@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/aws/caller/sim-aws-ambient-caller.d.ts

@@ -0,0 +1,23 @@
+import type { SimAwsPrincipal } from "./sim-aws-caller.js";
+import { type SimAwsRunAsOwner } from "./sim-aws-run-as-context.js";
+/**
+ * Where a call that names no caller of its own looks for one first.
+ *
+ * A `SimAws.runAs` block is what sets an ambient caller today. Asking through
+ * this interface keeps the resolver clear of Node.js asynchronous context
+ * tracking, and leaves room for the other thing that will set one, a simulated
+ * Lambda invocation running under an execution role.
+ */
+export interface SimAwsAmbientCaller {
+    /**
+     * The caller ambient where the call is being made, if there is one.
+     */
+    currentCaller(): SimAwsPrincipal | undefined;
+}
+/**
+ * The ambient caller of the `runAs` block one simulation is inside.
+ *
+ * Only that simulation's own runs count. Each SimAws instance is its own
+ * simulated universe, so a `runAs` on one never decides what another observes.
+ */
+export declare function simAwsRunAsAmbientCaller(owner: SimAwsRunAsOwner): SimAwsAmbientCaller;

package/dist/service/aws/caller/sim-aws-ambient-caller.js

@@ -0,0 +1,12 @@
+import { simAwsRunAsContext, } from "./sim-aws-run-as-context.js";
+/**
+ * The ambient caller of the `runAs` block one simulation is inside.
+ *
+ * Only that simulation's own runs count. Each SimAws instance is its own
+ * simulated universe, so a `runAs` on one never decides what another observes.
+ */
+export function simAwsRunAsAmbientCaller(owner) {
+    return {
+        currentCaller: () => simAwsRunAsContext.currentCaller(owner),
+    };
+}

package/dist/service/aws/caller/sim-aws-caller-resolver.d.ts

@@ -1,3 +1,4 @@
+import type { SimAwsAmbientCaller } from "./sim-aws-ambient-caller.js";
 import type { SimAwsCaller, SimAwsDefaultCaller, SimAwsPrincipal, SimCredentialCaller } from "./sim-aws-caller.js";
 import type { SimIamCredentialIdentity } from "../../iam/credential/sim-aws-credentials.js";
 export interface SimAwsCredentialIdentityResolver {
@@ -33,25 +34,35 @@ export interface SimAwsCallerResolverProperties {
      * default caller keeps the Account root fallback.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     *
+     * A `runAs` block says who is making the calls inside it, which is more
+     * specific than what a simulation holds for its unattributed calls
+     * generally, so it is consulted first.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
 }
 /**
  * Resolves caller input at a simulated AWS operation boundary.
  *
- * An omitted caller resolves to the simulation's default caller, and to the
- * supplied operation default where there is none. Explicit anonymity is
- * preserved. Credential callers are authenticated before a resolved caller is
- * returned, and a caller already resolved elsewhere is taken as it stands.
+ * An omitted caller resolves to the ambient caller of the `runAs` block the
+ * call is inside, then to the simulation's default caller, and to the supplied
+ * operation default where there is neither. Explicit anonymity is preserved.
+ * Credential callers are authenticated before a resolved caller is returned,
+ * and a caller already resolved elsewhere is taken as it stands.
  */
 export declare class SimAwsCallerResolver {
     private readonly credentialIdentityResolver?;
     private readonly defaultCaller?;
+    private readonly ambientCaller?;
     constructor(properties?: SimAwsCallerResolverProperties);
     /**
      * Resolve and normalize a simulated AWS caller.
      *
      * The request's own caller is used where it has one. A request without one
-     * falls back to the simulation's default caller, and then to the operation
-     * default the call site supplies.
+     * falls back to the ambient `runAs` caller, then to the simulation's default
+     * caller, and then to the operation default the call site supplies.
      */
     resolve(caller: SimAwsCaller | undefined, defaultPrincipal: SimAwsPrincipal): SimAwsResolvedCaller;
     private normalized;

package/dist/service/aws/caller/sim-aws-caller-resolver.js

@@ -2,27 +2,30 @@ import { assertDefined } from "../../../util/type-guard/defined.js";
 /**
  * Resolves caller input at a simulated AWS operation boundary.
  *
- * An omitted caller resolves to the simulation's default caller, and to the
- * supplied operation default where there is none. Explicit anonymity is
- * preserved. Credential callers are authenticated before a resolved caller is
- * returned, and a caller already resolved elsewhere is taken as it stands.
+ * An omitted caller resolves to the ambient caller of the `runAs` block the
+ * call is inside, then to the simulation's default caller, and to the supplied
+ * operation default where there is neither. Explicit anonymity is preserved.
+ * Credential callers are authenticated before a resolved caller is returned,
+ * and a caller already resolved elsewhere is taken as it stands.
  */
 export class SimAwsCallerResolver {
     credentialIdentityResolver;
     defaultCaller;
+    ambientCaller;
     constructor(properties = {}) {
         this.credentialIdentityResolver = properties.credentialIdentityResolver;
         this.defaultCaller = properties.defaultCaller;
+        this.ambientCaller = properties.ambientCaller;
     }
     /**
      * Resolve and normalize a simulated AWS caller.
      *
      * The request's own caller is used where it has one. A request without one
-     * falls back to the simulation's default caller, and then to the operation
-     * default the call site supplies.
+     * falls back to the ambient `runAs` caller, then to the simulation's default
+     * caller, and then to the operation default the call site supplies.
      */
     resolve(caller, defaultPrincipal) {
-        const stated = caller ?? this.defaultCaller;
+        const stated = caller ?? this.ambientCaller?.currentCaller() ?? this.defaultCaller;
         if (stated?.kind === "resolved") {
             return this.normalized(stated.principal, stated.identityPolicyPrincipal);
         }
@@ -35,28 +38,20 @@ export class SimAwsCallerResolver {
         return this.normalized(principal, principal);
     }
     normalized(principal, identityPolicyPrincipal) {
-        if (principal.kind === "arn") {
-            const identityPolicyArn = identityPolicyPrincipal.kind === "arn"
-                ? identityPolicyPrincipal.arn
-                : undefined;
-            return {
-                principal,
-                identityPolicyPrincipal,
-                arn: principal.arn,
-                identityPolicyArn,
-                accountId: this.accountId(principal.arn),
-            };
-        }
+        const both = { principal, identityPolicyPrincipal };
         if (principal.kind === "service") {
-            return {
-                principal,
-                identityPolicyPrincipal,
-                service: principal.service,
-            };
+            return { ...both, service: principal.service };
+        }
+        if (principal.kind !== "arn") {
+            return both;
         }
         return {
-            principal,
-            identityPolicyPrincipal,
+            ...both,
+            arn: principal.arn,
+            identityPolicyArn: identityPolicyPrincipal.kind === "arn"
+                ? identityPolicyPrincipal.arn
+                : undefined,
+            accountId: this.accountId(principal.arn),
         };
     }
     /**

package/dist/service/aws/factory/sim-aws-account-region-service-builder.d.ts

@@ -2,6 +2,7 @@ import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/bac
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import type { SimAws } from "../sim-aws.js";
 import type { SimAwsDefaultCaller } from "../caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../caller/sim-aws-ambient-caller.js";
 import { SimCloudFormation } from "../../cloudformation/index.js";
 import { SimCloudWatch } from "../../cloudwatch/index.js";
 import { SimCognitoIdentityProvider } from "../../cognito/index.js";
@@ -35,6 +36,10 @@ interface SimAwsAccountRegionServiceBuilderProperties {
      * The caller this simulation attributes a request naming none to.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
 }
 /**
  * Builder for simulated AWS services scoped to one Account and Region.
@@ -67,6 +72,7 @@ export declare class SimAwsAccountRegionServiceBuilder {
     private readonly accountServices;
     private readonly messageLog;
     private readonly defaultCaller?;
+    private readonly ambientCaller?;
     constructor(properties: SimAwsAccountRegionServiceBuilderProperties);
     /** Create simulated ACM for an Account Region scope. */
     /** Create simulated CloudFormation for an Account Region scope. */

package/dist/service/aws/factory/sim-aws-account-region-service-builder.js

@@ -56,6 +56,7 @@ export class SimAwsAccountRegionServiceBuilder {
     accountServices;
     messageLog;
     defaultCaller;
+    ambientCaller;
     constructor(properties) {
         this.simAws = properties.simAws;
         this.background = properties.background;
@@ -65,6 +66,7 @@ export class SimAwsAccountRegionServiceBuilder {
         this.accountServices = properties.accountServices;
         this.messageLog = properties.messageLog;
         this.defaultCaller = properties.defaultCaller;
+        this.ambientCaller = properties.ambientCaller;
     }
     /** Create simulated ACM for an Account Region scope. */
     /** Create simulated CloudFormation for an Account Region scope. */
@@ -272,6 +274,7 @@ export class SimAwsAccountRegionServiceBuilder {
             background: this.background,
             iamResolver: this.iamRegistry,
             defaultCaller: this.defaultCaller,
+            ambientCaller: this.ambientCaller,
         });
     }
     /**

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts

@@ -2,6 +2,7 @@ import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/bac
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import type { SimAws } from "../sim-aws.js";
 import type { SimAwsDefaultCaller } from "../caller/sim-aws-caller.js";
+import type { SimAwsAmbientCaller } from "../caller/sim-aws-ambient-caller.js";
 import type { SimAcmRegistry } from "../../acm/registry/sim-acm-registry.js";
 import type { SimCloudFrontRegistry } from "../../cloudfront/registry/sim-cloud-front-registry.js";
 import { SimCloudFront } from "../../cloudfront/sim-cloudfront.js";
@@ -30,6 +31,10 @@ interface SimAwsAccountServiceCacheProperties {
      * The caller this simulation attributes a request naming none to.
      */
     readonly defaultCaller?: SimAwsDefaultCaller | undefined;
+    /**
+     * Where a request naming no caller looks before the default.
+     */
+    readonly ambientCaller?: SimAwsAmbientCaller | undefined;
 }
 /**
  * Account-level cache for simulated AWS service instances.
@@ -61,6 +66,7 @@ export declare class SimAwsAccountServiceCache {
     private readonly accessKeyRegistry;
     private readonly scpResolver;
     private readonly defaultCaller?;
+    private readonly ambientCaller?;
     private readonly route53Registry;
     private readonly kmsRegistry;
     private readonly serviceHosts;

package/dist/service/aws/factory/sim-aws-account-service-cache.js

@@ -39,6 +39,7 @@ export class SimAwsAccountServiceCache {
     accessKeyRegistry;
     scpResolver;
     defaultCaller;
+    ambientCaller;
     route53Registry;
     kmsRegistry;
     serviceHosts;
@@ -59,6 +60,7 @@ export class SimAwsAccountServiceCache {
         this.iamRegistry = properties.iamRegistry;
         this.scpResolver = properties.scpResolver;
         this.defaultCaller = properties.defaultCaller;
+        this.ambientCaller = properties.ambientCaller;
         this.accessKeyRegistry = properties.accessKeyRegistry;
         this.route53Registry = properties.route53Registry;
         this.kmsRegistry = properties.kmsRegistry;
@@ -117,8 +119,10 @@ export class SimAwsAccountServiceCache {
                 // the Account, so IAM asks simulated Organizations about it.
                 scpResolver: this.scpResolver,
                 // Who a request naming no caller comes from is decided for the
-                // whole simulation. Every Account in it applies the same default.
+                // whole simulation. Every Account in it applies the same default,
+                // and answers to the same run-as block ahead of it.
                 defaultCaller: this.defaultCaller,
+                ambientCaller: this.ambientCaller,
                 // Access keys are indexed simulation-wide as they are issued, so a
                 // signed request naming only a key id can be traced to this Account.
                 credentialRegistry: new SimIamCredentialRegistry({

package/dist/service/aws/factory/sim-aws-registered-service-builder.js

@@ -82,8 +82,10 @@ export class SimAwsRegisteredServiceBuilder {
      * nothing but that URI, and the function need not be in this scope.
      */
     createEcr(scope) {
+        const { accountRegionScope, iam } = this.scoped(scope);
         return new SimEcr({
-            accountRegionScope: scope.accountRegionScope,
+            accountRegionScope,
+            iam,
             registry: this.registries.ecr,
         });
     }

package/dist/service/aws/factory/sim-aws-service-factory.js

@@ -1,3 +1,4 @@
+import { simAwsRunAsAmbientCaller } from "../caller/sim-aws-ambient-caller.js";
 import { SimCloudFrontRegistry } from "../../cloudfront/registry/sim-cloud-front-registry.js";
 import { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
 import { SimOrganizations } from "../../organizations/index.js";
@@ -88,6 +89,10 @@ export class SimAwsServiceFactory {
     registeredServices;
     selfContainedServices;
     constructor(properties) {
+        // Where a request naming no caller of its own looks before the default.
+        // Keyed on the SimAws instance, so a run-as on one simulation decides
+        // nothing in another.
+        const ambientCaller = simAwsRunAsAmbientCaller(properties.simAws);
         this.accountServices = new SimAwsAccountServiceCache({
             simAws: properties.simAws,
             background: properties.background,
@@ -107,13 +112,16 @@ export class SimAwsServiceFactory {
             // Simulated IAM applies this wherever a request names no caller of its
             // own, in place of the Account root it would otherwise be decided as.
             defaultCaller: properties.defaultCaller,
+            ambientCaller,
         });
         this.accountRegionServices = new SimAwsAccountRegionServiceBuilder({
             simAws: properties.simAws,
             background: properties.background,
             // STS reports and evaluates the same default. An unattributed
-            // GetCallerIdentity answers with the principal everything else uses.
+            // GetCallerIdentity answers with the principal everything else uses,
+            // the ambient run-as caller included.
             defaultCaller: properties.defaultCaller,
+            ambientCaller,
             registries: this.registries,
             iamRegistry: this.iamRegistry,
             lambdaUrlRegistry: this.lambdaUrlRegistry,

package/dist/service/cloudformation/command/create-stack/create-stack.handler.d.ts

@@ -8,6 +8,7 @@ import type { SimCreateStackCommand, SimCreateStackCommandOutput } from "./creat
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../../bind/sim-cfn-binding.js";
 import type { SimCfnExports } from "../../export/sim-cfn-exports.js";
+import type { SimCfnResourceOrder } from "../../stack/deploy/sim-cfn-resource-order.js";
 interface CreateStackCommandHandlerProperties {
     readonly simAws: SimAws;
     readonly accountRegionScope: SimAwsAccountRegionScope;
@@ -17,6 +18,8 @@ interface CreateStackCommandHandlerProperties {
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     /** The principal the Stack's Resources are created as. */
     readonly caller?: SimAwsCaller | undefined;
+    /** The order Resources with no dependency between them are started in. */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly exports?: SimCfnExports | undefined;
 }
 /**
@@ -32,6 +35,7 @@ export declare class CreateStackCommandHandler implements CommandHandler<SimCrea
     private readonly cdkOutContext;
     private readonly bindings;
     private readonly caller;
+    private readonly resourceOrder;
     private readonly exports;
     constructor(properties: CreateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/create-stack/create-stack.handler.js

@@ -17,9 +17,10 @@ export class CreateStackCommandHandler {
     cdkOutContext;
     bindings;
     caller;
+    resourceOrder;
     exports;
     constructor(properties) {
-        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, exports, } = properties;
+        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, resourceOrder, exports, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stacks = stacks;
@@ -27,6 +28,7 @@ export class CreateStackCommandHandler {
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
         this.caller = caller;
+        this.resourceOrder = resourceOrder;
         this.exports = exports;
     }
     /**
@@ -63,6 +65,7 @@ export class CreateStackCommandHandler {
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
             caller: this.caller,
+            resourceOrder: this.resourceOrder,
             exports: this.exports,
         });
         this.stacks.set(stack.stackName, stack);

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-deployer.js

@@ -27,7 +27,7 @@ export class SimCfnCdkOutDeployer {
     }
     async deployStack(stack, plan, deployed) {
         const { simAws, accountRegionScope } = this.scope;
-        const { transform, caller, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
+        const { transform, caller, resourceOrder, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
         return await simAws
             .accountRegionScope(accountRegionScope.accountId, stack.regionName)
             .cloudFormation()
@@ -36,6 +36,7 @@ export class SimCfnCdkOutDeployer {
             stackName: stack.stackName,
             ...options,
             caller: caller ?? plan.caller,
+            resourceOrder: resourceOrder ?? plan.resourceOrder,
             transform: cdkOutBoundTransform(transform, deployed),
         });
     }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.d.ts

@@ -2,6 +2,7 @@ import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import { type SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
 import { type SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
+import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 export interface SimCloudFormationDeployCdkOutProperties {
     /** The `cdk.out` directory to deploy, holding a `manifest.json`. */
     readonly directoryPath: string;
@@ -23,8 +24,15 @@ export interface SimCloudFormationDeployCdkOutProperties {
      */
     readonly caller?: SimAwsCaller | undefined;
     /**
-     * Bindings, parameters, a caller and a transform for individual Stacks,
-     * keyed the same way `stackNames` names them.
+     * The order every Stack in the assembly creates Resources with no dependency
+     * between them in, which one named in `stackOptions` overrides for its own
+     * Stack. `reversed` deploys each Stack the other way round from the one its
+     * template is written in.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
+    /**
+     * Bindings, parameters, a caller, a Resource order and a transform for
+     * individual Stacks, keyed the same way `stackNames` names them.
      */
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
@@ -35,6 +43,7 @@ export interface SimCfnCdkOutPlannedStack extends SimCdkAssemblyStack {
 export interface SimCfnCdkOutPlan {
     readonly stacks: readonly SimCfnCdkOutPlannedStack[];
     readonly caller?: SimAwsCaller | undefined;
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.js

@@ -10,7 +10,7 @@ import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options
  * an assembly that cannot be deployed says so before any Stack is created.
  */
 export async function planCdkOutDeployment(properties) {
-    const { directoryPath, stackNames, caller, stackOptions } = cdkOutDeployment(properties.request);
+    const { directoryPath, stackNames, caller, resourceOrder, stackOptions } = cdkOutDeployment(properties.request);
     const selected = selectCdkAssemblyStacks({
         stacks: await loadCdkAssemblyStacks(directoryPath),
         stackNames,
@@ -23,6 +23,7 @@ export async function planCdkOutDeployment(properties) {
             regionName: stack.regionName ?? properties.defaultRegionName,
         })),
         caller,
+        resourceOrder,
         stackOptions,
     };
 }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.d.ts

@@ -4,6 +4,7 @@ import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnDeployedStack } from "../stack/sim-cfn-deployed-stack.type.js";
 import type { CfnTemplateBodyRecord } from "../template/sim-cfn-template.js";
 import type { SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
+import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 /**
  * Adapts one Stack's parsed template, with the Stacks the same call has already
  * deployed to hand.
@@ -33,6 +34,11 @@ export interface SimCfnCdkOutStackOptions {
      * application Stack deployed by another is what this is for.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The order this Stack creates Resources with no dependency between them in,
+     * where the assembly's own order is not the right one for it.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly transform?: SimCfnCdkOutTemplateTransform | undefined;
 }
 export type SimCfnCdkOutStackOptionsByName = Record<string, SimCfnCdkOutStackOptions>;

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.d.ts

@@ -9,6 +9,7 @@ import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { BackgroundCompleter, BackgroundScheduler } from "../../../util/background/background.js";
 import type { SimCfnExports } from "../export/sim-cfn-exports.js";
+import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 export interface SimCloudFormationCreateStackProperties {
     readonly stackName?: SimCloudFormationStackName | string;
     readonly template: CfnTemplateBodyRecord;
@@ -23,6 +24,16 @@ export interface SimCloudFormationCreateStackProperties {
      * policy denying an Account's root principal then denies.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The order Resources with no dependency between them are created in.
+     *
+     * CloudFormation is free to create them either way round, and the template's
+     * own order is what a deployment does by default. `reversed` starts each
+     * dependency batch from its last Resource, so a Stack that only deploys in
+     * the order its template happens to be written fails here rather than in the
+     * account. Declared dependencies and `DependsOn` are honoured either way.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     /**
      * The synthesized CDK template file this in-memory template stands in for.
      *

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.js

@@ -59,6 +59,7 @@ export class SimCloudFormationTemplateDeployer {
             parameters: properties.parameters,
             bindings: properties.bindings,
             caller: properties.caller,
+            resourceOrder: properties.resourceOrder,
             cdkOutContext: await cdkOutContextForTemplatePath(properties.templatePath),
         });
     }
@@ -102,33 +103,34 @@ export class SimCloudFormationTemplateDeployer {
         this.watches.stopAll();
     }
     async deployTemplateWithContext(properties) {
-        await this.createStackWithContext({
-            input: {
-                StackName: properties.stackName,
-                TemplateBody: jsonStringify(properties.template),
-                Parameters: Object.entries(properties.parameters ?? {}).map(([parameterKey, parameterValue]) => ({
-                    ParameterKey: parameterKey,
-                    ParameterValue: parameterValue,
-                })),
-            },
-        }, properties.cdkOutContext, properties.bindings, properties.caller);
+        await this.createStackWithContext(properties);
         const stack = this.stacks.get(properties.stackName);
         assertDefined(stack, `Sim CloudFormation Stack named ${properties.stackName}`);
         await stack.waitForDeployComplete();
         return stack;
     }
-    async createStackWithContext(command, cdkOutContext, bindings, caller) {
+    async createStackWithContext(deployment) {
         const handler = new CreateStackCommandHandler({
             simAws: this.simAws,
             accountRegionScope: this.accountRegionScope,
             stacks: this.stacks,
             background: this.background,
-            cdkOutContext,
-            bindings,
-            caller,
+            cdkOutContext: deployment.cdkOutContext,
+            bindings: deployment.bindings,
+            caller: deployment.caller,
+            resourceOrder: deployment.resourceOrder,
             exports: this.exports,
         });
-        return await handler.handle(command);
+        return await handler.handle({
+            input: {
+                StackName: deployment.stackName,
+                TemplateBody: jsonStringify(deployment.template),
+                Parameters: Object.entries(deployment.parameters ?? {}).map(([parameterKey, parameterValue]) => ({
+                    ParameterKey: parameterKey,
+                    ParameterValue: parameterValue,
+                })),
+            },
+        });
     }
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.d.ts

@@ -5,6 +5,7 @@ import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import type { SimCfnTemplateFileWatchOptions } from "../watch/sim-cfn-template-watch.type.js";
 import { type SimCfnTemplateFileTransform } from "./sim-cfn-template-file-transform.js";
+import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 export interface SimCloudFormationDeployTemplateFileProperties {
     readonly templatePath: string;
     readonly stackName?: SimCloudFormationStackName | string | undefined;
@@ -19,6 +20,16 @@ export interface SimCloudFormationDeployTemplateFileProperties {
      * policy denying an Account's root principal then denies.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The order Resources with no dependency between them are created in.
+     *
+     * CloudFormation is free to create them either way round, and the template's
+     * own order is what a deployment does by default. `reversed` starts each
+     * dependency batch from its last Resource, so a Stack that only deploys in
+     * the order its template happens to be written fails here rather than in the
+     * account. Declared dependencies and `DependsOn` are honoured either way.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     /**
      * Adapt the parsed template before it is deployed, and again every time a
      * watched file changes.
@@ -53,6 +64,7 @@ export interface SimCfnLoadedTemplateFile {
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     readonly caller?: SimAwsCaller | undefined;
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
 }
 /**

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.js

@@ -16,7 +16,7 @@ export class SimCfnTemplateFileLoader {
      */
     async load(properties) {
         const deployment = simCfnTemplateFileDeployment(properties);
-        const { templatePath, parameters, bindings, caller } = deployment;
+        const { templatePath, parameters, bindings, caller, resourceOrder } = deployment;
         const stackName = deployment.stackName ?? stackNameFromTemplatePath(templatePath);
         // The template is named to a `yulin watch` supervisor, so re-synthing a
         // stack restarts the process that deployed it. Nothing happens outside
@@ -32,6 +32,7 @@ export class SimCfnTemplateFileLoader {
             parameters,
             bindings,
             caller,
+            resourceOrder,
             cdkOutContext,
         };
     }

package/dist/service/cloudformation/resource/cfn/cloudfront/sim-cloudfront-cache-policy-cfn.d.ts

@@ -0,0 +1,23 @@
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SimCloudFrontCachePolicy } from "../../../../cloudfront/cache-policy/sim-cf-cache-policy.js";
+import type { SimCfnResourceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+interface SimCloudFrontCachePolicyCfnProperties {
+    readonly policy: SimCloudFrontCachePolicy;
+}
+/**
+ * CloudFormation-facing behavior for an AWS::CloudFront::CachePolicy Resource.
+ */
+export declare class SimCloudFrontCachePolicyCfn implements SimCfnResourceValueAdapter {
+    private readonly policy;
+    constructor(properties: SimCloudFrontCachePolicyCfnProperties);
+    /**
+     * CloudFormation Ref for AWS::CloudFront::CachePolicy returns the policy ID,
+     * which is what a Cache Behavior's CachePolicyId wants.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * CloudFormation attributes for AWS::CloudFront::CachePolicy.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+export {};