@kensio/yulin 1.10.0 → 1.10.2

package/dist/service/cloudfront/distribution/configurator/sim-cloud-front-origin-configurator.d.ts

@@ -2,6 +2,7 @@ import type { SimCloudFrontOriginConfig } from "../../command/create-distributio
 import type { SimCloudFrontDistribution } from "../sim-cloudfront-distribution.js";
 import { type SimCloudFrontS3OriginResolver } from "../../origin/s3/sim-cloudfront-s3-origin.js";
 import type { SimCfCustomOriginDispatcher } from "../../origin/custom/sim-cf-custom-origin-dispatcher.js";
+import type { SimCloudFrontOriginAccessControlRegistry } from "../../origin-access-control/sim-cf-origin-access-control-registry.js";
 /**
  * Applies Origin configuration to a sim CloudFront Distribution.
  *
@@ -14,11 +15,28 @@ import type { SimCfCustomOriginDispatcher } from "../../origin/custom/sim-cf-cus
  */
 export declare class SimCloudFrontOriginConfigurator {
     private readonly s3OriginResolver;
+    private readonly originAccessControls;
     private readonly customOriginDispatcher?;
-    constructor(s3OriginResolver: SimCloudFrontS3OriginResolver, customOriginDispatcher?: SimCfCustomOriginDispatcher | undefined);
+    constructor(s3OriginResolver: SimCloudFrontS3OriginResolver, originAccessControls: SimCloudFrontOriginAccessControlRegistry, customOriginDispatcher?: SimCfCustomOriginDispatcher | undefined);
     /**
      * Configure an Origin on a Distribution.
      */
     configure(distribution: SimCloudFrontDistribution, origin: SimCloudFrontOriginConfig): void;
+    /**
+     * Resolve the origin access control an Origin names.
+     *
+     * CloudFront refuses a Distribution whose Origin names an origin access
+     * control the account does not hold, so an ID nothing here created is
+     * refused rather than stored as written. An empty ID means no origin access
+     * control, which is how the CloudFront API says an Origin has none.
+     */
+    private originAccessControl;
+    /**
+     * Refuse an origin access control on a custom Origin.
+     *
+     * Every origin access control here signs for an S3 Origin, and CloudFront
+     * refuses one whose origin type does not match the Origin it is attached to.
+     */
+    private assertNoOriginAccessControl;
 }
 //# sourceMappingURL=sim-cloud-front-origin-configurator.d.ts.map

package/dist/service/cloudfront/distribution/configurator/sim-cloud-front-origin-configurator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloud-front-origin-configurator.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/distribution/configurator/sim-cloud-front-origin-configurator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAG1G;;;;;;;;;GASG;AACH,qBAAa,+BAA+B;IAExC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAF1C,YACmB,gBAAgB,EAAE,6BAA6B,EAC/C,sBAAsB,CAAC,EAAE,2BAA2B,YAAA,EACnE;IAEJ;;OAEG;IACH,SAAS,CACP,YAAY,EAAE,yBAAyB,EACvC,MAAM,EAAE,yBAAyB,GAChC,IAAI,CAwCN;CACF"}
+{"version":3,"file":"sim-cloud-front-origin-configurator.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/distribution/configurator/sim-cloud-front-origin-configurator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAG1G,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,sEAAsE,CAAC;AAGrI;;;;;;;;;GASG;AACH,qBAAa,+BAA+B;IAExC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAH1C,YACmB,gBAAgB,EAAE,6BAA6B,EAC/C,oBAAoB,EAAE,wCAAwC,EAC9D,sBAAsB,CAAC,EAAE,2BAA2B,YAAA,EACnE;IAEJ;;OAEG;IACH,SAAS,CACP,YAAY,EAAE,yBAAyB,EACvC,MAAM,EAAE,yBAAyB,GAChC,IAAI,CAqDN;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IA2B3B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;CAcpC"}

package/dist/service/cloudfront/distribution/configurator/sim-cloud-front-origin-configurator.js

@@ -1,6 +1,8 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { SimCloudFrontS3Origin, } from "../../origin/s3/sim-cloudfront-s3-origin.js";
+import { assertNoSimCfS3OriginAccessIdentity } from "../../origin/s3/sim-cf-s3-origin-access-identity.js";
 import { SimCloudFrontCustomOrigin } from "../../origin/custom/sim-cloudfront-custom-origin.js";
+import { SimCloudFrontInvalidOriginAccessControl } from "../../error/sim-cloudfront.error.js";
 /**
  * Applies Origin configuration to a sim CloudFront Distribution.
  *
@@ -13,9 +15,11 @@ import { SimCloudFrontCustomOrigin } from "../../origin/custom/sim-cloudfront-cu
  */
 export class SimCloudFrontOriginConfigurator {
     s3OriginResolver;
+    originAccessControls;
     customOriginDispatcher;
-    constructor(s3OriginResolver, customOriginDispatcher) {
+    constructor(s3OriginResolver, originAccessControls, customOriginDispatcher) {
         this.s3OriginResolver = s3OriginResolver;
+        this.originAccessControls = originAccessControls;
         this.customOriginDispatcher = customOriginDispatcher;
     }
     /**
@@ -24,13 +28,20 @@ export class SimCloudFrontOriginConfigurator {
     configure(distribution, origin) {
         assertDefined(origin.Id, "CloudFront Origin Id");
         assertDefined(origin.DomainName, "CloudFront Origin DomainName");
+        const originAccessControl = this.originAccessControl(origin.Id, origin.OriginAccessControlId);
         if (origin.S3OriginConfig !== undefined) {
-            const bucket = this.s3OriginResolver(origin.DomainName);
-            assertDefined(bucket, `Sim S3 Bucket for CloudFront Origin ${origin.DomainName}`);
-            distribution.addOrigin(origin.Id, new SimCloudFrontS3Origin({ bucket, originPath: origin.OriginPath }));
+            assertNoSimCfS3OriginAccessIdentity(origin.Id, origin.S3OriginConfig);
+            const originBucket = this.s3OriginResolver(origin.DomainName);
+            assertDefined(originBucket, `Sim S3 Bucket for CloudFront Origin ${origin.DomainName}`);
+            distribution.addOrigin(origin.Id, new SimCloudFrontS3Origin({
+                originBucket,
+                originPath: origin.OriginPath,
+                ...(originAccessControl !== undefined && { originAccessControl }),
+            }));
             return;
         }
         if (origin.CustomOriginConfig !== undefined) {
+            this.assertNoOriginAccessControl(origin.Id, originAccessControl);
             assertDefined(this.customOriginDispatcher, `Simulated AWS environment for sim CloudFront custom Origin ${origin.Id}, which a standalone SimCloudFront has no way to reach`);
             distribution.addOrigin(origin.Id, new SimCloudFrontCustomOrigin({
                 originId: origin.Id,
@@ -42,5 +53,41 @@ export class SimCloudFrontOriginConfigurator {
         }
         throw new Error(`Unsupported sim CloudFront Origin type for Origin ${origin.Id}`);
     }
+    /**
+     * Resolve the origin access control an Origin names.
+     *
+     * CloudFront refuses a Distribution whose Origin names an origin access
+     * control the account does not hold, so an ID nothing here created is
+     * refused rather than stored as written. An empty ID means no origin access
+     * control, which is how the CloudFront API says an Origin has none.
+     */
+    originAccessControl(originId, originAccessControlId) {
+        if (originAccessControlId === undefined ||
+            originAccessControlId.length === 0) {
+            return undefined;
+        }
+        const originAccessControl = this.originAccessControls.byId(originAccessControlId);
+        if (originAccessControl === undefined) {
+            throw new SimCloudFrontInvalidOriginAccessControl(`Sim CloudFront Origin ${originId} names origin access control ` +
+                `${originAccessControlId}, which does not exist. Only an origin ` +
+                `access control an AWS::CloudFront::OriginAccessControl Resource ` +
+                `created in this simulation can be named.`);
+        }
+        return originAccessControl;
+    }
+    /**
+     * Refuse an origin access control on a custom Origin.
+     *
+     * Every origin access control here signs for an S3 Origin, and CloudFront
+     * refuses one whose origin type does not match the Origin it is attached to.
+     */
+    assertNoOriginAccessControl(originId, originAccessControl) {
+        if (originAccessControl === undefined) {
+            return;
+        }
+        throw new SimCloudFrontInvalidOriginAccessControl(`Sim CloudFront custom Origin ${originId} names origin access control ` +
+            `${originAccessControl.name}, which signs for an ` +
+            `${originAccessControl.originType} Origin`);
+    }
 }
 //# sourceMappingURL=sim-cloud-front-origin-configurator.js.map

package/dist/service/cloudfront/distribution/configurator/sim-cloud-front-origin-configurator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloud-front-origin-configurator.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/distribution/configurator/sim-cloud-front-origin-configurator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EACL,qBAAqB,GAEtB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG;;;;;;;;;GASG;AACH,MAAM,OAAO,+BAA+B;IAEvB,gBAAgB;IAChB,sBAAsB;IAFzC,YACmB,gBAA+C,EAC/C,sBAAoD;gCADpD,gBAAgB;sCAChB,sBAAsB;IACtC,CAAC;IAEJ;;OAEG;IACH,SAAS,CACP,YAAuC,EACvC,MAAiC;QAEjC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACjD,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAExD,aAAa,CACX,MAAM,EACN,uCAAuC,MAAM,CAAC,UAAU,EAAE,CAC3D,CAAC;YAEF,YAAY,CAAC,SAAS,CACpB,MAAM,CAAC,EAAE,EACT,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CACrE,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5C,aAAa,CACX,IAAI,CAAC,sBAAsB,EAC3B,8DAA8D,MAAM,CAAC,EAAE,wDAAwD,CAChI,CAAC;YAEF,YAAY,CAAC,SAAS,CACpB,MAAM,CAAC,EAAE,EACT,IAAI,yBAAyB,CAAC;gBAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI,CAAC,sBAAsB;aACxC,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cloud-front-origin-configurator.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/distribution/configurator/sim-cloud-front-origin-configurator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EACL,qBAAqB,GAEtB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAE1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAGhG,OAAO,EAAE,uCAAuC,EAAE,MAAM,qCAAqC,CAAC;AAE9F;;;;;;;;;GASG;AACH,MAAM,OAAO,+BAA+B;IAEvB,gBAAgB;IAChB,oBAAoB;IACpB,sBAAsB;IAHzC,YACmB,gBAA+C,EAC/C,oBAA8D,EAC9D,sBAAoD;gCAFpD,gBAAgB;oCAChB,oBAAoB;sCACpB,sBAAsB;IACtC,CAAC;IAEJ;;OAEG;IACH,SAAS,CACP,YAAuC,EACvC,MAAiC;QAEjC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACjD,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAEjE,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAClD,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,qBAAqB,CAC7B,CAAC;QAEF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACxC,mCAAmC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAEtE,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE9D,aAAa,CACX,YAAY,EACZ,uCAAuC,MAAM,CAAC,UAAU,EAAE,CAC3D,CAAC;YAEF,YAAY,CAAC,SAAS,CACpB,MAAM,CAAC,EAAE,EACT,IAAI,qBAAqB,CAAC;gBACxB,YAAY;gBACZ,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,GAAG,CAAC,mBAAmB,KAAK,SAAS,IAAI,EAAE,mBAAmB,EAAE,CAAC;aAClE,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;YAEjE,aAAa,CACX,IAAI,CAAC,sBAAsB,EAC3B,8DAA8D,MAAM,CAAC,EAAE,wDAAwD,CAChI,CAAC;YAEF,YAAY,CAAC,SAAS,CACpB,MAAM,CAAC,EAAE,EACT,IAAI,yBAAyB,CAAC;gBAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI,CAAC,sBAAsB;aACxC,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB,CACzB,QAAgB,EAChB,qBAAyC;QAEzC,IACE,qBAAqB,KAAK,SAAS;YACnC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CACxD,qBAAqB,CACtB,CAAC;QAEF,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,uCAAuC,CAC/C,yBAAyB,QAAQ,+BAA+B;gBAC9D,GAAG,qBAAqB,yCAAyC;gBACjE,kEAAkE;gBAClE,0CAA0C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACK,2BAA2B,CACjC,QAAgB,EAChB,mBAAiE;QAEjE,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,uCAAuC,CAC/C,gCAAgC,QAAQ,+BAA+B;YACrE,GAAG,mBAAmB,CAAC,IAAI,uBAAuB;YAClD,GAAG,mBAAmB,CAAC,UAAU,SAAS,CAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/distribution/sim-cf-distribution-reconfigurer.d.ts

@@ -1,12 +1,14 @@
 import type { SimCloudFrontDistributionConfig } from "../command/create-distribution/create-distribution.command.js";
 import type { SimCfCustomOriginDispatcher } from "../origin/custom/sim-cf-custom-origin-dispatcher.js";
 import type { SimCloudFrontS3OriginResolver } from "../origin/s3/sim-cloudfront-s3-origin.js";
+import type { SimCloudFrontOriginAccessControlRegistry } from "../origin-access-control/sim-cf-origin-access-control-registry.js";
 import type { SimCloudFrontRegistry } from "../registry/sim-cloud-front-registry.js";
 import type { SimCloudFrontDistribution } from "./sim-cloudfront-distribution.js";
 interface SimCloudFrontDistributionReconfigurerProperties {
     readonly cloudFrontRegistry: SimCloudFrontRegistry;
     readonly s3OriginResolver: SimCloudFrontS3OriginResolver;
     readonly customOriginDispatcher?: SimCfCustomOriginDispatcher | undefined;
+    readonly originAccessControls: SimCloudFrontOriginAccessControlRegistry;
 }
 /**
  * Applies a replacement DistributionConfig to a Distribution already in place.

package/dist/service/cloudfront/distribution/sim-cf-distribution-reconfigurer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-distribution-reconfigurer.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/distribution/sim-cf-distribution-reconfigurer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAGrF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAElF,UAAU,+CAA+C;IACvD,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,6BAA6B,CAAC;IACzD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;CAC3E;AAED;;;;;;;GAOG;AACH,qBAAa,qCAAqC;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IAErE,YAAY,UAAU,EAAE,+CAA+C,EAGtE;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,YAAY,EAAE,yBAAyB,EACvC,kBAAkB,EAAE,+BAA+B,GAClD,IAAI,CAmBN;CACF"}
+{"version":3,"file":"sim-cf-distribution-reconfigurer.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/distribution/sim-cf-distribution-reconfigurer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+DAA+D,CAAC;AACrH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mEAAmE,CAAC;AAClI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAGrF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAElF,UAAU,+CAA+C;IACvD,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,6BAA6B,CAAC;IACzD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,oBAAoB,EAAE,wCAAwC,CAAC;CACzE;AAED;;;;;;;GAOG;AACH,qBAAa,qCAAqC;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IAErE,YAAY,UAAU,EAAE,+CAA+C,EAGtE;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,YAAY,EAAE,yBAAyB,EACvC,kBAAkB,EAAE,+BAA+B,GAClD,IAAI,CAmBN;CACF"}

package/dist/service/cloudfront/distribution/sim-cf-distribution-reconfigurer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-distribution-reconfigurer.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/distribution/sim-cf-distribution-reconfigurer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,yCAAyC,EAAE,MAAM,4DAA4D,CAAC;AAUvH;;;;;;;GAOG;AACH,MAAM,OAAO,qCAAqC;IAC/B,kBAAkB,CAAwB;IAC1C,YAAY,CAAwC;IAErE,YAAY,UAA2D;QACrE,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,YAAuC,EACvC,kBAAmD;QAEnD,MAAM,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;QAExC,IAAI,CAAC,kBAAkB,CAAC,mCAAmC,CACzD,kBAAkB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,EACvC,cAAc,CACf,CAAC;QAEF,IAAI,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;QAEvE,YAAY,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAE9D,KAAK,MAAM,mBAAmB,IAAI,YAAY,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACzE,IAAI,CAAC,kBAAkB,CAAC,2BAA2B,CACjD,mBAAmB,EACnB,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cf-distribution-reconfigurer.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/distribution/sim-cf-distribution-reconfigurer.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,yCAAyC,EAAE,MAAM,4DAA4D,CAAC;AAWvH;;;;;;;GAOG;AACH,MAAM,OAAO,qCAAqC;IAC/B,kBAAkB,CAAwB;IAC1C,YAAY,CAAwC;IAErE,YAAY,UAA2D;QACrE,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,YAAuC,EACvC,kBAAmD;QAEnD,MAAM,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;QAExC,IAAI,CAAC,kBAAkB,CAAC,mCAAmC,CACzD,kBAAkB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,EACvC,cAAc,CACf,CAAC;QAEF,IAAI,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;QAEvE,YAAY,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAE9D,KAAK,MAAM,mBAAmB,IAAI,YAAY,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACzE,IAAI,CAAC,kBAAkB,CAAC,2BAA2B,CACjD,mBAAmB,EACnB,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cloudfront/error/sim-cloudfront.error.d.ts

@@ -90,6 +90,26 @@ export declare class SimCloudFrontResponseHeadersPolicyAlreadyExists extends Sim
     readonly name = "ResponseHeadersPolicyAlreadyExists";
     constructor(message: string);
 }
+/**
+ * Simulated CloudFront InvalidOriginAccessControl error.
+ *
+ * What CloudFront answers when an Origin's `OriginAccessControlId` names no
+ * origin access control the account holds.
+ */
+export declare class SimCloudFrontInvalidOriginAccessControl extends SimCloudFrontError {
+    readonly name = "InvalidOriginAccessControl";
+    constructor(message: string);
+}
+/**
+ * Simulated CloudFront OriginAccessControlAlreadyExists error.
+ *
+ * CloudFront requires an origin access control name to be unique within an
+ * account, so a second one claiming a name is refused rather than created.
+ */
+export declare class SimCloudFrontOriginAccessControlAlreadyExists extends SimCloudFrontError {
+    readonly name = "OriginAccessControlAlreadyExists";
+    constructor(message: string);
+}
 /**
  * Simulated CloudFront DistributionNotDisabled error.
  *

package/dist/service/cloudfront/error/sim-cloudfront.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront.error.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/error/sim-cloudfront.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,SAAS,EAAE,0BAA0B;IAFvD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,0BAA+B,EAG3D;CACF;AAED;;;;;;GAMG;AACH,qBAAa,qCAAsC,SAAQ,kBAAkB;IAC3E,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,qCAAsC,SAAQ,kBAAkB;IAC3E,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,kBAAkB;IACnE,SAAyB,IAAI,sBAAsB;IAEnD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,gCAAiC,SAAQ,kBAAkB;IACtE,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,kBAAkB;IAClE,SAAyB,IAAI,qBAAqB;IAElD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;GAIG;AACH,qBAAa,+BAAgC,SAAQ,kBAAkB;IACrE,SAAyB,IAAI,wBAAwB;IAErD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iCAAkC,SAAQ,kBAAkB;IACvE,SAAyB,IAAI,0BAA0B;IAEvD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;GAIG;AACH,qBAAa,wCAAyC,SAAQ,kBAAkB;IAC9E,SAAyB,IAAI,iCAAiC;IAE9D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,+CAAgD,SAAQ,kBAAkB;IACrF,SAAyB,IAAI,wCAAwC;IAErE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,oCAAqC,SAAQ,kBAAkB;IAC1E,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}
+{"version":3,"file":"sim-cloudfront.error.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/error/sim-cloudfront.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,SAAS,EAAE,0BAA0B;IAFvD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,0BAA+B,EAG3D;CACF;AAED;;;;;;GAMG;AACH,qBAAa,qCAAsC,SAAQ,kBAAkB;IAC3E,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,qCAAsC,SAAQ,kBAAkB;IAC3E,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,kBAAkB;IACnE,SAAyB,IAAI,sBAAsB;IAEnD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,gCAAiC,SAAQ,kBAAkB;IACtE,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,kBAAkB;IAClE,SAAyB,IAAI,qBAAqB;IAElD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;GAIG;AACH,qBAAa,+BAAgC,SAAQ,kBAAkB;IACrE,SAAyB,IAAI,wBAAwB;IAErD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iCAAkC,SAAQ,kBAAkB;IACvE,SAAyB,IAAI,0BAA0B;IAEvD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;GAIG;AACH,qBAAa,wCAAyC,SAAQ,kBAAkB;IAC9E,SAAyB,IAAI,iCAAiC;IAE9D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,+CAAgD,SAAQ,kBAAkB;IACrF,SAAyB,IAAI,wCAAwC;IAErE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,uCAAwC,SAAQ,kBAAkB;IAC7E,SAAyB,IAAI,gCAAgC;IAE7D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,6CAA8C,SAAQ,kBAAkB;IACnF,SAAyB,IAAI,sCAAsC;IAEnE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,oCAAqC,SAAQ,kBAAkB;IAC1E,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/cloudfront/error/sim-cloudfront.error.js

@@ -105,6 +105,30 @@ export class SimCloudFrontResponseHeadersPolicyAlreadyExists extends SimCloudFro
         super(message, { httpStatusCode: 409 });
     }
 }
+/**
+ * Simulated CloudFront InvalidOriginAccessControl error.
+ *
+ * What CloudFront answers when an Origin's `OriginAccessControlId` names no
+ * origin access control the account holds.
+ */
+export class SimCloudFrontInvalidOriginAccessControl extends SimCloudFrontError {
+    name = "InvalidOriginAccessControl";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated CloudFront OriginAccessControlAlreadyExists error.
+ *
+ * CloudFront requires an origin access control name to be unique within an
+ * account, so a second one claiming a name is refused rather than created.
+ */
+export class SimCloudFrontOriginAccessControlAlreadyExists extends SimCloudFrontError {
+    name = "OriginAccessControlAlreadyExists";
+    constructor(message) {
+        super(message, { httpStatusCode: 409 });
+    }
+}
 /**
  * Simulated CloudFront DistributionNotDisabled error.
  *

package/dist/service/cloudfront/error/sim-cloudfront.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront.error.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/error/sim-cloudfront.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAA+B,EAAE;QAE1D,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,qCAAsC,SAAQ,kBAAkB;IAClD,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qCAAsC,SAAQ,kBAAkB;IAClD,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,6BAA8B,SAAQ,kBAAkB;IAC1C,IAAI,GAAG,kBAAkB,CAAC;IAEnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gCAAiC,SAAQ,kBAAkB;IAC7C,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,kBAAkB;IACzC,IAAI,GAAG,iBAAiB,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,+BAAgC,SAAQ,kBAAkB;IAC5C,IAAI,GAAG,oBAAoB,CAAC;IAErD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iCAAkC,SAAQ,kBAAkB;IAC9C,IAAI,GAAG,sBAAsB,CAAC;IAEvD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,wCAAyC,SAAQ,kBAAkB;IACrD,IAAI,GAAG,6BAA6B,CAAC;IAE9D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,+CAAgD,SAAQ,kBAAkB;IAC5D,IAAI,GAAG,oCAAoC,CAAC;IAErE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oCAAqC,SAAQ,kBAAkB;IACjD,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"sim-cloudfront.error.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/error/sim-cloudfront.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAA+B,EAAE;QAE1D,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,qCAAsC,SAAQ,kBAAkB;IAClD,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qCAAsC,SAAQ,kBAAkB;IAClD,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,6BAA8B,SAAQ,kBAAkB;IAC1C,IAAI,GAAG,kBAAkB,CAAC;IAEnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gCAAiC,SAAQ,kBAAkB;IAC7C,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,kBAAkB;IACzC,IAAI,GAAG,iBAAiB,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,+BAAgC,SAAQ,kBAAkB;IAC5C,IAAI,GAAG,oBAAoB,CAAC;IAErD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iCAAkC,SAAQ,kBAAkB;IAC9C,IAAI,GAAG,sBAAsB,CAAC;IAEvD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,wCAAyC,SAAQ,kBAAkB;IACrD,IAAI,GAAG,6BAA6B,CAAC;IAE9D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,+CAAgD,SAAQ,kBAAkB;IAC5D,IAAI,GAAG,oCAAoC,CAAC;IAErE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uCAAwC,SAAQ,kBAAkB;IACpD,IAAI,GAAG,4BAA4B,CAAC;IAE7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,6CAA8C,SAAQ,kBAAkB;IAC1D,IAAI,GAAG,kCAAkC,CAAC;IAEnE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oCAAqC,SAAQ,kBAAkB;IACjD,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-access-identity.d.ts

@@ -0,0 +1,14 @@
+import type { SimCloudFrontS3OriginConfig } from "../../command/create-distribution/create-distribution.command.js";
+/**
+ * Refuse an S3 Origin that reads its Bucket as a legacy origin access identity.
+ *
+ * An origin access identity signs the Origin request as a CloudFront canonical
+ * user, which nothing here models. A Bucket policy granting that canonical user
+ * would be evaluated against an anonymous read and deny it, so the Origin would
+ * serve nothing and say nothing useful about why. Refusing the declaration by
+ * name says it instead.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+ */
+export declare function assertNoSimCfS3OriginAccessIdentity(originId: string, s3OriginConfig: SimCloudFrontS3OriginConfig): void;
+//# sourceMappingURL=sim-cf-s3-origin-access-identity.d.ts.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-access-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-access-identity.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-access-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kEAAkE,CAAC;AAEpH;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,2BAA2B,GAC1C,IAAI,CAUN"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-access-identity.js

@@ -0,0 +1,19 @@
+/**
+ * Refuse an S3 Origin that reads its Bucket as a legacy origin access identity.
+ *
+ * An origin access identity signs the Origin request as a CloudFront canonical
+ * user, which nothing here models. A Bucket policy granting that canonical user
+ * would be evaluated against an anonymous read and deny it, so the Origin would
+ * serve nothing and say nothing useful about why. Refusing the declaration by
+ * name says it instead.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+ */
+export function assertNoSimCfS3OriginAccessIdentity(originId, s3OriginConfig) {
+    const originAccessIdentity = s3OriginConfig.OriginAccessIdentity ?? "";
+    if (originAccessIdentity === "") {
+        return;
+    }
+    throw new Error(`Sim CloudFront Origin ${originId} sets S3OriginConfig.OriginAccessIdentity to ${originAccessIdentity}, and a legacy origin access identity is not simulated. Use an origin access control, or leave OriginAccessIdentity empty for the anonymous read CloudFront makes without one.`);
+}
+//# sourceMappingURL=sim-cf-s3-origin-access-identity.js.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-access-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-access-identity.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-access-identity.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mCAAmC,CACjD,QAAgB,EAChB,cAA2C;IAE3C,MAAM,oBAAoB,GAAG,cAAc,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAEvE,IAAI,oBAAoB,KAAK,EAAE,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,gDAAgD,oBAAoB,gLAAgL,CACtR,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-bucket.d.ts

@@ -0,0 +1,14 @@
+import type { SimS3Bucket } from "../../../s3/bucket/sim-s3-bucket.js";
+import type { SimS3 } from "../../../s3/sim-s3.js";
+/**
+ * The Bucket an S3 Origin serves, with the simulated S3 that holds it.
+ *
+ * The scope comes along with the Bucket because an Origin reads through that
+ * scope's GetObject command rather than out of Bucket storage, so the Bucket
+ * policy decides what the Origin can serve, as it does in real S3.
+ */
+export interface SimCfS3OriginBucket {
+    readonly bucket: SimS3Bucket;
+    readonly simS3: SimS3;
+}
+//# sourceMappingURL=sim-cf-s3-origin-bucket.d.ts.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-bucket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-bucket.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-bucket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-bucket.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-cf-s3-origin-bucket.js.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-bucket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-bucket.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-bucket.ts"],"names":[],"mappings":""}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-object-key.d.ts

@@ -0,0 +1,17 @@
+import type { SimCloudFrontOriginRequest } from "../sim-cloudfront-request-response.js";
+/**
+ * The Bucket object key an S3 Origin reads for a request.
+ *
+ * The Origin path goes in front of the request path, and the result is decoded
+ * and tidied into a key: repeated slashes collapse into one, and the leading
+ * slash goes, because an S3 object key has neither.
+ */
+export declare class SimCfS3OriginObjectKey {
+    private readonly originPath;
+    constructor(originPath: string);
+    /**
+     * The object key one Origin request reads.
+     */
+    forRequest(request: SimCloudFrontOriginRequest): string;
+}
+//# sourceMappingURL=sim-cf-s3-origin-object-key.d.ts.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-object-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-object-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-object-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAExF;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,UAAU,EAAE,MAAM,EAE7B;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CAMtD;CACF"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-object-key.js

@@ -0,0 +1,23 @@
+/**
+ * The Bucket object key an S3 Origin reads for a request.
+ *
+ * The Origin path goes in front of the request path, and the result is decoded
+ * and tidied into a key: repeated slashes collapse into one, and the leading
+ * slash goes, because an S3 object key has neither.
+ */
+export class SimCfS3OriginObjectKey {
+    originPath;
+    constructor(originPath) {
+        this.originPath = originPath;
+    }
+    /**
+     * The object key one Origin request reads.
+     */
+    forRequest(request) {
+        const { pathname } = new URL(request.req.url);
+        return decodeURIComponent(`${this.originPath}/${pathname}`)
+            .replaceAll(/\/+/gu, "/")
+            .replace(/^\/+/u, "");
+    }
+}
+//# sourceMappingURL=sim-cf-s3-origin-object-key.js.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-object-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-object-key.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-object-key.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAChB,UAAU,CAAS;IAEpC,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAmC;QAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE9C,OAAO,kBAAkB,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC;aACxD,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;aACxB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-object-loader.d.ts

@@ -0,0 +1,31 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import type { SimS3RequestOptions } from "../../../s3/command/sim-s3-request-options.js";
+import { SimS3Object } from "../../../s3/object/s3-object.js";
+import type { SimCfS3OriginBucket } from "./sim-cf-s3-origin-bucket.js";
+/**
+ * Reads Objects for a CloudFront S3 Origin.
+ *
+ * The Bucket policy is the only thing that can make an Object readable, whether
+ * the Origin reads anonymously or as the CloudFront service principal an origin
+ * access control signs for. Reading through the ordinary GetObject command is
+ * what applies it: a Bucket whose policy covers neither answers the
+ * Distribution 403 here as it does in real S3.
+ *
+ * Who the read is made as comes in per Object, from `SimCfS3OriginSigner`,
+ * because it depends on the Distribution the request arrived at.
+ */
+export declare class SimCfS3OriginObjectLoader {
+    private readonly simS3;
+    private readonly bucketName;
+    constructor(originBucket: SimCfS3OriginBucket);
+    /**
+     * Load an Object, nothing when the Bucket holds no such key, or the denial
+     * when the Bucket policy does not allow the read.
+     *
+     * A denial is reported rather than raised because it is an Origin response
+     * of its own: absence is 404 and denial is 403, and the Distribution can
+     * have a different custom error response for each.
+     */
+    load(objectKey: string, requestOptions: SimS3RequestOptions): Promise<SimS3Object | SimIamAccessDenied | undefined>;
+}
+//# sourceMappingURL=sim-cf-s3-origin-object-loader.d.ts.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-object-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-object-loader.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-object-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AAEzF,OAAO,EACL,WAAW,EAEZ,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAE7C,YAAY,YAAY,EAAE,mBAAmB,EAG5C;IAED;;;;;;;OAOG;IACG,IAAI,CACR,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,mBAAmB,GAClC,OAAO,CAAC,WAAW,GAAG,kBAAkB,GAAG,SAAS,CAAC,CAyBvD;CACF"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-object-loader.js

@@ -0,0 +1,54 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { SimS3NoSuchKey } from "../../../s3/error/sim-s3.error.js";
+import { SimS3Object, SimS3ObjectMetadata, } from "../../../s3/object/s3-object.js";
+import { simS3BodyToBuffer } from "../../../s3/storage/s3-body-buffer.js";
+/**
+ * Reads Objects for a CloudFront S3 Origin.
+ *
+ * The Bucket policy is the only thing that can make an Object readable, whether
+ * the Origin reads anonymously or as the CloudFront service principal an origin
+ * access control signs for. Reading through the ordinary GetObject command is
+ * what applies it: a Bucket whose policy covers neither answers the
+ * Distribution 403 here as it does in real S3.
+ *
+ * Who the read is made as comes in per Object, from `SimCfS3OriginSigner`,
+ * because it depends on the Distribution the request arrived at.
+ */
+export class SimCfS3OriginObjectLoader {
+    simS3;
+    bucketName;
+    constructor(originBucket) {
+        this.simS3 = originBucket.simS3;
+        this.bucketName = originBucket.bucket.bucketName;
+    }
+    /**
+     * Load an Object, nothing when the Bucket holds no such key, or the denial
+     * when the Bucket policy does not allow the read.
+     *
+     * A denial is reported rather than raised because it is an Origin response
+     * of its own: absence is 404 and denial is 403, and the Distribution can
+     * have a different custom error response for each.
+     */
+    async load(objectKey, requestOptions) {
+        try {
+            const output = await this.simS3.getObject({ input: { Bucket: this.bucketName, Key: objectKey } }, requestOptions);
+            return new SimS3Object({
+                key: objectKey,
+                body: await simS3BodyToBuffer(output.Body),
+                metadata: new SimS3ObjectMetadata({ ...output.Metadata }),
+            });
+        }
+        catch (error) {
+            if (error instanceof SimS3NoSuchKey) {
+                return undefined;
+            }
+            if (error instanceof SimIamAccessDenied) {
+                return error;
+            }
+            // Anything else is the Bucket itself being unreachable, which the
+            // Distribution has no response for and should not hide.
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=sim-cf-s3-origin-object-loader.js.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-object-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-object-loader.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-object-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,WAAW,EACX,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yBAAyB;IACnB,KAAK,CAAQ;IACb,UAAU,CAAkB;IAE7C,YAAY,YAAiC;QAC3C,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CACR,SAAiB,EACjB,cAAmC;QAEnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CACvC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EACtD,cAAc,CACf,CAAC;YAEF,OAAO,IAAI,WAAW,CAAC;gBACrB,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAA6B,CAAC;gBACnE,QAAQ,EAAE,IAAI,mBAAmB,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;gBACpC,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,kEAAkE;YAClE,wDAAwD;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.d.ts

@@ -1,8 +1,17 @@
 import type { SimAws } from "../../../aws/sim-aws.js";
-import type { SimAwsAccountRegionContainer } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimCloudFrontS3OriginResolver } from "./sim-cloudfront-s3-origin.js";
 /**
  * Create an S3 Origin Resolver backed by a simulated AWS Account/Region scope.
+ *
+ * The Bucket is resolved in the Account and Region that own it, which is not
+ * necessarily where the Distribution was created: serving a Bucket owned by
+ * one Account from a Distribution in another is ordinary, and real CloudFront
+ * checks neither ownership nor existence when a Distribution is created. What
+ * the Distribution may read is left to the Bucket policy.
+ *
+ * The simulated S3 holding the Bucket is returned with it, because that is what
+ * the Bucket policy is evaluated by: an Origin reads through that S3's
+ * GetObject command rather than out of Bucket storage.
  */
-export declare function makeSimCfS3OriginResolver(simAws: SimAws, scope: SimAwsAccountRegionContainer): SimCloudFrontS3OriginResolver;
+export declare function makeSimCfS3OriginResolver(simAws: SimAws): SimCloudFrontS3OriginResolver;
 //# sourceMappingURL=sim-cf-s3-origin-resolver-factory.d.ts.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-s3-origin-resolver-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AACjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAInF;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAe/B"}
+{"version":3,"file":"sim-cf-s3-origin-resolver-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAInF;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GACb,6BAA6B,CAoB/B"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.js

@@ -2,17 +2,30 @@ import { bucketNameFromCfS3OriginDomainName } from "./sim-cf-s3-origin-bucket-na
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 /**
  * Create an S3 Origin Resolver backed by a simulated AWS Account/Region scope.
+ *
+ * The Bucket is resolved in the Account and Region that own it, which is not
+ * necessarily where the Distribution was created: serving a Bucket owned by
+ * one Account from a Distribution in another is ordinary, and real CloudFront
+ * checks neither ownership nor existence when a Distribution is created. What
+ * the Distribution may read is left to the Bucket policy.
+ *
+ * The simulated S3 holding the Bucket is returned with it, because that is what
+ * the Bucket policy is evaluated by: an Origin reads through that S3's
+ * GetObject command rather than out of Bucket storage.
  */
-export function makeSimCfS3OriginResolver(simAws, scope) {
+export function makeSimCfS3OriginResolver(simAws) {
     return (originDomainName) => {
         const bucketName = bucketNameFromCfS3OriginDomainName(originDomainName);
         const bucketScope = simAws.s3().findBucketScope(bucketName);
         assertDefined(bucketScope, `Unable to find sim S3 Bucket ${bucketName} for sim CloudFront S3 Origin`);
-        return simAws
-            .region(bucketScope.regionName)
-            .account(scope.account.accountId)
-            .s3()
-            .getSimBucketByName(bucketName);
+        const simS3 = simAws
+            .accountRegionScope(bucketScope.accountId, bucketScope.regionName)
+            .s3();
+        const bucket = simS3.getSimBucketByName(bucketName);
+        if (bucket === undefined) {
+            return;
+        }
+        return { bucket, simS3 };
     };
 }
 //# sourceMappingURL=sim-cf-s3-origin-resolver-factory.js.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-s3-origin-resolver-factory.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAEvE;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,KAAmC;IAEnC,OAAO,CAAC,gBAAwB,EAAE,EAAE;QAClC,MAAM,UAAU,GAAG,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5D,aAAa,CACX,WAAW,EACX,gCAAgC,UAAU,+BAA+B,CAC1E,CAAC;QAEF,OAAO,MAAM;aACV,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;aAC9B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;aAChC,EAAE,EAAE;aACJ,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-cf-s3-origin-resolver-factory.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc;IAEd,OAAO,CAAC,gBAAwB,EAAE,EAAE;QAClC,MAAM,UAAU,GAAG,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5D,aAAa,CACX,WAAW,EACX,gCAAgC,UAAU,+BAA+B,CAC1E,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM;aACjB,kBAAkB,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,UAAU,CAAC;aACjE,EAAE,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-responses.d.ts

@@ -0,0 +1,32 @@
+import type { SimS3BucketName } from "../../../s3/bucket/sim-s3-bucket.js";
+import type { SimS3Object } from "../../../s3/object/s3-object.js";
+/**
+ * The responses a CloudFront S3 Origin answers a Distribution with.
+ *
+ * Kept apart from the Origin because deciding what to serve and building the
+ * response that serves it are separate jobs, and only the first one is
+ * interesting.
+ */
+export declare class SimCfS3OriginResponses {
+    private readonly bucketName;
+    constructor(bucketName: SimS3BucketName);
+    /**
+     * Serve an Object, with no body when the request was a HEAD.
+     */
+    foundObject(object: SimS3Object, request: Request): Response;
+    /**
+     * Report an Object the Bucket does not hold.
+     */
+    notFound(objectKey: string): Response;
+    /**
+     * The 403 S3 answers an unsigned read of an Object it has not been told to
+     * make public, which the Distribution's custom error response for 403 can
+     * then replace, as it does in CloudFront.
+     */
+    accessDenied(objectKey: string): Response;
+    /**
+     * Refuse a method an S3 Origin does not answer.
+     */
+    methodNotAllowed(method: string): Response;
+}
+//# sourceMappingURL=sim-cf-s3-origin-responses.d.ts.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-responses.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-responses.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAOnE;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,eAAe,EAAI;IAE5D;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,CAW3D;IAED;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAKpC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAKxC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAKzC;CACF"}