Add AWS App Runner (Container App Hosting) Service Emulation

docs/architecture.md

@@ -57,7 +57,7 @@ Until every service has landed, OCI diverges from the pattern above in two docum
 Sitting above Layer 2 (driver interfaces) are **cross-service engines** that consume driver interfaces directly without going through the portable API. They're peers of each other, not layers in the three-layer stack. Two exist today:
 
 - `features/topology/` -- reads from compute, networking, and DNS drivers to simulate real network connectivity (`CanConnect`, `TraceRoute`, `Resolve`, security-group and NACL evaluation). See [topology.md](topology.md).
-- `server/` -- exposes driver interfaces over HTTP in each cloud's native SDK wire format, so real `aws-sdk-go-v2`, `azure-sdk-for-go`, and `cloud.google.com/go` clients work against CloudEmu by only changing the endpoint. Covers storage, compute, relational and NoSQL databases (incl. Redis/MemoryDB and Cassandra — Keyspaces and Azure Managed Cassandra), networking, monitoring/logging, serverless, containers (registry + ECS + Kubernetes), messaging, streaming (Kinesis Data Streams and MSK / managed Kafka), secrets, key management (KMS), certificate management (ACM), web application firewall (WAFv2), workflow orchestration (Step Functions), search/analytics (OpenSearch), audit logging (CloudTrail), configuration management (AWS Config), data integration / ETL and the Data Catalog (Glue), threat detection (GuardDuty), file systems (EFS), email (SES v2), IAM, resource discovery, and AI/ML (Bedrock, SageMaker, Azure AI, Vertex AI) across all 3 providers. Uses a pluggable `Handler` registry so new services drop in as self-contained packages without touching the core. See [sdk-server.md](sdk-server.md) and the full catalog in [services.md](services.md).
+- `server/` -- exposes driver interfaces over HTTP in each cloud's native SDK wire format, so real `aws-sdk-go-v2`, `azure-sdk-for-go`, and `cloud.google.com/go` clients work against CloudEmu by only changing the endpoint. Covers storage, compute, relational and NoSQL databases (incl. Redis/MemoryDB and Cassandra — Keyspaces and Azure Managed Cassandra), networking, monitoring/logging, serverless, containers (registry + ECS + Kubernetes + App Runner), messaging, streaming (Kinesis Data Streams and MSK / managed Kafka), secrets, key management (KMS), certificate management (ACM), web application firewall (WAFv2), workflow orchestration (Step Functions), search/analytics (OpenSearch), audit logging (CloudTrail), configuration management (AWS Config), data integration / ETL and the Data Catalog (Glue), threat detection (GuardDuty), file systems (EFS), email (SES v2), IAM, resource discovery, and AI/ML (Bedrock, SageMaker, Azure AI, Vertex AI) across all 3 providers. Uses a pluggable `Handler` registry so new services drop in as self-contained packages without touching the core. See [sdk-server.md](sdk-server.md) and the full catalog in [services.md](services.md).
 
 Both engines depend only on Layer 2 interfaces -- never on concrete provider types -- so they work uniformly across AWS, Azure, and GCP backends.
 

docs/coverage/README.md

@@ -10,6 +10,7 @@ capability the code does not implement. Machine-readable: [`coverage.json`](./co
 | Service | AWS | Azure | GCP | OCI | Operations |
 | --- | --- | --- | --- | --- | --- |
 | `acm` | [ACM](./aws/acm.md) | — | — | — | 17 |
+| `apprunner` | [AppRunner](./aws/apprunner.md) | — | — | — | 37 |
 | `azureai` | — | [AI](./azure/ai.md) | — | — | 92 |
 | `azuresearch` | — | [Search](./azure/search.md) | — | — | 53 |
 | `bedrock` | [Bedrock](./aws/bedrock.md) | — | — | — | 65 |

docs/coverage/aws/README.md

@@ -6,6 +6,7 @@ Services cloudemu emulates for AWS, by native name. Back to the [cross-provider
 | AWS service | Portable service | Operations |
 | --- | --- | --- |
 | [ACM](./acm.md) | `acm` | 17 |
+| [AppRunner](./apprunner.md) | `apprunner` | 37 |
 | [Bedrock](./bedrock.md) | `bedrock` | 65 |
 | [BedrockAgent](./bedrockagent.md) | `bedrockagent` | 29 |
 | [BedrockAgentRuntime](./bedrockagentruntime.md) | `bedrockagentruntime` | 3 |

docs/coverage/aws/apprunner.md

@@ -0,0 +1,50 @@
+<!-- Generated by `go generate ./...` (internal/coveragegen). Do not edit by hand. -->
+# AppRunner
+
+AWS's `apprunner` service · portable interface `driver.AppRunner` · [AWS index](./README.md)
+
+## Operations (37)
+
+| Operation | Description |
+| --- | --- |
+| `AssociateCustomDomain` | CustomDomain. The dnsTarget is the App Runner subdomain the |
+| `CreateAutoScalingConfiguration` | AutoScalingConfiguration. |
+| `CreateConnection` | Connection. |
+| `CreateObservabilityConfiguration` | ObservabilityConfiguration. |
+| `CreateService` | Service. |
+| `CreateVpcConnector` | VpcConnector. |
+| `CreateVpcIngressConnection` | VpcIngressConnection. |
+| `DeleteAutoScalingConfiguration` |  |
+| `DeleteConnection` |  |
+| `DeleteObservabilityConfiguration` |  |
+| `DeleteService` |  |
+| `DeleteVpcConnector` |  |
+| `DeleteVpcIngressConnection` |  |
+| `DescribeAutoScalingConfiguration` |  |
+| `DescribeCustomDomains` |  |
+| `DescribeObservabilityConfiguration` |  |
+| `DescribeService` |  |
+| `DescribeVpcConnector` |  |
+| `DescribeVpcIngressConnection` |  |
+| `DisassociateCustomDomain` |  |
+| `ListAutoScalingConfigurations` |  |
+| `ListConnections` |  |
+| `ListObservabilityConfigurations` |  |
+| `ListOperations` | Operations. |
+| `ListServices` |  |
+| `ListServicesForAutoScalingConfiguration` |  |
+| `ListTagsForResource` |  |
+| `ListVpcConnectors` |  |
+| `ListVpcIngressConnections` |  |
+| `PauseService` |  |
+| `ResumeService` |  |
+| `StartDeployment` |  |
+| `TagResource` | Tags. |
+| `UntagResource` |  |
+| `UpdateDefaultAutoScalingConfiguration` |  |
+| `UpdateService` |  |
+| `UpdateVpcIngressConnection` |  |
+
+## Not in scope
+
+_Not documented yet. See the [emulator boundary](../../../README.md) for cloudemu-wide non-goals._

docs/coverage/coverage.json

@@ -59,6 +59,135 @@
       "aws": "ACM"
     }
   },
+  {
+    "service": "apprunner",
+    "interface": "AppRunner",
+    "operations": [
+      {
+        "name": "AssociateCustomDomain",
+        "doc": "CustomDomain. The dnsTarget is the App Runner subdomain the"
+      },
+      {
+        "name": "CreateAutoScalingConfiguration",
+        "doc": "AutoScalingConfiguration."
+      },
+      {
+        "name": "CreateConnection",
+        "doc": "Connection."
+      },
+      {
+        "name": "CreateObservabilityConfiguration",
+        "doc": "ObservabilityConfiguration."
+      },
+      {
+        "name": "CreateService",
+        "doc": "Service."
+      },
+      {
+        "name": "CreateVpcConnector",
+        "doc": "VpcConnector."
+      },
+      {
+        "name": "CreateVpcIngressConnection",
+        "doc": "VpcIngressConnection."
+      },
+      {
+        "name": "DeleteAutoScalingConfiguration"
+      },
+      {
+        "name": "DeleteConnection"
+      },
+      {
+        "name": "DeleteObservabilityConfiguration"
+      },
+      {
+        "name": "DeleteService"
+      },
+      {
+        "name": "DeleteVpcConnector"
+      },
+      {
+        "name": "DeleteVpcIngressConnection"
+      },
+      {
+        "name": "DescribeAutoScalingConfiguration"
+      },
+      {
+        "name": "DescribeCustomDomains"
+      },
+      {
+        "name": "DescribeObservabilityConfiguration"
+      },
+      {
+        "name": "DescribeService"
+      },
+      {
+        "name": "DescribeVpcConnector"
+      },
+      {
+        "name": "DescribeVpcIngressConnection"
+      },
+      {
+        "name": "DisassociateCustomDomain"
+      },
+      {
+        "name": "ListAutoScalingConfigurations"
+      },
+      {
+        "name": "ListConnections"
+      },
+      {
+        "name": "ListObservabilityConfigurations"
+      },
+      {
+        "name": "ListOperations",
+        "doc": "Operations."
+      },
+      {
+        "name": "ListServices"
+      },
+      {
+        "name": "ListServicesForAutoScalingConfiguration"
+      },
+      {
+        "name": "ListTagsForResource"
+      },
+      {
+        "name": "ListVpcConnectors"
+      },
+      {
+        "name": "ListVpcIngressConnections"
+      },
+      {
+        "name": "PauseService"
+      },
+      {
+        "name": "ResumeService"
+      },
+      {
+        "name": "StartDeployment"
+      },
+      {
+        "name": "TagResource",
+        "doc": "Tags."
+      },
+      {
+        "name": "UntagResource"
+      },
+      {
+        "name": "UpdateDefaultAutoScalingConfiguration"
+      },
+      {
+        "name": "UpdateService"
+      },
+      {
+        "name": "UpdateVpcIngressConnection"
+      }
+    ],
+    "providers": {
+      "aws": "AppRunner"
+    }
+  },
   {
     "service": "azureai",
     "interface": "AzureAI",

docs/services.md

@@ -50,6 +50,7 @@ This document lists every service and operation available in CloudEmu across all
 | 37 | Data Integration (ETL / Data Catalog) | `glue` | — | — |
 | 38 | Threat Detection | `guardduty` | — | — |
 | 39 | Streaming (Managed Kafka) | `kafka` | — | — |
+| 40 | Container App Hosting | `apprunner` | — | — |
 
 ---
 
@@ -3147,6 +3148,43 @@ delete) is still enforced.
 
 **Total: 59 operations.**
 
+## 40. Container App Hosting (App Runner)
+
+**Driver interface:** `services/apprunner/driver/`
+**AWS:** App Runner (AWS JSON 1.0, `X-Amz-Target: AppRunner.<Op>`) | **Azure:** — | **GCP:** —
+
+AWS-only. Real `aws-sdk-go-v2/service/apprunner` clients (and the `aws apprunner`
+CLI) work against the SDK-compat server (`awsserver.Drivers{AppRunner: cloud.AppRunner}`).
+The handler matches on the `X-Amz-Target` prefix `AppRunner.`, so it is
+unambiguous with the S3 catch-all. Full `aws-sdk-go-v2/service/apprunner`
+parity — every one of the 37 client operations is implemented.
+
+**Services behave realistically.** `CreateService` mints a service ARN + ID and
+returns a service that is immediately `RUNNING` (deterministic — no wall-clock
+provisioning) with a synthesized `ServiceUrl`. `PauseService`/`ResumeService`
+enforce the state machine (`InvalidStateException` from an illegal state), and
+every mutation records an `OperationSummary` surfaced by `ListOperations`.
+Auto-scaling, observability, and VPC-connector configurations are revision-managed
+(shared name, incrementing revision, one `Latest`); reads deep-copy. Errors map
+per-op to the exception each operation actually models — a missing resource on an
+op that models `ResourceNotFoundException` returns that, while ops that don't
+(e.g. `AssociateCustomDomain`, `CreateVpcIngressConnection`) return
+`InvalidRequestException`.
+
+| Family | Operations |
+|--------|-----------|
+| Services | CreateService, DescribeService, UpdateService, DeleteService, ListServices, PauseService, ResumeService, StartDeployment |
+| Auto-scaling configs | CreateAutoScalingConfiguration, DescribeAutoScalingConfiguration, DeleteAutoScalingConfiguration, ListAutoScalingConfigurations, UpdateDefaultAutoScalingConfiguration, ListServicesForAutoScalingConfiguration |
+| Connections | CreateConnection, DeleteConnection, ListConnections |
+| Observability configs | Create/Describe/Delete/ListObservabilityConfigurations |
+| VPC connectors | Create/Describe/Delete/ListVpcConnectors |
+| VPC ingress connections | Create/Describe/Delete/List/UpdateVpcIngressConnection |
+| Custom domains | AssociateCustomDomain, DisassociateCustomDomain, DescribeCustomDomains |
+| Operations | ListOperations |
+| Tags | ListTagsForResource, TagResource, UntagResource |
+
+**Total: 37 operations.**
+
 ## Summary
 
 | Service | Operations |
@@ -3203,7 +3241,8 @@ delete) is still enforced.
 | Data Integration — AWS Glue | 299 |
 | Threat Detection — Amazon GuardDuty | 87 |
 | Streaming — Amazon MSK | 59 |
-| **Grand Total** | **2749** (+138 optional) |
+| Container App Hosting — AWS App Runner | 37 |
+| **Grand Total** | **2786** (+138 optional) |
 
 Optional operations are capabilities a driver may implement but is not required
 to; see the sections marked "optional capability". They are counted separately

go.mod

@@ -43,6 +43,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/config v1.32.14
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.14
 	github.com/aws/aws-sdk-go-v2/service/acm v1.38.3
+	github.com/aws/aws-sdk-go-v2/service/apprunner v1.39.14
 	github.com/aws/aws-sdk-go-v2/service/autoscaling v1.66.1
 	github.com/aws/aws-sdk-go-v2/service/bedrock v1.64.0
 	github.com/aws/aws-sdk-go-v2/service/bedrockagent v1.58.0

go.sum

@@ -136,6 +136,8 @@ github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 h1:jbGY4CXLzZElOXgGsexlC3Hi+3Y
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36/go.mod h1:uBu/9aKsS/UQGc72RAt3y54kjgYQxmhut8ZD2dXCDNE=
 github.com/aws/aws-sdk-go-v2/service/acm v1.38.3 h1:Fzab84hCu3rw9R9Y3mH7SHfr/cSEHnCB0Mq1JCdr9t0=
 github.com/aws/aws-sdk-go-v2/service/acm v1.38.3/go.mod h1:yCteizCNPaHt0SnNusoGGHvy0JDB0tvGDTVhEt5anZM=
+github.com/aws/aws-sdk-go-v2/service/apprunner v1.39.14 h1:C8XTHmSZQtTrOcmYXkzQUiHD97mINN/MnoOG7/vv9pk=
+github.com/aws/aws-sdk-go-v2/service/apprunner v1.39.14/go.mod h1:7QwBy8GT8JH3GJKNcn7gEKqJhoTC7MvLeD94S4Balo0=
 github.com/aws/aws-sdk-go-v2/service/autoscaling v1.66.1 h1:kGlbhb5GMfkP/bcqcbt3oDi50kwDTpRmNzYUY9LqbLk=
 github.com/aws/aws-sdk-go-v2/service/autoscaling v1.66.1/go.mod h1:z45kurrOonQepd3SN5LIgropAn1NGHwBn1yOMF+QVFU=
 github.com/aws/aws-sdk-go-v2/service/bedrock v1.64.0 h1:jZOg03lM41zl89h17avGr6AFqAb9g3s/rZytTQslz14=
@@ -174,10 +176,10 @@ github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.56.0 h1:OJRqQ6G7R
 github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.56.0/go.mod h1:qNnJkZTDHDL2sO8hyVH2yILcfSEkjP/pIns2JsF1g1o=
 github.com/aws/aws-sdk-go-v2/service/eventbridge v1.47.0 h1:LuPLDBMCmldgg779sq8swfEdRNMeKlaT852uxKYCOkk=
 github.com/aws/aws-sdk-go-v2/service/eventbridge v1.47.0/go.mod h1:3g/foYPw/4CT8yV7/A1QsbvnhDZW/2x2uzl4vkqX49o=
-github.com/aws/aws-sdk-go-v2/service/guardduty v1.79.3 h1:AGUhgPCJKoXbNbk93EtLt6nzu7WoaFyln1g753W9E6g=
-github.com/aws/aws-sdk-go-v2/service/guardduty v1.79.3/go.mod h1:OOwqiU2hPl8v3FomNDgNPj3RCCsTfrsjzgWmuqHidhw=
 github.com/aws/aws-sdk-go-v2/service/glue v1.152.0 h1:82K11SuRv2c5gmlwJXImQrs2+nzro1KF/MOjr5qzVZ0=
 github.com/aws/aws-sdk-go-v2/service/glue v1.152.0/go.mod h1:3kgUanQ41XP3SMxOurl1gu9cQ2B4AltelI+0srIz0Yg=
+github.com/aws/aws-sdk-go-v2/service/guardduty v1.79.3 h1:AGUhgPCJKoXbNbk93EtLt6nzu7WoaFyln1g753W9E6g=
+github.com/aws/aws-sdk-go-v2/service/guardduty v1.79.3/go.mod h1:OOwqiU2hPl8v3FomNDgNPj3RCCsTfrsjzgWmuqHidhw=
 github.com/aws/aws-sdk-go-v2/service/iam v1.53.10 h1:kcN3I3llO7VwIY5w3Pc5FmEonpsr23Ou7Cwk4qf7dik=
 github.com/aws/aws-sdk-go-v2/service/iam v1.53.10/go.mod h1:1vkJzjCYC3byO0kIrBqLPzvZpuvYhPXkuyARs6E7tM4=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14 h1:SA43nfaY7+1jjMNIc2ywu99JLJLButtIdLP6j+bT870=