hold the references still being read. `prefetch` reads them
+ * ahead of resolution, `substitute` runs while the properties resolve, and
+ * `settle` finishes whatever the prefetch pass never reached.
  */
 export declare class SimCfnDynamicReferences {
     private readonly resolvers;
     private readonly propertyIgnorer;
     private readonly resourceType;
     private readonly awaited;
+    private readonly prefetched;
     constructor(properties: SimCfnDynamicReferencesProperties);
+    /**
+     * Read every reference the properties hold, before resolving them for real.
+     *
+     * A service that has to be waited on cannot answer during resolution, which
+     * is synchronous, so an `Fn::Split` over a reference would otherwise split
+     * something that is not the value yet. Resolving the properties twice is
+     * what avoids that: this pass leaves every reference as the template wrote
+     * it and only collects what the services answer, and the pass after it finds
+     * the answers already here.
+     *
+     * Nothing is recorded here and no failure escapes. A template this pass
+     * cannot resolve is resolved again straight afterwards, and that is the pass
+     * whose failure the Resource reports. A reference the pass never reached, or
+     * one whose service refused it, is left to `substitute` and `settle`.
+     */
+    prefetch(resolve: () => void): Promise<void>;
     /**
      * Replace every dynamic reference in a resolved string.
      *
@@ -44,6 +62,10 @@ export declare class SimCfnDynamicReferences {
      * whose properties name only services answering at once.
      */
     settle(properties: SimCfnTemplateValueRecord): Promise<SimCfnTemplateValueRecord>;
+    /**
+     * What one reference is replaced with, given the service answering it.
+     */
+    private substituted;
     /**
      * The value one reference resolved to.
      *

package/dist/service/cloudformation/template/dynamic/sim-cfn-dynamic-references.js

@@ -2,6 +2,7 @@ import { currentSimCfnValuePath } from "../value/sim-cfn-value-path.js";
 import { SimCfnAwaitedDynamicReferences } from "./sim-cfn-awaited-dynamic-references.js";
 import { fillSimCfnDynamicReferencePlaceholders } from "./sim-cfn-dynamic-reference-placeholder.js";
 import { substituteSimCfnDynamicReferences } from "./sim-cfn-dynamic-reference-scan.js";
+import { SimCfnPrefetchedDynamicReferences } from "./sim-cfn-prefetched-dynamic-references.js";
 /**
  * The services a Stack's dynamic references are answered by.
  *
@@ -11,19 +12,39 @@ import { substituteSimCfnDynamicReferences } from "./sim-cfn-dynamic-reference-s
  * what the ones this simulation has yet to implement do.
  *
  * One of these belongs to a single Resource's property resolution. That is
- * what lets it hold the references still being read. `substitute` runs while
- * the properties resolve, and `settle` finishes them afterwards.
+ * what lets it hold the references still being read. `prefetch` reads them
+ * ahead of resolution, `substitute` runs while the properties resolve, and
+ * `settle` finishes whatever the prefetch pass never reached.
  */
 export class SimCfnDynamicReferences {
     resolvers;
     propertyIgnorer;
     resourceType;
     awaited = new SimCfnAwaitedDynamicReferences();
+    prefetched = new SimCfnPrefetchedDynamicReferences();
     constructor(properties) {
         this.resolvers = properties.resolvers;
         this.propertyIgnorer = properties.propertyIgnorer;
         this.resourceType = properties.resourceType;
     }
+    /**
+     * Read every reference the properties hold, before resolving them for real.
+     *
+     * A service that has to be waited on cannot answer during resolution, which
+     * is synchronous, so an `Fn::Split` over a reference would otherwise split
+     * something that is not the value yet. Resolving the properties twice is
+     * what avoids that: this pass leaves every reference as the template wrote
+     * it and only collects what the services answer, and the pass after it finds
+     * the answers already here.
+     *
+     * Nothing is recorded here and no failure escapes. A template this pass
+     * cannot resolve is resolved again straight afterwards, and that is the pass
+     * whose failure the Resource reports. A reference the pass never reached, or
+     * one whose service refused it, is left to `substitute` and `settle`.
+     */
+    async prefetch(resolve) {
+        await this.prefetched.read(resolve);
+    }
     /**
      * Replace every dynamic reference in a resolved string.
      *
@@ -37,15 +58,7 @@ export class SimCfnDynamicReferences {
             if (resolver === undefined) {
                 return;
             }
-            const path = currentSimCfnValuePath();
-            const resolution = resolver.resolve(reference, {
-                resourceType: this.resourceType,
-                propertyPath: path,
-            });
-            if (resolution instanceof Promise) {
-                return this.awaited.hold(resolution, path);
-            }
-            return this.answer(resolution, path);
+            return this.substituted(resolver, reference);
         });
     }
     /**
@@ -66,6 +79,32 @@ export class SimCfnDynamicReferences {
         ]));
         return fillSimCfnDynamicReferencePlaceholders(properties, values);
     }
+    /**
+     * What one reference is replaced with, given the service answering it.
+     */
+    substituted(resolver, reference) {
+        const path = currentSimCfnValuePath();
+        const key = `${path} ${reference.text}`;
+        const prefetched = this.prefetched.answerFor(key);
+        if (prefetched !== undefined) {
+            return this.answer(prefetched, path);
+        }
+        if (this.prefetched.isHeld(key)) {
+            return reference.text;
+        }
+        const resolution = resolver.resolve(reference, {
+            resourceType: this.resourceType,
+            propertyPath: path,
+        });
+        if (this.prefetched.isReading) {
+            this.prefetched.hold(key, resolution);
+            return reference.text;
+        }
+        if (resolution instanceof Promise) {
+            return this.awaited.hold(resolution, path);
+        }
+        return this.answer(resolution, path);
+    }
     /**
      * The value one reference resolved to.
      *

package/dist/service/cloudformation/template/dynamic/sim-cfn-prefetched-dynamic-references.d.ts

@@ -0,0 +1,42 @@
+import type { SimCfnDynamicReferenceResolution } from "./sim-cfn-dynamic-reference.type.js";
+/**
+ * The references of one property resolution that were read before it ran.
+ *
+ * A service that has to be waited on cannot answer while the properties
+ * resolve, because resolution is synchronous, so properties holding a
+ * reference are resolved twice. The first pass leaves every reference as the
+ * template wrote it and keeps what the services answer here. The second finds
+ * the answers waiting, so an `Fn::Split` over a reference splits the value
+ * rather than something standing in for it.
+ *
+ * A read that failed is not kept. The resolution pass asks its service again,
+ * and the failure reaches the Resource from there, which is what fails a
+ * Resource holding a reference the deployment may not read.
+ */
+export declare class SimCfnPrefetchedDynamicReferences {
+    private readonly answers;
+    private reads;
+    /** Whether the pass running now is the one reading references ahead. */
+    get isReading(): boolean;
+    /**
+     * What one reference was already answered with, where it was.
+     */
+    answerFor(key: string): SimCfnDynamicReferenceResolution | undefined;
+    /**
+     * Whether the pass running now has already started reading one reference.
+     *
+     * A property holding the same reference twice would otherwise read it twice.
+     */
+    isHeld(key: string): boolean;
+    /**
+     * Keep one reference's answer for the resolution pass to use.
+     */
+    hold(key: string, resolution: SimCfnDynamicReferenceResolution | Promise<SimCfnDynamicReferenceResolution>): void;
+    /**
+     * Run one pass over the properties, keeping what its references answer.
+     *
+     * Nothing the pass throws escapes. The resolution pass after it resolves the
+     * same properties, and that is the pass whose failure the Resource reports.
+     */
+    read(pass: () => void): Promise<void>;
+}