@kensio/yulin 1.21.4 → 1.21.6

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.d.ts

@@ -8,12 +8,16 @@ interface SimCdkAssetsPublisherProperties {
     readonly stackName?: string | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     /**
-     * The principal the deployment runs as, which the staging Bucket is created
-     * and written to as. A real `cdk deploy` publishes assets before
-     * CloudFormation sees the template, and it publishes them as somebody; a
-     * deployment that names a caller is what says who.
+     * The principal the assets are published as.
+     *
+     * A real `cdk deploy` publishes assets before CloudFormation sees the
+     * template, as the file publishing Role the assets manifest names in each
+     * destination's `assumeRoleArn`. CloudFormation then processes the template
+     * as the execution Role. A deployment that names an assets caller is what
+     * tells the two apart here, and one that names none publishes as whoever
+     * deploys.
      */
-    readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
 }
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.
@@ -25,7 +29,7 @@ interface SimCdkAssetsPublisherProperties {
  * Lambda function resolves its code through the ordinary sim S3 fetch with no
  * Lambda-specific asset handling.
  *
- * Publishing is byte movement only; nothing here runs asset code. Functions
+ * Publishing is byte movement only. Nothing here runs asset code. Functions
  * sim Lambda cannot run, such as a CDK BucketDeployment provider written in
  * Python, are declined later by the Lambda resource creator on their Runtime.
  */
@@ -42,15 +46,16 @@ export declare class SimCdkAssetsPublisher {
     publish(): Promise<void>;
     private publishAsset;
     /**
-     * Create the staging Bucket if this is the first asset published into it,
+     * Make the staging Bucket if this is the first asset published into it,
      * standing in for the CDK bootstrap stack that provisions it for real.
      *
-     * Stacks deployed concurrently share one staging Bucket, and creating it is
-     * not atomic: sim S3 reaches a sequencing point before registering the
-     * Bucket, so both can pass the check above and the loser is refused. A
-     * Bucket that exists by the time the failure lands is the outcome this
-     * wanted, whoever created it. Anything else, such as the name already being
-     * taken in another scope, is a real failure and is reported.
+     * The bootstrap stack runs long before the deployment, and neither the file
+     * publishing Role nor the execution Role creates this Bucket. It comes
+     * through `makeSimBucket` for that reason, which asks IAM nothing. A
+     * deployment scoped to the permissions its real execution Role holds would
+     * otherwise be refused `s3:CreateBucket` before creating a Resource.
+     *
+     * A name already taken in another scope is a real failure, and is reported.
      */
     private ensureBucket;
     private stagingS3;

package/dist/service/cloudformation/cdk/assets/sim-cdk-assets-publisher.js

@@ -1,7 +1,7 @@
 import { SimCfnPseudoParameters } from "../../parameters/pseudo/sim-cfn-pseudo-parameters.js";
 import { SimCdkAssetPublications, } from "./sim-cdk-asset-publications.js";
 import { readSimCdkAssetBytes } from "./sim-cdk-asset-bytes.js";
-import { simCfnResourceCallerOptions, } from "../../resource/caller/sim-cfn-resource-caller-options.js";
+import { simCfnResourceCallerOptions } from "../../resource/caller/sim-cfn-resource-caller-options.js";
 /**
  * Publishes a CDK cloud assembly's file assets into simulated S3.
  *
@@ -12,7 +12,7 @@ import { simCfnResourceCallerOptions, } from "../../resource/caller/sim-cfn-reso
  * Lambda function resolves its code through the ordinary sim S3 fetch with no
  * Lambda-specific asset handling.
  *
- * Publishing is byte movement only; nothing here runs asset code. Functions
+ * Publishing is byte movement only. Nothing here runs asset code. Functions
  * sim Lambda cannot run, such as a CDK BucketDeployment provider written in
  * Python, are declined later by the Lambda resource creator on their Runtime.
  */
@@ -42,7 +42,7 @@ export class SimCdkAssetsPublisher {
             }),
         }).resolve(cdkOutContext.assetsManifest);
         for (const publication of publications) {
-            // oxlint-disable-next-line no-await-in-loop -- assets sharing a staging Bucket must not race to create it
+            // oxlint-disable-next-line no-await-in-loop -- published in manifest order, as cdk-assets publishes them
             await this.publishAsset(publication);
         }
     }
@@ -52,38 +52,30 @@ export class SimCdkAssetsPublisher {
             return;
         }
         const s3 = this.stagingS3();
-        const options = simCfnResourceCallerOptions(this.properties.caller);
-        await this.ensureBucket(s3, publication.bucketName, options);
+        this.ensureBucket(s3, publication.bucketName);
         await s3.putObject({
             input: {
                 Bucket: publication.bucketName,
                 Key: publication.objectKey,
                 Body: assetBytes,
             },
-        }, options);
+        }, simCfnResourceCallerOptions(this.properties.assetsCaller));
     }
     /**
-     * Create the staging Bucket if this is the first asset published into it,
+     * Make the staging Bucket if this is the first asset published into it,
      * standing in for the CDK bootstrap stack that provisions it for real.
      *
-     * Stacks deployed concurrently share one staging Bucket, and creating it is
-     * not atomic: sim S3 reaches a sequencing point before registering the
-     * Bucket, so both can pass the check above and the loser is refused. A
-     * Bucket that exists by the time the failure lands is the outcome this
-     * wanted, whoever created it. Anything else, such as the name already being
-     * taken in another scope, is a real failure and is reported.
+     * The bootstrap stack runs long before the deployment, and neither the file
+     * publishing Role nor the execution Role creates this Bucket. It comes
+     * through `makeSimBucket` for that reason, which asks IAM nothing. A
+     * deployment scoped to the permissions its real execution Role holds would
+     * otherwise be refused `s3:CreateBucket` before creating a Resource.
+     *
+     * A name already taken in another scope is a real failure, and is reported.
      */
-    async ensureBucket(s3, bucketName, options) {
-        if (s3.getSimBucketByName(bucketName) !== undefined) {
-            return;
-        }
-        try {
-            await s3.createBucket({ input: { Bucket: bucketName } }, options);
-        }
-        catch (error) {
-            if (s3.getSimBucketByName(bucketName) === undefined) {
-                throw error;
-            }
+    ensureBucket(s3, bucketName) {
+        if (s3.getSimBucketByName(bucketName) === undefined) {
+            s3.makeSimBucket(bucketName);
         }
     }
     stagingS3() {

package/dist/service/cloudformation/cdk/sim-cdk-cloud-assembly.factory.d.ts

@@ -1,6 +1,7 @@
 import { AsyncMappedFactory } from "@kensio/part-factory";
 import { TemporaryDirectory } from "../../../util/filesystem/temporary-directory.js";
 import type { SimCfnTemplateValueRecord } from "../template/value/sim-cfn-template-value.js";
+import type { SimCdkAssetsManifest } from "./sim-cdk-out-context.js";
 /**
  * One synthesized Stack in a cloud assembly a test writes.
  */
@@ -25,9 +26,20 @@ export interface SimCdkCloudAssemblyStackInput {
     readonly resources?: SimCfnTemplateValueRecord | undefined;
     /** The template's Outputs, which a Stack sharing a value needs. */
     readonly outputs?: SimCfnTemplateValueRecord | undefined;
+    /**
+     * The assets manifest `cdk synth` writes beside the template, for a Stack
+     * that stages file assets. A Stack given none has no manifest file at all,
+     * which is what a Stack with nothing to stage synthesizes.
+     */
+    readonly assets?: SimCdkAssetsManifest | undefined;
 }
 export interface SimCdkCloudAssemblyInput {
     readonly stacks: readonly SimCdkCloudAssemblyStackInput[];
+    /**
+     * Staged asset files to write into the assembly, keyed by the path an assets
+     * manifest source names.
+     */
+    readonly assetFiles?: Record<string, string> | undefined;
 }
 /** The Bucket a Stack in a written assembly creates, unless it is given others. */
 export declare function assemblyStackBucketName(artifactId: string): string;

package/dist/service/cloudformation/cdk/sim-cdk-cloud-assembly.factory.js

@@ -23,13 +23,19 @@ export function assemblyStackBucketName(artifactId) {
 export const simCdkCloudAssemblyFactory = new AsyncMappedFactory(() => ({ stacks: [{ artifactId: "SiteStack", regionName: "eu-west-2" }] }), async (input) => {
     const directory = new TemporaryDirectory();
     await directory.writeFile(["cdk.out", "manifest.json"], jsonStringify(assemblyManifest(input.stacks)));
-    await Promise.all(input.stacks.map(async (stack) => directory.writeFile(["cdk.out", templateFileName(stack)], 
-    // JSON.stringify drops an undefined value, so a Stack given no
-    // Outputs writes a template with none rather than a null one.
-    jsonStringify({
-        Resources: stackResources(stack),
-        Outputs: stack.outputs,
-    }))));
+    await Promise.all([
+        ...input.stacks.map(async (stack) => directory.writeFile(["cdk.out", templateFileName(stack)], 
+        // JSON.stringify drops an undefined value, so a Stack given no
+        // Outputs writes a template with none rather than a null one.
+        jsonStringify({
+            Resources: stackResources(stack),
+            Outputs: stack.outputs,
+        }))),
+        ...input.stacks
+            .filter((stack) => stack.assets !== undefined)
+            .map(async (stack) => directory.writeFile(["cdk.out", assetsFileName(stack)], jsonStringify(stack.assets))),
+        ...Object.entries(input.assetFiles ?? {}).map(async ([assetPath, content]) => directory.writeFile(["cdk.out", assetPath], content)),
+    ]);
     return directory;
 });
 function assemblyManifest(stacks) {
@@ -56,6 +62,9 @@ function assemblyManifest(stacks) {
 function templateFileName(stack) {
     return `${stack.artifactId}.template.json`;
 }
+function assetsFileName(stack) {
+    return `${stack.artifactId}.assets.json`;
+}
 function stackResources(stack) {
     return (stack.resources ?? {
         [`${stack.artifactId}Bucket`]: {

package/dist/service/cloudformation/command/create-stack/create-stack.handler.d.ts

@@ -18,6 +18,8 @@ interface CreateStackCommandHandlerProperties {
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     /** The principal the Stack's Resources are created as. */
     readonly caller?: SimAwsCaller | undefined;
+    /** The principal the Stack's CDK file assets are published as. */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /** The order Resources with no dependency between them are started in. */
     readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly exports?: SimCfnExports | undefined;
@@ -35,6 +37,7 @@ export declare class CreateStackCommandHandler implements CommandHandler<SimCrea
     private readonly cdkOutContext;
     private readonly bindings;
     private readonly caller;
+    private readonly assetsCaller;
     private readonly resourceOrder;
     private readonly exports;
     constructor(properties: CreateStackCommandHandlerProperties);

package/dist/service/cloudformation/command/create-stack/create-stack.handler.js

@@ -16,10 +16,11 @@ export class CreateStackCommandHandler {
     cdkOutContext;
     bindings;
     caller;
+    assetsCaller;
     resourceOrder;
     exports;
     constructor(properties) {
-        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, resourceOrder, exports, } = properties;
+        const { simAws, accountRegionScope, stacks, background, cdkOutContext, bindings, caller, assetsCaller, resourceOrder, exports, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stacks = stacks;
@@ -27,6 +28,7 @@ export class CreateStackCommandHandler {
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
         this.caller = caller;
+        this.assetsCaller = assetsCaller;
         this.resourceOrder = resourceOrder;
         this.exports = exports;
     }
@@ -65,6 +67,7 @@ export class CreateStackCommandHandler {
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
             caller: this.caller,
+            assetsCaller: this.assetsCaller,
             resourceOrder: this.resourceOrder,
             exports: this.exports,
         });

package/dist/service/cloudformation/command/update-stack/update-stack.handler.d.ts

@@ -22,6 +22,11 @@ interface UpdateStackCommandHandlerProperties {
      * one. Left out, the Stack goes on running as whoever deployed it.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal to publish the re-synthesized CDK file assets as, for an
+     * update that names one. Left out, they are published as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /** The export names published in this Account and Region. */
     readonly exports?: SimCfnExports | undefined;
 }
@@ -37,6 +42,7 @@ export declare class UpdateStackCommandHandler implements CommandHandler<SimUpda
     private readonly background;
     private readonly cdkOutContext;
     private readonly caller;
+    private readonly assetsCaller;
     private readonly exports;
     constructor(properties: UpdateStackCommandHandlerProperties);
     /**

package/dist/service/cloudformation/command/update-stack/update-stack.handler.js

@@ -14,6 +14,7 @@ export class UpdateStackCommandHandler {
     background;
     cdkOutContext;
     caller;
+    assetsCaller;
     exports;
     constructor(properties) {
         this.simAws = properties.simAws;
@@ -22,6 +23,7 @@ export class UpdateStackCommandHandler {
         this.background = properties.background;
         this.cdkOutContext = properties.cdkOutContext;
         this.caller = properties.caller;
+        this.assetsCaller = properties.assetsCaller;
         this.exports = properties.exports;
     }
     /**
@@ -51,7 +53,11 @@ export class UpdateStackCommandHandler {
             stack,
             input: command.input,
             exports: this.exports,
-        }), { cdkOutContext: this.cdkOutContext, caller: this.caller });
+        }), {
+            cdkOutContext: this.cdkOutContext,
+            caller: this.caller,
+            assetsCaller: this.assetsCaller,
+        });
         return {
             StackId: stack.stackId,
             $metadata: {},

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-deployer.js

@@ -27,7 +27,7 @@ export class SimCfnCdkOutDeployer {
     }
     async deployStack(stack, plan, deployed) {
         const { simAws, accountRegionScope } = this.scope;
-        const { transform, caller, resourceOrder, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
+        const { transform, caller, assetsCaller, resourceOrder, ...options } = cdkOutOptionsFor(stack, plan.stackOptions);
         return await simAws
             .accountRegionScope(accountRegionScope.accountId, stack.regionName)
             .cloudFormation()
@@ -36,6 +36,7 @@ export class SimCfnCdkOutDeployer {
             stackName: stack.stackName,
             ...options,
             caller: caller ?? plan.caller,
+            assetsCaller: assetsCaller ?? plan.assetsCaller,
             resourceOrder: resourceOrder ?? plan.resourceOrder,
             transform: cdkOutBoundTransform(transform, deployed),
         });

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-options-deployed.d.ts

@@ -0,0 +1,10 @@
+import type { SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
+import type { SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
+/**
+ * Refuse options keyed against a Stack that is not being deployed.
+ *
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
+ */
+export declare function assertCdkOutOptionsAreDeployed(optionsByName: SimCfnCdkOutStackOptionsByName | undefined, deploying: readonly SimCdkAssemblyStack[]): void;

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-options-deployed.js

@@ -0,0 +1,14 @@
+/**
+ * Refuse options keyed against a Stack that is not being deployed.
+ *
+ * A renamed Stack would otherwise take its bindings, its caller and its
+ * transform with it without saying anything, and the deployment that lost them
+ * looks like one that never had them.
+ */
+export function assertCdkOutOptionsAreDeployed(optionsByName, deploying) {
+    const names = new Set(deploying.flatMap((stack) => [stack.stackName, stack.artifactId]));
+    const unmatched = Object.keys(optionsByName ?? {}).filter((name) => !names.has(name));
+    if (unmatched.length > 0) {
+        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${deploying.map((stack) => stack.stackName).join(", ")}.`);
+    }
+}

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.d.ts

@@ -1,7 +1,7 @@
 import type { AwsRegionName } from "../../aws/sim-aws-region.js";
 import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
 import { type SimCdkAssemblyStack } from "../cdk/sim-cdk-assembly-manifest.js";
-import { type SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
+import type { SimCfnCdkOutStackOptionsByName } from "./sim-cfn-cdk-out-stack-options.js";
 import type { SimCfnResourceOrder } from "../stack/deploy/sim-cfn-resource-order.js";
 export interface SimCloudFormationDeployCdkOutProperties {
     /** The `cdk.out` directory to deploy, holding a `manifest.json`. */
@@ -23,6 +23,15 @@ export interface SimCloudFormationDeployCdkOutProperties {
      * in `stackOptions` overrides for its own Stack.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal every Stack in the assembly publishes its CDK file assets
+     * as, which one named in `stackOptions` overrides for its own Stack.
+     *
+     * A real `cdk deploy` publishes assets as the file publishing Role and
+     * processes each template as the execution Role. Left out, an assembly
+     * publishes its assets as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order every Stack in the assembly creates Resources with no dependency
      * between them in, which one named in `stackOptions` overrides for its own
@@ -43,6 +52,7 @@ export interface SimCfnCdkOutPlannedStack extends SimCdkAssemblyStack {
 export interface SimCfnCdkOutPlan {
     readonly stacks: readonly SimCfnCdkOutPlannedStack[];
     readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
     readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly stackOptions?: SimCfnCdkOutStackOptionsByName | undefined;
 }

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-plan.js

@@ -2,7 +2,7 @@ import path from "node:path";
 import { loadCdkAssemblyStacks, } from "../cdk/sim-cdk-assembly-manifest.js";
 import { orderCdkAssemblyStacks } from "../cdk/sim-cdk-assembly-order.js";
 import { selectCdkAssemblyStacks } from "../cdk/sim-cdk-assembly-selection.js";
-import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options.js";
+import { assertCdkOutOptionsAreDeployed } from "./sim-cfn-cdk-out-options-deployed.js";
 /**
  * Work out which Stacks to deploy, in what order, and into which region.
  *
@@ -10,7 +10,7 @@ import { assertCdkOutOptionsAreDeployed, } from "./sim-cfn-cdk-out-stack-options
  * an assembly that cannot be deployed says so before any Stack is created.
  */
 export async function planCdkOutDeployment(properties) {
-    const { directoryPath, stackNames, caller, resourceOrder, stackOptions } = cdkOutDeployment(properties.request);
+    const { directoryPath, stackNames, caller, assetsCaller, resourceOrder, stackOptions, } = cdkOutDeployment(properties.request);
     const selected = selectCdkAssemblyStacks({
         stacks: await loadCdkAssemblyStacks(directoryPath),
         stackNames,
@@ -23,6 +23,7 @@ export async function planCdkOutDeployment(properties) {
             regionName: stack.regionName ?? properties.defaultRegionName,
         })),
         caller,
+        assetsCaller,
         resourceOrder,
         stackOptions,
     };

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.d.ts

@@ -34,6 +34,11 @@ export interface SimCfnCdkOutStackOptions {
      * application Stack deployed by another is what this is for.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal this Stack publishes its CDK file assets as, where the
+     * assembly's own assets caller is not the right one for it.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order this Stack creates Resources with no dependency between them in,
      * where the assembly's own order is not the right one for it.
@@ -53,11 +58,3 @@ export declare function cdkOutOptionsFor(stack: SimCdkAssemblyStack, optionsByNa
  * keeps the deployment it was handed while the call goes on deploying.
  */
 export declare function cdkOutBoundTransform(transform: SimCfnCdkOutTemplateTransform | undefined, deployed: ReadonlyMap<string, SimCfnDeployedStack>): SimCfnTemplateFileTransform | undefined;
-/**
- * Refuse options keyed against a Stack that is not being deployed.
- *
- * A renamed Stack would otherwise take its bindings, its caller and its
- * transform with it without saying anything, and the deployment that lost them
- * looks like one that never had them.
- */
-export declare function assertCdkOutOptionsAreDeployed(optionsByName: SimCfnCdkOutStackOptionsByName | undefined, deploying: readonly SimCdkAssemblyStack[]): void;

package/dist/service/cloudformation/deploy/sim-cfn-cdk-out-stack-options.js

@@ -17,17 +17,3 @@ export function cdkOutBoundTransform(transform, deployed) {
     const deployedSoFar = new Map(deployed);
     return (template) => transform(template, deployedSoFar);
 }
-/**
- * Refuse options keyed against a Stack that is not being deployed.
- *
- * A renamed Stack would otherwise take its bindings, its caller and its
- * transform with it without saying anything, and the deployment that lost them
- * looks like one that never had them.
- */
-export function assertCdkOutOptionsAreDeployed(optionsByName, deploying) {
-    const names = new Set(deploying.flatMap((stack) => [stack.stackName, stack.artifactId]));
-    const unmatched = Object.keys(optionsByName ?? {}).filter((name) => !names.has(name));
-    if (unmatched.length > 0) {
-        throw new Error(`Options were given for ${unmatched.join(", ")}, which no Stack being deployed is named. The Stacks being deployed are ${deploying.map((stack) => stack.stackName).join(", ")}.`);
-    }
-}

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.d.ts

@@ -24,6 +24,15 @@ export interface SimCloudFormationCreateStackProperties {
      * policy denying an Account's root principal then denies.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal the CDK file assets staged beside the template are published
+     * as.
+     *
+     * A real `cdk deploy` publishes them as the file publishing Role and only
+     * then processes the template as the execution Role, which is why the two
+     * are named apart. Left out, assets are published as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order Resources with no dependency between them are created in.
      *

package/dist/service/cloudformation/deploy/sim-cfn-template-deployer.js

@@ -59,6 +59,7 @@ export class SimCloudFormationTemplateDeployer {
             parameters: properties.parameters,
             bindings: properties.bindings,
             caller: properties.caller,
+            assetsCaller: properties.assetsCaller,
             resourceOrder: properties.resourceOrder,
             cdkOutContext: await cdkOutContextForTemplatePath(properties.templatePath),
         });
@@ -118,6 +119,7 @@ export class SimCloudFormationTemplateDeployer {
             cdkOutContext: deployment.cdkOutContext,
             bindings: deployment.bindings,
             caller: deployment.caller,
+            assetsCaller: deployment.assetsCaller,
             resourceOrder: deployment.resourceOrder,
             exports: this.exports,
         });

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.d.ts

@@ -20,6 +20,15 @@ export interface SimCloudFormationDeployTemplateFileProperties {
      * policy denying an Account's root principal then denies.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The principal the CDK file assets staged beside the template are published
+     * as.
+     *
+     * A real `cdk deploy` publishes them as the file publishing Role and only
+     * then processes the template as the execution Role, which is why the two
+     * are named apart. Left out, assets are published as `caller`.
+     */
+    readonly assetsCaller?: SimAwsCaller | undefined;
     /**
      * The order Resources with no dependency between them are created in.
      *
@@ -64,6 +73,7 @@ export interface SimCfnLoadedTemplateFile {
     readonly parameters?: Record<string, string> | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     readonly caller?: SimAwsCaller | undefined;
+    readonly assetsCaller?: SimAwsCaller | undefined;
     readonly resourceOrder?: SimCfnResourceOrder | undefined;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
 }

package/dist/service/cloudformation/deploy/sim-cfn-template-file-loader.js

@@ -16,7 +16,7 @@ export class SimCfnTemplateFileLoader {
      */
     async load(properties) {
         const deployment = simCfnTemplateFileDeployment(properties);
-        const { templatePath, parameters, bindings, caller, resourceOrder } = deployment;
+        const { templatePath, parameters, bindings, caller, assetsCaller, resourceOrder, } = deployment;
         const stackName = deployment.stackName ?? stackNameFromTemplatePath(templatePath);
         // The template is named to a `yulin watch` supervisor, so re-synthing a
         // stack restarts the process that deployed it. Nothing happens outside
@@ -32,6 +32,7 @@ export class SimCfnTemplateFileLoader {
             parameters,
             bindings,
             caller,
+            assetsCaller,
             resourceOrder,
             cdkOutContext,
         };

package/dist/service/cloudformation/deploy/sim-cfn-template-file-updater.js

@@ -43,6 +43,7 @@ export class SimCfnTemplateFileUpdater {
             background: this.background,
             cdkOutContext: loaded.cdkOutContext,
             caller: loaded.caller,
+            assetsCaller: loaded.assetsCaller,
         });
         await handler.handle({
             input: {

package/dist/service/cloudformation/resource/cfn/sim-cfn-default-resource-value-adapter.d.ts

@@ -2,6 +2,7 @@ import type { SimCfnTemplateValue } from "../../template/value/sim-cfn-template-
 import type { SimCfnResourceValueAdapter } from "./sim-cfn-resource-value-adapter.js";
 interface SimCfnDefaultResourceValueAdapterProperties {
     readonly logicalId: string;
+    readonly uncreatedPhysicalName?: string | undefined;
 }
 /**
  * Fallback CloudFormation-facing values for Resource types without specific
@@ -9,9 +10,15 @@ interface SimCfnDefaultResourceValueAdapterProperties {
  */
 export declare class SimCfnDefaultResourceValueAdapter implements SimCfnResourceValueAdapter {
     private readonly logicalId;
+    private readonly uncreatedPhysicalName;
     constructor(properties: SimCfnDefaultResourceValueAdapterProperties);
     /**
-     * Default physical-ID stand-in.
+     * The physical ID this Resource would have had, or the logical-ID stand-in.
+     *
+     * A service that worked out the Resource's name before refusing to create it
+     * leaves the simulation holding the name real CloudFormation would have
+     * produced. That is what Ref answers with. The logical ID is left for a
+     * Resource nothing ever named.
      */
     refValue(): SimCfnTemplateValue;
     /**

package/dist/service/cloudformation/resource/cfn/sim-cfn-default-resource-value-adapter.js

@@ -5,14 +5,21 @@ import { simCfnUnansweredAttribute } from "./sim-cfn-unanswered-attribute.js";
  */
 export class SimCfnDefaultResourceValueAdapter {
     logicalId;
+    uncreatedPhysicalName;
     constructor(properties) {
         this.logicalId = properties.logicalId;
+        this.uncreatedPhysicalName = properties.uncreatedPhysicalName;
     }
     /**
-     * Default physical-ID stand-in.
+     * The physical ID this Resource would have had, or the logical-ID stand-in.
+     *
+     * A service that worked out the Resource's name before refusing to create it
+     * leaves the simulation holding the name real CloudFormation would have
+     * produced. That is what Ref answers with. The logical ID is left for a
+     * Resource nothing ever named.
      */
     refValue() {
-        return this.logicalId;
+        return this.uncreatedPhysicalName ?? this.logicalId;
     }
     /**
      * Default attribute stand-in.

package/dist/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.d.ts

@@ -7,6 +7,11 @@ export interface SimCfnResourceValueAdapterProperties {
     readonly logicalId: string;
     readonly type: string | undefined;
     readonly simResource: object | undefined;
+    /**
+     * The name real CloudFormation would have given the Resource, where the
+     * service knew it before deciding not to create it.
+     */
+    readonly uncreatedPhysicalName?: string | undefined;
 }
 /**
  * The adapter for a Resource type one service owns, or nothing when the
@@ -23,6 +28,6 @@ export type SimCfnServiceValueAdapter = SimCfnResourceValueAdapter | undefined;
  * Each service matches its own Resource types, beside that service's adapters,
  * so this registry stays a list of services. A Resource no service claims
  * falls through to the default adapter, which answers a Ref with the logical
- * ID.
+ * ID, or with the name a service worked out before refusing the Resource.
  */
 export declare function simCfnResourceValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnResourceValueAdapter;

package/dist/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.js

@@ -10,7 +10,7 @@ import { simCfnServiceValueAdapters } from "./sim-cfn-service-value-adapters.js"
  * Each service matches its own Resource types, beside that service's adapters,
  * so this registry stays a list of services. A Resource no service claims
  * falls through to the default adapter, which answers a Ref with the logical
- * ID.
+ * ID, or with the name a service worked out before refusing the Resource.
  */
 export function simCfnResourceValueAdapter(properties) {
     for (const serviceAdapter of simCfnServiceValueAdapters) {
@@ -21,5 +21,6 @@ export function simCfnResourceValueAdapter(properties) {
     }
     return new SimCfnDefaultResourceValueAdapter({
         logicalId: properties.logicalId,
+        uncreatedPhysicalName: properties.uncreatedPhysicalName,
     });
 }

package/dist/service/cloudformation/resource/create/sim-cfn-resource-create-operation.d.ts

@@ -39,6 +39,10 @@ export declare class SimCfnResourceCreateOperation<T extends object = object> {
      * a gap and is skipped, unless nothing this simulator models could have told
      * it apart from one that was created, in which case saying it is missing
      * sends a reader after something that is not lost.
+     *
+     * Either way the Resource keeps whatever name the refusal carried. A
+     * template reading a Ref of it then gets the name real CloudFormation would
+     * have produced.
      */
     private recordUncreated;
     private resourceCreationError;