@kensio/yulin 1.20.15 → 1.20.17

package/dist/service/aws/factory/sim-aws-service-factory.js

@@ -1,3 +1,4 @@
+import { simAwsRunAsAmbientCaller } from "../caller/sim-aws-ambient-caller.js";
 import { SimCloudFrontRegistry } from "../../cloudfront/registry/sim-cloud-front-registry.js";
 import { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
 import { SimOrganizations } from "../../organizations/index.js";
@@ -88,6 +89,10 @@ export class SimAwsServiceFactory {
     registeredServices;
     selfContainedServices;
     constructor(properties) {
+        // Where a request naming no caller of its own looks before the default.
+        // Keyed on the SimAws instance, so a run-as on one simulation decides
+        // nothing in another.
+        const ambientCaller = simAwsRunAsAmbientCaller(properties.simAws);
         this.accountServices = new SimAwsAccountServiceCache({
             simAws: properties.simAws,
             background: properties.background,
@@ -104,10 +109,19 @@ export class SimAwsServiceFactory {
             iamRegistry: this.iamRegistry,
             accessKeyRegistry: this.requestAuth.accessKeyRegistry,
             scpResolver: this.organizations,
+            // Simulated IAM applies this wherever a request names no caller of its
+            // own, in place of the Account root it would otherwise be decided as.
+            defaultCaller: properties.defaultCaller,
+            ambientCaller,
         });
         this.accountRegionServices = new SimAwsAccountRegionServiceBuilder({
             simAws: properties.simAws,
             background: properties.background,
+            // STS reports and evaluates the same default. An unattributed
+            // GetCallerIdentity answers with the principal everything else uses,
+            // the ambient run-as caller included.
+            defaultCaller: properties.defaultCaller,
+            ambientCaller,
             registries: this.registries,
             iamRegistry: this.iamRegistry,
             lambdaUrlRegistry: this.lambdaUrlRegistry,

package/dist/service/aws/sim-aws-properties.d.ts

@@ -2,6 +2,7 @@ import type { BackgroundCompleter, BackgroundScheduler } from "../../util/backgr
 import type { SimClock } from "../../util/clock/sim-clock.js";
 import type { SimIamSigV4ExpectedScope } from "../iam/sigv4/sim-iam-sigv4-expected-scope.js";
 import type { SimAwsAccountId } from "./sim-aws-account.js";
+import type { SimAwsDefaultCaller } from "./caller/sim-aws-caller.js";
 import type { AwsRegionName } from "./sim-aws-region.js";
 /**
  * Everything caller resolution needs besides the request itself.
@@ -28,6 +29,20 @@ export interface SimAwsProperties {
      */
     readonly defaultAccountId?: SimAwsAccountId | string;
     readonly defaultRegionName?: AwsRegionName;
+    /**
+     * The principal this simulation attributes a call naming no caller to.
+     *
+     * Every simulated operation takes a `caller`, and one is set for a
+     * deployment through `deployTemplate` and `deployCdkOut`. This says who the
+     * calls that name none are, such as the role an operator reads the account
+     * through. An explicit caller always wins, as does the ambient caller of a
+     * `runAs` block.
+     *
+     * Left out, a call naming no caller is decided as the root principal of the
+     * Account it reaches. A service control policy denying that root then denies
+     * the call. That is the reason to name a default.
+     */
+    readonly defaultCaller?: SimAwsDefaultCaller;
     readonly background?: BackgroundScheduler & BackgroundCompleter;
     /**
      * Clock this simulation's timestamps start from, defaulting to the real

package/dist/service/aws/sim-aws.js

@@ -34,7 +34,7 @@ export class SimAws extends SimAwsServiceAccessors {
     requestAuthentication;
     constructor(properties = {}) {
         super();
-        const { defaultAccountId = DEFAULT_SIM_AWS_ACCOUNT_ID, defaultRegionName = DEFAULT_SIM_AWS_REGION_NAME, clock, background: suppliedBackground, } = properties;
+        const { defaultAccountId = DEFAULT_SIM_AWS_ACCOUNT_ID, defaultRegionName = DEFAULT_SIM_AWS_REGION_NAME, clock, defaultCaller, background: suppliedBackground, } = properties;
         const timekeeping = new SimAwsTimekeeping({
             clock,
             background: suppliedBackground,
@@ -47,6 +47,7 @@ export class SimAws extends SimAwsServiceAccessors {
         this.serviceFactory = new SimAwsServiceFactory({
             simAws: this,
             background,
+            defaultCaller,
         });
         this.iamRegistry = this.serviceFactory.iamRegistry;
         this.scopes = new SimAwsScopeRegistry({ simAws: this });

package/dist/service/cloudformation/command/create-stack/create-stack.handler.d.ts

@@ -8,6 +8,7 @@ import type { SimCreateStackCommand, SimCreateStackCommandOutput } from "./creat
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../../bind/sim-cfn-binding.js";
 import type { SimCfnExports } from "../../export/sim-cfn-exports.js";
+import type { SimCfnResourceOrder } from "../../stack/deploy/sim-cfn-resource-order.js";
 interface CreateStackCommandHandlerProperties {
     readonly simAws: SimAws;
     readonly accountRegionScope: SimAwsAccountRegionScope;
@@ -17,6 +18,8 @@ interface CreateStackCommandHandlerProperties {
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     /** The principal the Stack's Resources are created as. */
     readonly caller?: SimAwsCaller | undefined;
+    /** The order Resources with no dependency between them are started in. */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly exports?: SimCfnExports | undefined;
 }
 /**
@@ -32,6 +35,7 @@ export declare class CreateStackCommandHandler implements CommandHandler<SimCrea
     private readonly cdkOutContext;
     private readonly bindings;
     private readonly caller;
+    private readonly resourceOrder;
     private readonly exports;
     constructor(properties: CreateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/create-stack/create-stack.handler.js

@@ -17,9 +17,10 @@ export class CreateStackCommandHandler {
     cdkOutContext;
     bindings;
     caller;
+    resourceOrder;
     exports;
     constructor(properties) {
-        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, exports, } = properties;
+        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, resourceOrder, exports, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stacks = stacks;
@@ -27,6 +28,7 @@ export class CreateStackCommandHandler {
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
         this.caller = caller;
+        this.resourceOrder = resourceOrder;
         this.exports = exports;
     }
     /**
@@ -63,6 +65,7 @@ export class CreateStackCommandHandler {
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
             caller: this.caller,
+            resourceOrder: this.resourceOrder,
             exports: this.exports,
         });
         this.stacks.set(stack.stackName, stack);

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-deployer.js

@@ -27,7 +27,7 @@ export class SimCfnCdkOutDeployer {
     }
     async deployStack(stack, plan, deployed) {
         const { simAws, accountRegionScope } = this.scope;
-        const { transform, caller, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
+        const { transform, caller, resourceOrder, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
         return await simAws
             .accountRegionScope(accountRegionScope.accountId, stack.regionName)
             .cloudFormation()
@@ -36,6 +36,7 @@ export class SimCfnCdkOutDeployer {
             stackName: stack.stackName,
             ...options,
             caller: caller ?? plan.caller,
+            resourceOrder: resourceOrder ?? plan.resourceOrder,
             transform: cdkOutBoundTransform(transform, deployed),
         });
     }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.d.ts

@@ -2,6 +2,7 @@ import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import { type SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
 import { type SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
+import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 export interface SimCloudFormationDeployCdkOutProperties {
     /** The `cdk.out` directory to deploy, holding a `manifest.json`. */
     readonly directoryPath: string;
@@ -23,8 +24,15 @@ export interface SimCloudFormationDeployCdkOutProperties {
      */
     readonly caller?: SimAwsCaller | undefined;
     /**
-     * Bindings, parameters, a caller and a transform for individual Stacks,
-     * keyed the same way `stackNames` names them.
+     * The order every Stack in the assembly creates Resources with no dependency
+     * between them in, which one named in `stackOptions` overrides for its own
+     * Stack. `reversed` deploys each Stack the other way round from the one its
+     * template is written in.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
+    /**
+     * Bindings, parameters, a caller, a Resource order and a transform for
+     * individual Stacks, keyed the same way `stackNames` names them.
      */
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
@@ -35,6 +43,7 @@ export interface SimCfnCdkOutPlannedStack extends SimCdkAssemblyStack {
 export interface SimCfnCdkOutPlan {
     readonly stacks: readonly SimCfnCdkOutPlannedStack[];
     readonly caller?: SimAwsCaller | undefined;
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.js

@@ -10,7 +10,7 @@ import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options
  * an assembly that cannot be deployed says so before any Stack is created.
  */
 export async function planCdkOutDeployment(properties) {
-    const { directoryPath, stackNames, caller, stackOptions } = cdkOutDeployment(properties.request);
+    const { directoryPath, stackNames, caller, resourceOrder, stackOptions } = cdkOutDeployment(properties.request);
     const selected = selectCdkAssemblyStacks({
         stacks: await loadCdkAssemblyStacks(directoryPath),
         stackNames,
@@ -23,6 +23,7 @@ export async function planCdkOutDeployment(properties) {
             regionName: stack.regionName ?? properties.defaultRegionName,
         })),
         caller,
+        resourceOrder,
         stackOptions,
     };
 }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDeployedStack } from "../stack/sim-cfn-deployed-stack.type.js";
 import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
 import type { SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
+import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 /**
  * Adapts one Stack's parsed template, with the Stacks the same call has already
  * deployed to hand.
@@ -33,6 +34,11 @@ export interface SimCfnCdkOutStackOptions {
      * application Stack deployed by another is what this is for.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The order this Stack creates Resources with no dependency between them in,
+     * where the assembly's own order is not the right one for it.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly transform?: SimCfnCdkOutTemplateTransform | undefined;
 }
 export type SimCfnCdkOutStackOptionsByName = Record<string, SimCfnCdkOutStackOptions>;

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.d.ts

@@ -9,6 +9,7 @@ import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimCfnExports } from "../export/sim-cfn-exports.js";
+import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 export interface SimCloudFormationCreateStackProperties {
     readonly stackName?: SimCloudFormationStackName | string;
     readonly template: CfnTemplateBodyRecord;
@@ -23,6 +24,16 @@ export interface SimCloudFormationCreateStackProperties {
      * policy denying an Account's root principal then denies.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The order Resources with no dependency between them are created in.
+     *
+     * CloudFormation is free to create them either way round, and the template's
+     * own order is what a deployment does by default. `reversed` starts each
+     * dependency batch from its last Resource, so a Stack that only deploys in
+     * the order its template happens to be written fails here rather than in the
+     * account. Declared dependencies and `DependsOn` are honoured either way.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     /**
      * The synthesized CDK template file this in-memory template stands in for.
      *

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.js

@@ -59,6 +59,7 @@ export class SimCloudFormationTemplateDeployer {
             parameters: properties.parameters,
             bindings: properties.bindings,
             caller: properties.caller,
+            resourceOrder: properties.resourceOrder,
             cdkOutContext: await cdkOutContextForTemplatePath(properties.templatePath),
         });
     }
@@ -102,33 +103,34 @@ export class SimCloudFormationTemplateDeployer {
         this.watches.stopAll();
     }
     async deployTemplateWithContext(properties) {
-        await this.createStackWithContext({
-            input: {
-                StackName: properties.stackName,
-                TemplateBody: jsonStringify(properties.template),
-                Parameters: Object.entries(properties.parameters ?? {}).map(([parameterKey, parameterValue]) => ({
-                    ParameterKey: parameterKey,
-                    ParameterValue: parameterValue,
-                })),
-            },
-        }, properties.cdkOutContext, properties.bindings, properties.caller);
+        await this.createStackWithContext(properties);
         const stack = this.stacks.get(properties.stackName);
         assertDefined(stack, `Sim CloudFormation Stack named ${properties.stackName}`);
         await stack.waitForDeployComplete();
         return stack;
     }
-    async createStackWithContext(command, cdkOutContext, bindings, caller) {
+    async createStackWithContext(deployment) {
         const handler = new CreateStackCommandHandler({
             simAws: this.simAws,
             accountRegionScope: this.accountRegionScope,
             stacks: this.stacks,
             background: this.background,
-            cdkOutContext,
-            bindings,
-            caller,
+            cdkOutContext: deployment.cdkOutContext,
+            bindings: deployment.bindings,
+            caller: deployment.caller,
+            resourceOrder: deployment.resourceOrder,
             exports: this.exports,
         });
-        return await handler.handle(command);
+        return await handler.handle({
+            input: {
+                StackName: deployment.stackName,
+                TemplateBody: jsonStringify(deployment.template),
+                Parameters: Object.entries(deployment.parameters ?? {}).map(([parameterKey, parameterValue]) => ({
+                    ParameterKey: parameterKey,
+                    ParameterValue: parameterValue,
+                })),
+            },
+        });
     }
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.d.ts

@@ -5,6 +5,7 @@ import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnTemplateFileWatchOptions } from "../watch/sim-cfn-template-watch.type.js";
 import { type SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
+import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 export interface SimCloudFormationDeployTemplateFileProperties {
     readonly templatePath: string;
     readonly stackName?: SimCloudFormationStackName | string | undefined;
@@ -19,6 +20,16 @@ export interface SimCloudFormationDeployTemplateFileProperties {
      * policy denying an Account's root principal then denies.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The order Resources with no dependency between them are created in.
+     *
+     * CloudFormation is free to create them either way round, and the template's
+     * own order is what a deployment does by default. `reversed` starts each
+     * dependency batch from its last Resource, so a Stack that only deploys in
+     * the order its template happens to be written fails here rather than in the
+     * account. Declared dependencies and `DependsOn` are honoured either way.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     /**
      * Adapt the parsed template before it is deployed, and again every time a
      * watched file changes.
@@ -53,6 +64,7 @@ export interface SimCfnLoadedTemplateFile {
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     readonly caller?: SimAwsCaller | undefined;
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.js

@@ -16,7 +16,7 @@ export class SimCfnTemplateFileLoader {
      */
     async load(properties) {
         const deployment = simCfnTemplateFileDeployment(properties);
-        const { templatePath, parameters, bindings, caller } = deployment;
+        const { templatePath, parameters, bindings, caller, resourceOrder } = deployment;
         const stackName = deployment.stackName ?? stackNameFromTemplatePath(templatePath);
         // The template is named to a `yulin watch` supervisor, so re-synthing a
         // stack restarts the process that deployed it. Nothing happens outside
@@ -32,6 +32,7 @@ export class SimCfnTemplateFileLoader {
             parameters,
             bindings,
             caller,
+            resourceOrder,
             cdkOutContext,
         };
     }

package/dist/service/cloudformation/resource/cfn/cloudfront/sim-cloudfront-cache-policy-cfn.d.ts

@@ -0,0 +1,23 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SimCloudFrontCachePolicy } from "../../../../cloudfront/cache-policy/sim-cf-cache-policy.js";
+import type { SimCfnResourceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+interface SimCloudFrontCachePolicyCfnProperties {
+    readonly policy: SimCloudFrontCachePolicy;
+}
+/**
+ * CloudFormation-facing behavior for an AWS::CloudFront::CachePolicy Resource.
+ */
+export declare class SimCloudFrontCachePolicyCfn implements SimCfnResourceValueAdapter {
+    private readonly policy;
+    constructor(properties: SimCloudFrontCachePolicyCfnProperties);
+    /**
+     * CloudFormation Ref for AWS::CloudFront::CachePolicy returns the policy ID,
+     * which is what a Cache Behavior's CachePolicyId wants.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * CloudFormation attributes for AWS::CloudFront::CachePolicy.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+export {};

package/dist/service/cloudformation/resource/cfn/cloudfront/sim-cloudfront-cache-policy-cfn.js

@@ -0,0 +1,30 @@
+/**
+ * CloudFormation-facing behavior for an AWS::CloudFront::CachePolicy Resource.
+ */
+export class SimCloudFrontCachePolicyCfn {
+    policy;
+    constructor(properties) {
+        this.policy = properties.policy;
+    }
+    /**
+     * CloudFormation Ref for AWS::CloudFront::CachePolicy returns the policy ID,
+     * which is what a Cache Behavior's CachePolicyId wants.
+     */
+    refValue() {
+        return this.policy.id;
+    }
+    /**
+     * CloudFormation attributes for AWS::CloudFront::CachePolicy.
+     */
+    attributeValue(attributeName) {
+        switch (attributeName) {
+            case "Id": {
+                return this.policy.id;
+            }
+            default: {
+                /* v8 ignore next */
+                return `${this.policy.id}.${attributeName}`;
+            }
+        }
+    }
+}

package/dist/service/cloudformation/resource/cfn/cloudfront/sim-cloudfront-cfn-value-adapter.js

@@ -4,6 +4,8 @@ import { SimCloudFrontFunction } from "../../../../cloudfront/cff/sim-cloudfront
 import { SimCloudFrontFunctionCfn } from "./sim-cloudfront-function-cfn.js";
 import { SimCloudFrontResponseHeadersPolicy } from "../../../../cloudfront/response-headers-policy/sim-cf-response-headers-policy.js";
 import { SimCloudFrontResponseHeadersPolicyCfn } from "./sim-cloudfront-rh-policy-cfn.js";
+import { SimCloudFrontCachePolicy } from "../../../../cloudfront/cache-policy/sim-cf-cache-policy.js";
+import { SimCloudFrontCachePolicyCfn } from "./sim-cloudfront-cache-policy-cfn.js";
 import { SimCloudFrontOriginAccessControl } from "../../../../cloudfront/origin-access-control/sim-cf-origin-access-control.js";
 import { SimCloudFrontOriginAccessControlCfn } from "./sim-cloudfront-oac-cfn.js";
 import { SimCloudFrontKeyValueStore } from "../../../../cloudfront/key-value-store/sim-cf-key-value-store.js";
@@ -28,6 +30,12 @@ export function cloudFrontValueAdapter(properties) {
             policy: properties.simResource,
         });
     }
+    if (properties.type === "AWS::CloudFront::CachePolicy" &&
+        properties.simResource instanceof SimCloudFrontCachePolicy) {
+        return new SimCloudFrontCachePolicyCfn({
+            policy: properties.simResource,
+        });
+    }
     if (properties.type === "AWS::CloudFront::OriginAccessControl" &&
         properties.simResource instanceof SimCloudFrontOriginAccessControl) {
         return new SimCloudFrontOriginAccessControlCfn({

package/dist/service/cloudformation/resource/name/sim-cfn-generated-resource-name.d.ts

@@ -6,18 +6,25 @@ interface SimCfnGeneratedResourceNameProperties {
 /**
  * The name CloudFormation gives a Resource whose template does not name it.
  *
- * Real CloudFormation generates `<stack name>-<logical ID>-<random>`. The
- * random part is left out here so a test can predict the name, which is the one
- * thing a template cannot rely on for real. Everything else follows AWS: two
+ * CloudFormation generates `<stack name>-<logical ID>-<random>`. The tail here
+ * is a hash of the other two parts rather than random characters. The same
+ * template deployed under the same stack name generates the same name again,
+ * and a test can read it back and compare. Everything else follows AWS. Two
  * stacks deploying the same template get different names, because the stack
  * name is part of it.
  *
- * Each service has its own limit on how long a name can be, so a long stack
- * name and logical ID together are trimmed to fit. The start is kept, since
- * that is where the stack name is, and the trimmed name ends in a hash of the
- * untrimmed one. CDK puts its own disambiguating hash at the end of a logical
- * ID, which is exactly what trimming cuts off, so without that two Resources in
- * one stack could end up asking for the same name.
+ * Each service has its own limit on how long a name can be, and CloudFormation
+ * reserves the last thirteen characters of it for the tail and its hyphen. What
+ * is left over goes to the stack name and the logical ID either side of one
+ * more hyphen, half each, the stack name rounding up and either taking what the
+ * other does not use. Where a service allows 64 characters, a long stack name
+ * and a long logical ID keep 25 each. The rule is inferred from names real
+ * CloudFormation produced, since AWS documents none of it.
+ *
+ * The tail is derived from the whole untrimmed name. That is what keeps two
+ * trimmed names apart. CDK puts its own disambiguating hash at the end of a
+ * logical ID, which is exactly what trimming cuts off, so without that two
+ * Resources in one stack could end up asking for the same name.
  */
 export declare class SimCfnGeneratedResourceName {
     private readonly stackName;
@@ -29,12 +36,22 @@ export declare class SimCfnGeneratedResourceName {
      */
     get value(): string;
     /**
-     * The tail a trimmed name ends with, derived from the whole untrimmed name.
+     * The stack name and logical ID, trimmed to the room the tail leaves them.
+     *
+     * A name that already fits is kept whole. One that does not gives each part
+     * half of what is left. The stack name is trimmed rather than lost, since
+     * that is the part an IAM policy scoped by resource prefix matches on.
+     */
+    private trimmed;
+    /**
+     * The tail the name ends with, derived from the whole untrimmed name.
      *
      * It is a hash rather than the random characters real CloudFormation uses, so
-     * the name stays the same between deployments of the same template.
+     * the name stays the same between deployments of the same template. Hex
+     * suits every service, since one that only allows lowercase takes it as it
+     * is.
      */
-    private distinguisher;
+    private tail;
     /**
      * The name before it is trimmed to the length the service allows.
      *

package/dist/service/cloudformation/resource/name/sim-cfn-generated-resource-name.js

@@ -1,24 +1,31 @@
 import { createHash } from "node:crypto";
 /**
- * How many characters of the hash of the untrimmed name a trimmed one ends
- * with, so two long names that start the same do not become one name.
+ * How many characters the tail on the end of a generated name is, which is as
+ * many as the random characters real CloudFormation ends one with.
  */
-const distinguisherLength = 8;
+const tailLength = 12;
 /**
  * The name CloudFormation gives a Resource whose template does not name it.
  *
- * Real CloudFormation generates `<stack name>-<logical ID>-<random>`. The
- * random part is left out here so a test can predict the name, which is the one
- * thing a template cannot rely on for real. Everything else follows AWS: two
+ * CloudFormation generates `<stack name>-<logical ID>-<random>`. The tail here
+ * is a hash of the other two parts rather than random characters. The same
+ * template deployed under the same stack name generates the same name again,
+ * and a test can read it back and compare. Everything else follows AWS. Two
  * stacks deploying the same template get different names, because the stack
  * name is part of it.
  *
- * Each service has its own limit on how long a name can be, so a long stack
- * name and logical ID together are trimmed to fit. The start is kept, since
- * that is where the stack name is, and the trimmed name ends in a hash of the
- * untrimmed one. CDK puts its own disambiguating hash at the end of a logical
- * ID, which is exactly what trimming cuts off, so without that two Resources in
- * one stack could end up asking for the same name.
+ * Each service has its own limit on how long a name can be, and CloudFormation
+ * reserves the last thirteen characters of it for the tail and its hyphen. What
+ * is left over goes to the stack name and the logical ID either side of one
+ * more hyphen, half each, the stack name rounding up and either taking what the
+ * other does not use. Where a service allows 64 characters, a long stack name
+ * and a long logical ID keep 25 each. The rule is inferred from names real
+ * CloudFormation produced, since AWS documents none of it.
+ *
+ * The tail is derived from the whole untrimmed name. That is what keeps two
+ * trimmed names apart. CDK puts its own disambiguating hash at the end of a
+ * logical ID, which is exactly what trimming cuts off, so without that two
+ * Resources in one stack could end up asking for the same name.
  */
 export class SimCfnGeneratedResourceName {
     stackName;
@@ -33,24 +40,48 @@ export class SimCfnGeneratedResourceName {
      * The generated name.
      */
     get value() {
+        const tail = this.tail();
+        if (this.maximumLength <= tailLength + 1) {
+            return tail.slice(0, this.maximumLength);
+        }
+        return `${this.trimmed()}-${tail}`;
+    }
+    /**
+     * The stack name and logical ID, trimmed to the room the tail leaves them.
+     *
+     * A name that already fits is kept whole. One that does not gives each part
+     * half of what is left. The stack name is trimmed rather than lost, since
+     * that is the part an IAM policy scoped by resource prefix matches on.
+     */
+    trimmed() {
         const composed = this.composed();
-        if (composed.length <= this.maximumLength) {
+        const budget = this.maximumLength - tailLength - 1;
+        if (composed.length <= budget) {
             return composed;
         }
-        const kept = composed.slice(0, this.maximumLength - distinguisherLength - 1);
-        return `${kept}-${this.distinguisher(composed)}`;
+        if (this.stackName === undefined || this.stackName === "") {
+            return composed.slice(0, budget);
+        }
+        const shared = budget - 1;
+        const stackNameKept = Math.min(this.stackName.length, shared - Math.min(this.logicalId.length, Math.floor(shared / 2)));
+        return [
+            this.stackName.slice(0, stackNameKept),
+            this.logicalId.slice(0, shared - stackNameKept),
+        ].join("-");
     }
     /**
-     * The tail a trimmed name ends with, derived from the whole untrimmed name.
+     * The tail the name ends with, derived from the whole untrimmed name.
      *
      * It is a hash rather than the random characters real CloudFormation uses, so
-     * the name stays the same between deployments of the same template.
+     * the name stays the same between deployments of the same template. Hex
+     * suits every service, since one that only allows lowercase takes it as it
+     * is.
      */
-    distinguisher(composed) {
+    tail() {
         return createHash("sha1")
-            .update(composed)
+            .update(this.composed())
             .digest("hex")
-            .slice(0, distinguisherLength);
+            .slice(0, tailLength);
     }
     /**
      * The name before it is trimmed to the length the service allows.

package/dist/service/cloudformation/stack/deploy/sim-cfn-resource-order.d.ts

@@ -0,0 +1,19 @@
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+/**
+ * The order the Resources in one dependency batch are started in.
+ *
+ * CloudFormation creates Resources with no dependency between them in whatever
+ * order it likes, so a template whose Resources only work in the order it wrote
+ * them deploys some of the time. `template` is the order the template declared,
+ * which is what a deployment does unless it is asked for something else.
+ * `reversed` starts each batch from its last Resource, which is the other order
+ * a pair with nothing between them could be created in.
+ *
+ * Dependencies are unaffected either way: a Resource still waits for everything
+ * it refers to and everything its `DependsOn` names.
+ */
+export type SimCfnResourceOrder = "template" | "reversed";
+/**
+ * The Resources of one batch, in the order the deployment asked for.
+ */
+export declare function simCfnOrderedResources(resources: readonly SimCfnResource[], order: SimCfnResourceOrder | undefined): readonly SimCfnResource[];

package/dist/service/cloudformation/stack/deploy/sim-cfn-resource-order.js

@@ -0,0 +1,6 @@
+/**
+ * The Resources of one batch, in the order the deployment asked for.
+ */
+export function simCfnOrderedResources(resources, order) {
+    return order === "reversed" ? resources.toReversed() : resources;
+}