@kensio/yulin 1.10.0 → 1.10.2

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-responses.js

@@ -0,0 +1,51 @@
+import { simS3ObjectResponseHeaders } from "../../../s3/object/s3-object-response-headers.js";
+const plainTextHeaders = {
+    "content-type": "text/plain; charset=utf-8",
+};
+/**
+ * The responses a CloudFront S3 Origin answers a Distribution with.
+ *
+ * Kept apart from the Origin because deciding what to serve and building the
+ * response that serves it are separate jobs, and only the first one is
+ * interesting.
+ */
+export class SimCfS3OriginResponses {
+    bucketName;
+    constructor(bucketName) {
+        this.bucketName = bucketName;
+    }
+    /**
+     * Serve an Object, with no body when the request was a HEAD.
+     */
+    foundObject(object, request) {
+        const headers = simS3ObjectResponseHeaders(object.metadata.values, object.body.length);
+        if (request.method === "HEAD") {
+            return new Response(undefined, { status: 200, headers });
+        }
+        return new Response(object.body, { status: 200, headers });
+    }
+    /**
+     * Report an Object the Bucket does not hold.
+     */
+    notFound(objectKey) {
+        return new Response(`Object ${objectKey} not found in sim S3 Bucket ${this.bucketName}`, { status: 404, headers: plainTextHeaders });
+    }
+    /**
+     * The 403 S3 answers an unsigned read of an Object it has not been told to
+     * make public, which the Distribution's custom error response for 403 can
+     * then replace, as it does in CloudFront.
+     */
+    accessDenied(objectKey) {
+        return new Response(`Access denied reading Object ${objectKey} from sim S3 Bucket ${this.bucketName}`, { status: 403, headers: plainTextHeaders });
+    }
+    /**
+     * Refuse a method an S3 Origin does not answer.
+     */
+    methodNotAllowed(method) {
+        return new Response(`Method ${method} not allowed`, {
+            status: 405,
+            headers: { allow: "GET, HEAD", ...plainTextHeaders },
+        });
+    }
+}
+//# sourceMappingURL=sim-cf-s3-origin-responses.js.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-responses.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-responses.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAE9F,MAAM,gBAAgB,GAAG;IACvB,cAAc,EAAE,2BAA2B;CACnC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACJ,UAAU;IAAvC,YAA6B,UAA2B;0BAA3B,UAAU;IAAoB,CAAC;IAE5D;;OAEG;IACH,WAAW,CAAC,MAAmB,EAAE,OAAgB;QAC/C,MAAM,OAAO,GAAG,0BAA0B,CACxC,MAAM,CAAC,QAAQ,CAAC,MAAM,EACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CACnB,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAiB;QACxB,OAAO,IAAI,QAAQ,CACjB,UAAU,SAAS,+BAA+B,IAAI,CAAC,UAAU,EAAE,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,QAAQ,CACjB,gCAAgC,SAAS,uBAAuB,IAAI,CAAC,UAAU,EAAE,EACjF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAc;QAC7B,OAAO,IAAI,QAAQ,CAAC,UAAU,MAAM,cAAc,EAAE;YAClD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,gBAAgB,EAAE;SACrD,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-signer.d.ts

@@ -0,0 +1,26 @@
+import type { SimS3RequestOptions } from "../../../s3/command/sim-s3-request-options.js";
+import type { SimCloudFrontOriginAccessControl } from "../../origin-access-control/sim-cf-origin-access-control.js";
+import type { SimCloudFrontOriginRequest } from "../sim-cloudfront-request-response.js";
+/**
+ * Who a CloudFront S3 Origin reads its Bucket as.
+ *
+ * An origin access control that signs makes the read a request from the
+ * CloudFront service principal carrying the Distribution's ARN, which is the
+ * pair a Bucket policy for an origin access control is written against. Without
+ * one, or with a `SigningBehavior` of `never`, CloudFront sends the S3 REST
+ * endpoint an unsigned request, so the read is anonymous.
+ *
+ * Which Distribution the read belongs to is only known per request, so this
+ * answers per read rather than when the Origin is built. Nothing about the read
+ * could be settled earlier anyway: in a CDK stack the Bucket policy is created
+ * after the Distribution, because it names the Distribution's ARN.
+ */
+export declare class SimCfS3OriginSigner {
+    private readonly originAccessControl;
+    constructor(originAccessControl?: SimCloudFrontOriginAccessControl);
+    /**
+     * The S3 request options one Origin read is made with.
+     */
+    forRequest(request: SimCloudFrontOriginRequest): SimS3RequestOptions;
+}
+//# sourceMappingURL=sim-cf-s3-origin-signer.d.ts.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-signer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-signer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AAEzF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAEtB;IAEd,YAAY,mBAAmB,CAAC,EAAE,gCAAgC,EAEjE;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,0BAA0B,GAAG,mBAAmB,CAUnE;CACF"}

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-signer.js

@@ -0,0 +1,36 @@
+import { simCloudFrontDistributionArn } from "../../distribution/sim-cf-distribution-view.js";
+import { simCloudFrontServicePrincipal } from "../../sim-cloudfront-service-principal.js";
+/**
+ * Who a CloudFront S3 Origin reads its Bucket as.
+ *
+ * An origin access control that signs makes the read a request from the
+ * CloudFront service principal carrying the Distribution's ARN, which is the
+ * pair a Bucket policy for an origin access control is written against. Without
+ * one, or with a `SigningBehavior` of `never`, CloudFront sends the S3 REST
+ * endpoint an unsigned request, so the read is anonymous.
+ *
+ * Which Distribution the read belongs to is only known per request, so this
+ * answers per read rather than when the Origin is built. Nothing about the read
+ * could be settled earlier anyway: in a CDK stack the Bucket policy is created
+ * after the Distribution, because it names the Distribution's ARN.
+ */
+export class SimCfS3OriginSigner {
+    originAccessControl;
+    constructor(originAccessControl) {
+        this.originAccessControl = originAccessControl;
+    }
+    /**
+     * The S3 request options one Origin read is made with.
+     */
+    forRequest(request) {
+        if (this.originAccessControl?.signs !== true) {
+            return { caller: { kind: "anonymous" } };
+        }
+        return {
+            caller: { kind: "service", service: simCloudFrontServicePrincipal },
+            sourceArn: simCloudFrontDistributionArn(request.distribution),
+            sourceAccount: request.distribution.accountId,
+        };
+    }
+}
+//# sourceMappingURL=sim-cf-s3-origin-signer.js.map

package/dist/service/cloudfront/origin/s3/sim-cf-s3-origin-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-s3-origin-signer.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cf-s3-origin-signer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAE9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAG1F;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,mBAAmB;IACb,mBAAmB,CAEtB;IAEd,YAAY,mBAAsD;QAChE,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAmC;QAC5C,IAAI,IAAI,CAAC,mBAAmB,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3C,CAAC;QAED,OAAO;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,EAAE;YACnE,SAAS,EAAE,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC;YAC7D,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS;SAC9C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/origin/s3/sim-cloudfront-s3-origin.d.ts

@@ -1,33 +1,49 @@
-import type { SimS3Bucket } from "../../../s3/bucket/sim-s3-bucket.js";
 import type { SimCloudFrontOriginRequest } from "../sim-cloudfront-request-response.js";
 import type { SimCloudFrontOrigin } from "../sim-cloudfront-origin.js";
-export type SimCloudFrontS3OriginResolver = (originDomainName: string) => SimS3Bucket | undefined;
+import type { SimCloudFrontOriginAccessControl } from "../../origin-access-control/sim-cf-origin-access-control.js";
+import type { SimCfS3OriginBucket } from "./sim-cf-s3-origin-bucket.js";
+export type SimCloudFrontS3OriginResolver = (originDomainName: string) => SimCfS3OriginBucket | undefined;
 /**
  * Default S3 Origin Resolver that returns undefined for all origin domains.
  */
 export declare function emptyCloudFrontS3OriginResolver(): undefined;
 interface SimCloudFrontS3OriginProperties {
-    readonly bucket: SimS3Bucket;
+    readonly originBucket: SimCfS3OriginBucket;
     readonly originPath?: string | undefined;
+    readonly originAccessControl?: SimCloudFrontOriginAccessControl | undefined;
 }
 /**
  * Simulated CloudFront S3 Origin.
  *
  * This represents a basic S3 object origin, not an S3 static website endpoint.
+ *
+ * Objects are read through the ordinary GetObject command, so the Bucket policy
+ * decides what the Origin can serve. An Origin whose origin access control
+ * signs reads as the CloudFront service principal, and one without reads
+ * anonymously, which is the unsigned request real CloudFront sends to the S3
+ * REST endpoint. An Object the Bucket policy does not make readable by whoever
+ * the Origin is reading as is refused, and the refusal reaches the viewer as
+ * the Origin answering 403.
  */
 export declare class SimCloudFrontS3Origin implements SimCloudFrontOrigin {
-    private readonly bucket;
-    private readonly originPath;
+    /**
+     * The origin access control this Origin was created with, if any.
+     *
+     * One that signs is what makes the read below a request from the CloudFront
+     * service principal carrying this Distribution's ARN, so a Bucket policy
+     * written for an origin access control is what decides the read.
+     */
+    readonly originAccessControl: SimCloudFrontOriginAccessControl | undefined;
+    private readonly loader;
+    private readonly responses;
+    private readonly objectKey;
+    private readonly signer;
     constructor(properties: SimCloudFrontS3OriginProperties);
     /**
      * Fetch an object from the backing simulated S3 Bucket.
      */
     fetch(request: SimCloudFrontOriginRequest): Promise<Response>;
     private methodSupported;
-    private objectKeyForRequest;
-    private normalizeObjectKey;
-    private foundObjectResponse;
-    private notFoundResponse;
 }
 export {};
 //# sourceMappingURL=sim-cloudfront-s3-origin.d.ts.map

package/dist/service/cloudfront/origin/s3/sim-cloudfront-s3-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-s3-origin.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cloudfront-s3-origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAGvE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,MAAM,MAAM,6BAA6B,GAAG,CAC1C,gBAAgB,EAAE,MAAM,KACrB,WAAW,GAAG,SAAS,CAAC;AAE7B;;GAEG;AACH,wBAAgB,+BAA+B,IAAI,SAAS,CAG3D;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,YAAW,mBAAmB;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACG,KAAK,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmBlE;IAED,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,gBAAgB;CAWzB"}
+{"version":3,"file":"sim-cloudfront-s3-origin.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cloudfront-s3-origin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAC;AACpH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAMxE,MAAM,MAAM,6BAA6B,GAAG,CAC1C,gBAAgB,EAAE,MAAM,KACrB,mBAAmB,GAAG,SAAS,CAAC;AAErC;;GAEG;AACH,wBAAgB,+BAA+B,IAAI,SAAS,CAG3D;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;CAC7E;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,YAAW,mBAAmB;IAC/D;;;;;;OAMG;IACH,SAAgB,mBAAmB,EAC/B,gCAAgC,GAChC,SAAS,CAAC;IAEd,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAE7C,YAAY,UAAU,EAAE,+BAA+B,EAQtD;IAED;;OAEG;IACG,KAAK,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBlE;IAED,OAAO,CAAC,eAAe;CAGxB"}

package/dist/service/cloudfront/origin/s3/sim-cloudfront-s3-origin.js

@@ -1,4 +1,8 @@
-import { simS3ObjectResponseHeaders } from "../../../s3/object/s3-object-response-headers.js";
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { SimCfS3OriginObjectKey } from "./sim-cf-s3-origin-object-key.js";
+import { SimCfS3OriginObjectLoader } from "./sim-cf-s3-origin-object-loader.js";
+import { SimCfS3OriginResponses } from "./sim-cf-s3-origin-responses.js";
+import { SimCfS3OriginSigner } from "./sim-cf-s3-origin-signer.js";
 /**
  * Default S3 Origin Resolver that returns undefined for all origin domains.
  */
@@ -10,67 +14,55 @@ export function emptyCloudFrontS3OriginResolver() {
  * Simulated CloudFront S3 Origin.
  *
  * This represents a basic S3 object origin, not an S3 static website endpoint.
+ *
+ * Objects are read through the ordinary GetObject command, so the Bucket policy
+ * decides what the Origin can serve. An Origin whose origin access control
+ * signs reads as the CloudFront service principal, and one without reads
+ * anonymously, which is the unsigned request real CloudFront sends to the S3
+ * REST endpoint. An Object the Bucket policy does not make readable by whoever
+ * the Origin is reading as is refused, and the refusal reaches the viewer as
+ * the Origin answering 403.
  */
 export class SimCloudFrontS3Origin {
-    bucket;
-    originPath;
+    /**
+     * The origin access control this Origin was created with, if any.
+     *
+     * One that signs is what makes the read below a request from the CloudFront
+     * service principal carrying this Distribution's ARN, so a Bucket policy
+     * written for an origin access control is what decides the read.
+     */
+    originAccessControl;
+    loader;
+    responses;
+    objectKey;
+    signer;
     constructor(properties) {
-        this.bucket = properties.bucket;
-        this.originPath = properties.originPath ?? "";
+        this.loader = new SimCfS3OriginObjectLoader(properties.originBucket);
+        this.signer = new SimCfS3OriginSigner(properties.originAccessControl);
+        this.responses = new SimCfS3OriginResponses(properties.originBucket.bucket.bucketName);
+        this.objectKey = new SimCfS3OriginObjectKey(properties.originPath ?? "");
+        this.originAccessControl = properties.originAccessControl;
     }
     /**
      * Fetch an object from the backing simulated S3 Bucket.
      */
     async fetch(request) {
-        if (!this.methodSupported(request.req.method)) {
-            return new Response(`Method ${request.req.method} not allowed`, {
-                status: 405,
-                headers: {
-                    allow: "GET, HEAD",
-                    "content-type": "text/plain; charset=utf-8",
-                },
-            });
+        const { method } = request.req;
+        if (!this.methodSupported(method)) {
+            return this.responses.methodNotAllowed(method);
+        }
+        const objectKey = this.objectKey.forRequest(request);
+        const object = await this.loader.load(objectKey, this.signer.forRequest(request));
+        if (object instanceof SimIamAccessDenied) {
+            return this.responses.accessDenied(objectKey);
         }
-        const objectKey = this.objectKeyForRequest(request);
-        const object = await this.bucket.getObject(objectKey);
         if (object === undefined) {
-            return this.notFoundResponse(objectKey);
+            return this.responses.notFound(objectKey);
         }
-        return this.foundObjectResponse(object, request.req);
+        return this.responses.foundObject(object, request.req);
     }
     methodSupported(method) {
         return method === "GET" || method === "HEAD";
     }
-    objectKeyForRequest(request) {
-        const url = new URL(request.req.url);
-        const requestPath = url.pathname;
-        return this.normalizeObjectKey(`${this.originPath}/${requestPath}`);
-    }
-    normalizeObjectKey(path) {
-        return decodeURIComponent(path)
-            .replaceAll(/\/+/gu, "/")
-            .replace(/^\/+/u, "");
-    }
-    foundObjectResponse(object, request) {
-        const headers = simS3ObjectResponseHeaders(object.metadata.values, object.body.length);
-        if (request.method === "HEAD") {
-            return new Response(undefined, {
-                status: 200,
-                headers,
-            });
-        }
-        return new Response(object.body, {
-            status: 200,
-            headers,
-        });
-    }
-    notFoundResponse(objectKey) {
-        return new Response(`Object ${objectKey} not found in sim S3 Bucket ${this.bucket.bucketName}`, {
-            status: 404,
-            headers: {
-                "content-type": "text/plain; charset=utf-8",
-            },
-        });
-    }
 }
 //# sourceMappingURL=sim-cloudfront-s3-origin.js.map

package/dist/service/cloudfront/origin/s3/sim-cloudfront-s3-origin.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-s3-origin.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cloudfront-s3-origin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAQ9F;;GAEG;AACH,MAAM,UAAU,+BAA+B;IAC7C,oBAAoB;IACpB,OAAO;AACT,CAAC;AAOD;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IACf,MAAM,CAAc;IACpB,UAAU,CAAS;IAEpC,YAAY,UAA2C;QACrD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,OAAmC;QAC7C,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,QAAQ,CAAC,UAAU,OAAO,CAAC,GAAG,CAAC,MAAM,cAAc,EAAE;gBAC9D,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,KAAK,EAAE,WAAW;oBAClB,cAAc,EAAE,2BAA2B;iBAC5C;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAEtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAEO,eAAe,CAAC,MAAc;QACpC,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IAC/C,CAAC;IAEO,mBAAmB,CAAC,OAAmC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;QAEjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC,CAAC;IACtE,CAAC;IAEO,kBAAkB,CAAC,IAAY;QACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;aACxB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC;IAEO,mBAAmB,CAAC,MAAmB,EAAE,OAAgB;QAC/D,MAAM,OAAO,GAAG,0BAA0B,CACxC,MAAM,CAAC,QAAQ,CAAC,MAAM,EACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CACnB,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;gBAC7B,MAAM,EAAE,GAAG;gBACX,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC/B,MAAM,EAAE,GAAG;YACX,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACxC,OAAO,IAAI,QAAQ,CACjB,UAAU,SAAS,+BAA+B,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAC1E;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,2BAA2B;aAC5C;SACF,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cloudfront-s3-origin.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/s3/sim-cloudfront-s3-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAKzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAMnE;;GAEG;AACH,MAAM,UAAU,+BAA+B;IAC7C,oBAAoB;IACpB,OAAO;AACT,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAqB;IAChC;;;;;;OAMG;IACa,mBAAmB,CAErB;IAEG,MAAM,CAA4B;IAClC,SAAS,CAAyB;IAClC,SAAS,CAAyB;IAClC,MAAM,CAAsB;IAE7C,YAAY,UAA2C;QACrD,IAAI,CAAC,MAAM,GAAG,IAAI,yBAAyB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,IAAI,sBAAsB,CACzC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAC1C,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,sBAAsB,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,OAAmC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QAE/B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,SAAS,EACT,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAChC,CAAC;QAEF,IAAI,MAAM,YAAY,kBAAkB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IAEO,eAAe,CAAC,MAAc;QACpC,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IAC/C,CAAC;CACF"}

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control-registry.d.ts

@@ -0,0 +1,28 @@
+import type { SimCloudFrontOriginAccessControl, SimCloudFrontOriginAccessControlId } from "./sim-cf-origin-access-control.js";
+/**
+ * The origin access controls one simulated CloudFront holds.
+ *
+ * They are found by ID, which is what an Origin's `OriginAccessControlId`
+ * names, and by name, which is what decides whether a new one may be stored.
+ */
+export declare class SimCloudFrontOriginAccessControlRegistry {
+    private readonly originAccessControls;
+    /**
+     * Store an origin access control, refusing a name another one already holds
+     * as CloudFront does.
+     */
+    add(originAccessControl: SimCloudFrontOriginAccessControl): void;
+    /**
+     * Forget an origin access control.
+     */
+    remove(originAccessControlId: SimCloudFrontOriginAccessControlId): void;
+    /**
+     * Get an origin access control by ID.
+     */
+    byId(originAccessControlId: SimCloudFrontOriginAccessControlId | string): SimCloudFrontOriginAccessControl | undefined;
+    /**
+     * Get an origin access control by name.
+     */
+    byName(originAccessControlName: string): SimCloudFrontOriginAccessControl | undefined;
+}
+//# sourceMappingURL=sim-cf-origin-access-control-registry.d.ts.map

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-origin-access-control-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,kCAAkC,EAEnC,MAAM,mCAAmC,CAAC;AAE3C;;;;;GAKG;AACH,qBAAa,wCAAwC;IACnD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CACzB;IAEZ;;;OAGG;IACH,GAAG,CAAC,mBAAmB,EAAE,gCAAgC,GAAG,IAAI,CAQ/D;IAED;;OAEG;IACH,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,GAAG,IAAI,CAEtE;IAED;;OAEG;IACH,IAAI,CACF,qBAAqB,EAAE,kCAAkC,GAAG,MAAM,GACjE,gCAAgC,GAAG,SAAS,CAI9C;IAED;;OAEG;IACH,MAAM,CACJ,uBAAuB,EAAE,MAAM,GAC9B,gCAAgC,GAAG,SAAS,CAO9C;CACF"}

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control-registry.js

@@ -0,0 +1,41 @@
+import { SimCloudFrontOriginAccessControlAlreadyExists } from "../error/sim-cloudfront.error.js";
+/**
+ * The origin access controls one simulated CloudFront holds.
+ *
+ * They are found by ID, which is what an Origin's `OriginAccessControlId`
+ * names, and by name, which is what decides whether a new one may be stored.
+ */
+export class SimCloudFrontOriginAccessControlRegistry {
+    originAccessControls = new Map();
+    /**
+     * Store an origin access control, refusing a name another one already holds
+     * as CloudFront does.
+     */
+    add(originAccessControl) {
+        if (this.byName(originAccessControl.name) !== undefined) {
+            throw new SimCloudFrontOriginAccessControlAlreadyExists(`Sim CloudFront origin access control ${originAccessControl.name} already exists`);
+        }
+        this.originAccessControls.set(originAccessControl.id, originAccessControl);
+    }
+    /**
+     * Forget an origin access control.
+     */
+    remove(originAccessControlId) {
+        this.originAccessControls.delete(originAccessControlId);
+    }
+    /**
+     * Get an origin access control by ID.
+     */
+    byId(originAccessControlId) {
+        return this.originAccessControls.get(originAccessControlId);
+    }
+    /**
+     * Get an origin access control by name.
+     */
+    byName(originAccessControlName) {
+        return this.originAccessControls
+            .values()
+            .find((originAccessControl) => originAccessControl.name === originAccessControlName);
+    }
+}
+//# sourceMappingURL=sim-cf-origin-access-control-registry.js.map

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-origin-access-control-registry.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6CAA6C,EAAE,MAAM,kCAAkC,CAAC;AAOjG;;;;;GAKG;AACH,MAAM,OAAO,wCAAwC;IAClC,oBAAoB,GACnC,IAAI,GAAG,EAAE,CAAC;IAEZ;;;OAGG;IACH,GAAG,CAAC,mBAAqD;QACvD,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,6CAA6C,CACrD,wCAAwC,mBAAmB,CAAC,IAAI,iBAAiB,CAClF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,qBAAyD;QAC9D,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,IAAI,CACF,qBAAkE;QAElE,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAClC,qBAA2D,CAC5D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,uBAA+B;QAE/B,OAAO,IAAI,CAAC,oBAAoB;aAC7B,MAAM,EAAE;aACR,IAAI,CACH,CAAC,mBAAmB,EAAE,EAAE,CACtB,mBAAmB,CAAC,IAAI,KAAK,uBAAuB,CACvD,CAAC;IACN,CAAC;CACF"}

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.d.ts

@@ -0,0 +1,61 @@
+import type { Brand } from "../../../util/brand.type.js";
+export type SimCloudFrontOriginAccessControlId = Brand<string, "SimCloudFrontOriginAccessControlId">;
+/**
+ * When CloudFront signs the request it sends to the Origin.
+ *
+ * `always` signs every request. `never` signs none, which turns the origin
+ * access control off without removing it. `no-override` signs a request the
+ * viewer did not already sign, and passes a signed one through.
+ */
+export type SimCloudFrontOriginAccessControlSigningBehavior = "always" | "never" | "no-override";
+interface SimCloudFrontOriginAccessControlProperties {
+    readonly id?: SimCloudFrontOriginAccessControlId;
+    readonly name: string;
+    readonly description?: string;
+    readonly signingBehavior: SimCloudFrontOriginAccessControlSigningBehavior;
+}
+/**
+ * Simulated CloudFront origin access control.
+ *
+ * An origin access control is attached to an Origin, and it is how a
+ * Distribution authenticates to a private S3 Bucket: CloudFront signs the
+ * Origin request with SigV4 as the CloudFront service principal, and the Bucket
+ * policy grants that principal on the Distribution's ARN.
+ *
+ * Only an `s3` origin type signed with `sigv4` is modelled, so those are fixed
+ * here rather than stored. Anything else is refused where the origin access
+ * control is read, rather than kept and treated as though it behaved like the
+ * supported values.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+ */
+export declare class SimCloudFrontOriginAccessControl {
+    readonly id: SimCloudFrontOriginAccessControlId;
+    readonly name: string;
+    readonly description: string | undefined;
+    readonly signingBehavior: SimCloudFrontOriginAccessControlSigningBehavior;
+    /**
+     * The kind of Origin this origin access control signs for.
+     */
+    readonly originType = "s3";
+    /**
+     * The protocol CloudFront signs the Origin request with.
+     */
+    readonly signingProtocol = "sigv4";
+    constructor(properties: SimCloudFrontOriginAccessControlProperties);
+    /**
+     * Whether this origin access control signs the request for an Origin read.
+     *
+     * `no-override` signs a request the viewer did not sign, and nothing here
+     * sends a pre-signed viewer request to an Origin, so it signs too.
+     */
+    get signs(): boolean;
+}
+export type SimCloudFrontOriginAccessControlMap = Map<SimCloudFrontOriginAccessControlId, SimCloudFrontOriginAccessControl>;
+/**
+ * Generate a fake sim CloudFront origin access control ID, in the shape
+ * CloudFront gives one.
+ */
+export declare function makeOriginAccessControlId(): SimCloudFrontOriginAccessControlId;
+export {};
+//# sourceMappingURL=sim-cf-origin-access-control.d.ts.map

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-origin-access-control.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,MAAM,kCAAkC,GAAG,KAAK,CACpD,MAAM,EACN,oCAAoC,CACrC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+CAA+C,GACvD,QAAQ,GACR,OAAO,GACP,aAAa,CAAC;AAElB,UAAU,0CAA0C;IAClD,QAAQ,CAAC,EAAE,CAAC,EAAE,kCAAkC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,+CAA+C,CAAC;CAC3E;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,EAAE,EAAE,kCAAkC,CAAC;IACvD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,eAAe,EAAE,+CAA+C,CAAC;IAEjF;;OAEG;IACH,SAAgB,UAAU,QAAQ;IAElC;;OAEG;IACH,SAAgB,eAAe,WAAW;IAE1C,YAAY,UAAU,EAAE,0CAA0C,EAKjE;IAED;;;;;OAKG;IACH,IAAI,KAAK,IAAI,OAAO,CAEnB;CACF;AAED,MAAM,MAAM,mCAAmC,GAAG,GAAG,CACnD,kCAAkC,EAClC,gCAAgC,CACjC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,kCAAkC,CAI9E"}

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.js

@@ -0,0 +1,53 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Simulated CloudFront origin access control.
+ *
+ * An origin access control is attached to an Origin, and it is how a
+ * Distribution authenticates to a private S3 Bucket: CloudFront signs the
+ * Origin request with SigV4 as the CloudFront service principal, and the Bucket
+ * policy grants that principal on the Distribution's ARN.
+ *
+ * Only an `s3` origin type signed with `sigv4` is modelled, so those are fixed
+ * here rather than stored. Anything else is refused where the origin access
+ * control is read, rather than kept and treated as though it behaved like the
+ * supported values.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+ */
+export class SimCloudFrontOriginAccessControl {
+    id;
+    name;
+    description;
+    signingBehavior;
+    /**
+     * The kind of Origin this origin access control signs for.
+     */
+    originType = "s3";
+    /**
+     * The protocol CloudFront signs the Origin request with.
+     */
+    signingProtocol = "sigv4";
+    constructor(properties) {
+        this.id = properties.id ?? makeOriginAccessControlId();
+        this.name = properties.name;
+        this.description = properties.description;
+        this.signingBehavior = properties.signingBehavior;
+    }
+    /**
+     * Whether this origin access control signs the request for an Origin read.
+     *
+     * `no-override` signs a request the viewer did not sign, and nothing here
+     * sends a pre-signed viewer request to an Origin, so it signs too.
+     */
+    get signs() {
+        return this.signingBehavior !== "never";
+    }
+}
+/**
+ * Generate a fake sim CloudFront origin access control ID, in the shape
+ * CloudFront gives one.
+ */
+export function makeOriginAccessControlId() {
+    return faker.helpers.fromRegExp(/E[0-9A-Z]{13}/);
+}
+//# sourceMappingURL=sim-cf-origin-access-control.js.map

package/dist/service/cloudfront/origin-access-control/sim-cf-origin-access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-origin-access-control.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/origin-access-control/sim-cf-origin-access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AA4BxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAgC;IAC3B,EAAE,CAAqC;IACvC,IAAI,CAAS;IACb,WAAW,CAAqB;IAChC,eAAe,CAAkD;IAEjF;;OAEG;IACa,UAAU,GAAG,IAAI,CAAC;IAElC;;OAEG;IACa,eAAe,GAAG,OAAO,CAAC;IAE1C,YAAY,UAAsD;QAChE,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,yBAAyB,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC;IAC1C,CAAC;CACF;AAOD;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAC7B,eAAe,CACsB,CAAC;AAC1C,CAAC"}

package/dist/service/cloudfront/resolver/sim-cloudfront-path-pattern.d.ts

@@ -23,6 +23,16 @@ export declare class SimCloudFrontPathPattern {
      */
     specificity(): number;
     private regex;
+    /**
+     * Reduce each run of stars to a single star.
+     *
+     * A star already matches across `/`, so `**` means what `*` means, and
+     * leaving the run would compile to `.*.*` and give the engine a needless
+     * amount of backtracking to do on a long near miss. Stars are collapsed as
+     * graphemes rather than in the raw pattern so that a star opening a cluster,
+     * as the keycap `*️⃣` does, stays the literal it is read as below.
+     */
+    private collapseStarRuns;
     private graphemes;
     private escapeRegexChar;
 }

package/dist/service/cloudfront/resolver/sim-cloudfront-path-pattern.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-path-pattern.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/resolver/sim-cloudfront-path-pattern.ts"],"names":[],"mappings":"AAAA,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAE/B;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YAAY,UAAU,EAAE,kCAAkC,EAEzD;IAED;;OAEG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEpC;IAED;;OAEG;IACH,WAAW,IAAI,MAAM,CAIpB;IAED,OAAO,CAAC,KAAK;IAwBb,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,eAAe;CAGxB"}
+{"version":3,"file":"sim-cloudfront-path-pattern.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/resolver/sim-cloudfront-path-pattern.ts"],"names":[],"mappings":"AAAA,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAE/B;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YAAY,UAAU,EAAE,kCAAkC,EAEzD;IAED;;OAEG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEpC;IAED;;OAEG;IACH,WAAW,IAAI,MAAM,CAIpB;IAED,OAAO,CAAC,KAAK;IAgCb;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,eAAe;CAGxB"}

package/dist/service/cloudfront/resolver/sim-cloudfront-path-pattern.js

@@ -30,7 +30,7 @@ export class SimCloudFrontPathPattern {
         }).length;
     }
     regex() {
-        const safeRegexPattern = this.graphemes(this.pathPattern)
+        const safeRegexPattern = this.collapseStarRuns(this.graphemes(this.pathPattern))
             .map((char) => {
             if (char === "*") {
                 return ".*";
@@ -45,10 +45,30 @@ export class SimCloudFrontPathPattern {
          * Path patterns are not accepted as regex syntax. They are converted from a
          * small CloudFront-style wildcard language where only "*" and "?" have
          * special meaning. All other graphemes are escaped above.
+         *
+         * Stars the pattern keeps apart still compile to a `.*` each, and a pattern
+         * holding a lot of them can take a backtracking engine a long time to
+         * settle on a long near miss. That is left alone: a path pattern is written
+         * into a Distribution by whoever configured it, never carried on a request,
+         * so the only run a pathological one can hold up is their own.
          */
-        // eslint-disable-next-line security/detect-non-literal-regexp
+        // oxlint-disable-next-line security/detect-non-literal-regexp
         return new RegExp(`^${safeRegexPattern}$`, "u");
     }
+    /**
+     * Reduce each run of stars to a single star.
+     *
+     * A star already matches across `/`, so `**` means what `*` means, and
+     * leaving the run would compile to `.*.*` and give the engine a needless
+     * amount of backtracking to do on a long near miss. Stars are collapsed as
+     * graphemes rather than in the raw pattern so that a star opening a cluster,
+     * as the keycap `*️⃣` does, stays the literal it is read as below.
+     */
+    collapseStarRuns(graphemes) {
+        return graphemes.filter((char, index) => {
+            return char !== "*" || graphemes[index - 1] !== "*";
+        });
+    }
     graphemes(value) {
         return Array.from(this.graphemeSegmenter.segment(value), (segment) => {
             return segment.segment;

package/dist/service/cloudfront/resolver/sim-cloudfront-path-pattern.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-path-pattern.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/resolver/sim-cloudfront-path-pattern.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,iBAAiB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;QACjE,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;IACc,WAAW,CAAS;IAErC,YAAY,UAA8C;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,WAAmB;QACzB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACtD,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QACtC,CAAC,CAAC,CAAC,MAAM,CAAC;IACZ,CAAC;IAEO,KAAK;QACX,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;aACtD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC;YACb,CAAC;YAED,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ;;;;WAIG;QACH,8DAA8D;QAC9D,OAAO,IAAI,MAAM,CAAC,IAAI,gBAAgB,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,IAAY;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAC;IAClE,CAAC;CACF"}
+{"version":3,"file":"sim-cloudfront-path-pattern.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/resolver/sim-cloudfront-path-pattern.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,iBAAiB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;QACjE,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;IACc,WAAW,CAAS;IAErC,YAAY,UAA8C;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,WAAmB;QACzB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACtD,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QACtC,CAAC,CAAC,CAAC,MAAM,CAAC;IACZ,CAAC;IAEO,KAAK;QACX,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CACjC;aACE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC;YACb,CAAC;YAED,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ;;;;;;;;;;WAUG;QACH,8DAA8D;QAC9D,OAAO,IAAI,MAAM,CAAC,IAAI,gBAAgB,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;OAQG;IACK,gBAAgB,CAAC,SAA4B;QACnD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACtC,OAAO,IAAI,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,IAAY;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/service/cloudfront/sim-cloudfront-commands.d.ts

@@ -14,6 +14,7 @@ import type { SimUpdateDistributionCommand, SimUpdateDistributionCommandOutput }
 import type { SimCloudFrontDistribution, SimCloudFrontDistributionId } from "./distribution/sim-cloudfront-distribution.js";
 import type { SimCfCustomOriginDispatcher } from "./origin/custom/sim-cf-custom-origin-dispatcher.js";
 import { type SimCloudFrontS3OriginResolver } from "./origin/s3/sim-cloudfront-s3-origin.js";
+import type { SimCloudFrontOriginAccessControlRegistry } from "./origin-access-control/sim-cf-origin-access-control-registry.js";
 import { SimCloudFrontRegistry } from "./registry/sim-cloud-front-registry.js";
 /**
  * How one simulated CloudFront is put together.
@@ -31,6 +32,7 @@ interface SimCloudFrontCommandsProperties extends SimCloudFrontProperties {
     readonly accountId: SimAwsAccountId;
     readonly distributions: SimCloudFrontDistributionMap;
     readonly cloudFrontFunctions: SimCloudFrontFunctionMap;
+    readonly originAccessControls: SimCloudFrontOriginAccessControlRegistry;
 }
 /**
  * Options carried by any simulated CloudFront request.
@@ -53,6 +55,7 @@ export declare class SimCloudFrontCommands {
     private readonly s3OriginResolver;
     private readonly customOriginDispatcher;
     private readonly acmRegistry;
+    private readonly originAccessControls;
     constructor(properties: SimCloudFrontCommandsProperties);
     /**
      * Handle a Create Distribution Command from the SDK.