@kensio/yulin 1.10.1 → 1.10.3

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-config.d.ts

@@ -0,0 +1,39 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import { SimCloudFrontOriginAccessControl } from "../../origin-access-control/sim-cf-origin-access-control.js";
+/**
+ * Reads an AWS::CloudFront::OriginAccessControl Resource into a simulated
+ * origin access control.
+ *
+ * Everything the config carries is required by the CloudFormation schema apart
+ * from the description, so anything missing is a template AWS would refuse
+ * before it reached an origin access control at all.
+ */
+export declare class SimCfnCfOriginAccessControlConfig {
+    private readonly resource;
+    private readonly properties;
+    constructor(properties: {
+        readonly resource: SimCfnResource;
+        readonly properties: SimCfnTemplateValueRecord;
+    });
+    /**
+     * Build the simulated origin access control this Resource describes.
+     */
+    build(): SimCloudFrontOriginAccessControl;
+    private originAccessControlConfig;
+    /**
+     * Refuse a config asking for anything but the one origin type and protocol a
+     * simulated origin access control signs.
+     */
+    private assertFixedValues;
+    /**
+     * One string field of the config, or nothing when it is absent.
+     */
+    private text;
+    private signingBehavior;
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    private refuse;
+}
+//# sourceMappingURL=sim-cfn-cf-oac-config.d.ts.map

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-oac-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EACL,gCAAgC,EAEjC,MAAM,6DAA6D,CAAC;AAkBrE;;;;;;;GAOG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IAEvD,YAAY,UAAU,EAAE;QACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;KAChD,EAGA;IAED;;OAEG;IACH,KAAK,IAAI,gCAAgC,CAcxC;IAED,OAAO,CAAC,yBAAyB;IAUjC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAczB;;OAEG;IACH,OAAO,CAAC,IAAI;IAkBZ,OAAO,CAAC,eAAe;IAgBvB;;OAEG;IACH,OAAO,CAAC,MAAM;CAKf"}

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-config.js

@@ -0,0 +1,97 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimCloudFrontOriginAccessControl, } from "../../origin-access-control/sim-cf-origin-access-control.js";
+/**
+ * The config values a simulated origin access control is fixed to.
+ *
+ * CloudFront also signs for MediaStore, MediaPackage V2 and Lambda Function URL
+ * Origins, and none of those is modelled. SigV4 is the only protocol CloudFront
+ * offers. Anything else is refused by name rather than stored and treated as
+ * though it behaved like these.
+ */
+const fixedValues = {
+    OriginAccessControlOriginType: "s3",
+    SigningProtocol: "sigv4",
+};
+const signingBehaviors = ["always", "never", "no-override"];
+/**
+ * Reads an AWS::CloudFront::OriginAccessControl Resource into a simulated
+ * origin access control.
+ *
+ * Everything the config carries is required by the CloudFormation schema apart
+ * from the description, so anything missing is a template AWS would refuse
+ * before it reached an origin access control at all.
+ */
+export class SimCfnCfOriginAccessControlConfig {
+    resource;
+    properties;
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.properties = properties.properties;
+    }
+    /**
+     * Build the simulated origin access control this Resource describes.
+     */
+    build() {
+        const config = this.originAccessControlConfig();
+        this.assertFixedValues(config);
+        const description = this.text(config, "Description");
+        return new SimCloudFrontOriginAccessControl({
+            name: this.text(config, "Name") ??
+                this.refuse("OriginAccessControlConfig Name must be a string"),
+            signingBehavior: this.signingBehavior(config),
+            ...(description !== undefined && { description }),
+        });
+    }
+    originAccessControlConfig() {
+        const config = this.properties["OriginAccessControlConfig"];
+        if (!isRecord(config)) {
+            this.refuse("OriginAccessControlConfig must be an object");
+        }
+        return config;
+    }
+    /**
+     * Refuse a config asking for anything but the one origin type and protocol a
+     * simulated origin access control signs.
+     */
+    assertFixedValues(config) {
+        for (const [key, fixed] of Object.entries(fixedValues)) {
+            // oxlint-disable-next-line security/detect-object-injection
+            const value = config[key];
+            if (value !== fixed) {
+                this.refuse(`${key} ${String(value)} is not modelled by simulated origin ` +
+                    `access controls, which only sign an ${fixedValues.OriginAccessControlOriginType} Origin with ${fixedValues.SigningProtocol}`);
+            }
+        }
+    }
+    /**
+     * One string field of the config, or nothing when it is absent.
+     */
+    text(config, key) {
+        // oxlint-disable-next-line security/detect-object-injection
+        const value = config[key];
+        if (value === undefined) {
+            return undefined;
+        }
+        if (typeof value !== "string") {
+            this.refuse(`OriginAccessControlConfig ${key} must be a string`);
+        }
+        return value;
+    }
+    signingBehavior(config) {
+        const value = config["SigningBehavior"];
+        if (!isSigningBehavior(value)) {
+            this.refuse(`SigningBehavior ${String(value)} is not one of ${signingBehaviors.join(", ")}`);
+        }
+        return value;
+    }
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    refuse(detail) {
+        throw new Error(`Invalid AWS::CloudFront::OriginAccessControl ${this.resource.logicalId}: ${detail}`);
+    }
+}
+function isSigningBehavior(value) {
+    return signingBehaviors.includes(value);
+}
+//# sourceMappingURL=sim-cfn-cf-oac-config.js.map

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-oac-config.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAGjE,OAAO,EACL,gCAAgC,GAEjC,MAAM,6DAA6D,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG;IAClB,6BAA6B,EAAE,IAAI;IACnC,eAAe,EAAE,OAAO;CACzB,CAAC;AAEF,MAAM,gBAAgB,GACpB,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,OAAO,iCAAiC;IAC3B,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IAEvD,YAAY,UAGX;QACC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAEhD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAErD,OAAO,IAAI,gCAAgC,CAAC;YAC1C,IAAI,EACF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,iDAAiD,CAAC;YAChE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAC7C,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAEO,yBAAyB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;QAE5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,MAA+B;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,uCAAuC;oBAC5D,uCAAuC,WAAW,CAAC,6BAA6B,gBAAgB,WAAW,CAAC,eAAe,EAAE,CAChI,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,IAAI,CACV,MAA+B,EAC/B,GAAW;QAEX,4DAA4D;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,6BAA6B,GAAG,mBAAmB,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CACrB,MAA+B;QAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAExC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CACT,mBAAmB,MAAM,CAAC,KAAK,CAAC,kBAAkB,gBAAgB,CAAC,IAAI,CACrE,IAAI,CACL,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,MAAc;QAC3B,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CACrF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,iBAAiB,CACxB,KAAc;IAEd,OAAO,gBAAgB,CAAC,QAAQ,CAC9B,KAAwD,CACzD,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.d.ts

@@ -0,0 +1,25 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCloudFront } from "../../sim-cloudfront.js";
+import type { SimCloudFrontOriginAccessControl } from "../../origin-access-control/sim-cf-origin-access-control.js";
+interface SimCfnCfOriginAccessControlCreatorProperties {
+    readonly cloudFront: SimCloudFront;
+}
+/**
+ * Creates simulated origin access controls from
+ * AWS::CloudFront::OriginAccessControl Resources.
+ */
+export declare class SimCfnCfOriginAccessControlCreator {
+    private readonly cloudFront;
+    constructor(properties: SimCfnCfOriginAccessControlCreatorProperties);
+    /**
+     * Create and store the origin access control one Resource describes.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontOriginAccessControl;
+    /**
+     * Remove an origin access control created from a Resource.
+     */
+    delete(resource: SimCfnResource): void;
+}
+export {};
+//# sourceMappingURL=sim-cfn-cf-oac-creator.d.ts.map

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-oac-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAC;AAGpH,UAAU,4CAA4C;IACpD,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;CACpC;AAED;;;GAGG;AACH,qBAAa,kCAAkC;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAE3C,YAAY,UAAU,EAAE,4CAA4C,EAEnE;IAED;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,gCAAgC,CASlC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAUrC;CACF"}

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.js

@@ -0,0 +1,33 @@
+import { SimCfnCfOriginAccessControlConfig } from "./sim-cfn-cf-oac-config.js";
+/**
+ * Creates simulated origin access controls from
+ * AWS::CloudFront::OriginAccessControl Resources.
+ */
+export class SimCfnCfOriginAccessControlCreator {
+    cloudFront;
+    constructor(properties) {
+        this.cloudFront = properties.cloudFront;
+    }
+    /**
+     * Create and store the origin access control one Resource describes.
+     */
+    create(resource, properties) {
+        const originAccessControl = new SimCfnCfOriginAccessControlConfig({
+            resource,
+            properties,
+        }).build();
+        this.cloudFront.addOriginAccessControl(originAccessControl);
+        return originAccessControl;
+    }
+    /**
+     * Remove an origin access control created from a Resource.
+     */
+    delete(resource) {
+        const originAccessControl = resource.simResource;
+        if (originAccessControl === undefined) {
+            return;
+        }
+        this.cloudFront.removeOriginAccessControl(originAccessControl.id);
+    }
+}
+//# sourceMappingURL=sim-cfn-cf-oac-creator.js.map

package/dist/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-oac-creator.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/origin-access-control/sim-cfn-cf-oac-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAM/E;;;GAGG;AACH,MAAM,OAAO,kCAAkC;IAC5B,UAAU,CAAgB;IAE3C,YAAY,UAAwD;QAClE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,QAAwB,EACxB,UAAqC;QAErC,MAAM,mBAAmB,GAAG,IAAI,iCAAiC,CAAC;YAChE,QAAQ;YACR,UAAU;SACX,CAAC,CAAC,KAAK,EAAE,CAAC;QAEX,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;QAE5D,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAwB;QAC7B,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAExB,CAAC;QAEd,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.d.ts

@@ -5,13 +5,18 @@ import { SimCloudFrontResponseHeadersPolicy } from "../../response-headers-polic
  * Reads an AWS::CloudFront::ResponseHeadersPolicy Resource into a simulated
  * policy.
  *
- * Only the custom headers and the removed headers are modelled. The other
- * sections are refused by name rather than stepped over, so a policy that would
- * serve different headers here than in AWS fails where it is written.
+ * Every section is read by its own function in this directory, each taking
+ * the whole config and finding its own section in it. This class only says
+ * which sections a policy has, and carries the refusal that names the
+ * Resource whichever section could not be read.
  */
 export declare class SimCfnCfResponseHeadersPolicyConfig {
     private readonly resource;
     private readonly properties;
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    private readonly refuse;
     constructor(properties: {
         readonly resource: SimCfnResource;
         readonly properties: SimCfnTemplateValueRecord;
@@ -20,19 +25,5 @@ export declare class SimCfnCfResponseHeadersPolicyConfig {
      * Build the simulated policy this Resource describes.
      */
     build(): SimCloudFrontResponseHeadersPolicy;
-    private policyConfig;
-    private assertModelled;
-    private policyName;
-    private customHeaders;
-    private customHeader;
-    private headersToRemove;
-    /**
-     * The `Items` of one `<name>Config` section, or nothing when it is absent.
-     */
-    private configItems;
-    /**
-     * Refuse this Resource, saying which part of it could not be read.
-     */
-    private refuse;
 }
 //# sourceMappingURL=sim-cfn-cf-rh-policy-config.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cf-rh-policy-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAgBrH;;;;;;;GAOG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IAEvD,YAAY,UAAU,EAAE;QACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;KAChD,EAGA;IAED;;OAEG;IACH,KAAK,IAAI,kCAAkC,CAU1C;IAED,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,WAAW;IA4BnB;;OAEG;IACH,OAAO,CAAC,MAAM;CAKf"}
+{"version":3,"file":"sim-cfn-cf-rh-policy-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAarH;;;;;;;;GAQG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IAEvD;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAIrB;IAEF,YAAY,UAAU,EAAE;QACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;KAChD,EAGA;IAED;;OAEG;IACH,KAAK,IAAI,kCAAkC,CA2B1C;CACF"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.js

@@ -1,30 +1,28 @@
 import { isRecord } from "../../../../util/type-guard/record.js";
-import { SimCloudFrontResponseHeader } from "../../response-headers-policy/sim-cf-response-header.js";
 import { SimCloudFrontResponseHeadersPolicy } from "../../response-headers-policy/sim-cf-response-headers-policy.js";
-/**
- * The sections of a ResponseHeadersPolicyConfig this simulation does not model.
- *
- * Each of these turns into response headers of its own, so ignoring one would
- * serve a response missing headers the policy promised. A CORS section that
- * quietly does nothing is the worst of them, because the request it breaks is
- * one a browser makes and a test does not.
- */
-const unmodelledSections = [
-    "CorsConfig",
-    "SecurityHeadersConfig",
-    "ServerTimingHeadersConfig",
-];
+import { simCfnCfResponseHeadersPolicyCors } from "./sim-cfn-cf-rh-policy-cors-config.js";
+import { simCfnCfResponseHeadersPolicyCustomHeaders, simCfnCfResponseHeadersPolicyRemoveHeaders, } from "./sim-cfn-cf-rh-policy-custom-headers.js";
+import { requiredString, } from "./sim-cfn-cf-rh-policy-field-reader.js";
+import { simCfnCfResponseHeadersPolicySecurityHeaders } from "./sim-cfn-cf-rh-policy-security-headers.js";
+import { simCfnCfResponseHeadersPolicyServerTiming } from "./sim-cfn-cf-rh-policy-server-timing.js";
 /**
  * Reads an AWS::CloudFront::ResponseHeadersPolicy Resource into a simulated
  * policy.
  *
- * Only the custom headers and the removed headers are modelled. The other
- * sections are refused by name rather than stepped over, so a policy that would
- * serve different headers here than in AWS fails where it is written.
+ * Every section is read by its own function in this directory, each taking
+ * the whole config and finding its own section in it. This class only says
+ * which sections a policy has, and carries the refusal that names the
+ * Resource whichever section could not be read.
  */
 export class SimCfnCfResponseHeadersPolicyConfig {
     resource;
     properties;
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    refuse = (detail) => {
+        throw new Error(`Invalid AWS::CloudFront::ResponseHeadersPolicy ${this.resource.logicalId}: ${detail}`);
+    };
     constructor(properties) {
         this.resource = properties.resource;
         this.properties = properties.properties;
@@ -33,95 +31,19 @@ export class SimCfnCfResponseHeadersPolicyConfig {
      * Build the simulated policy this Resource describes.
      */
     build() {
-        const config = this.policyConfig();
-        this.assertModelled(config);
-        return new SimCloudFrontResponseHeadersPolicy({
-            name: this.policyName(config),
-            customHeaders: this.customHeaders(config),
-            headersToRemove: this.headersToRemove(config),
-        });
-    }
-    policyConfig() {
+        const { refuse } = this;
         const config = this.properties["ResponseHeadersPolicyConfig"];
         if (!isRecord(config)) {
-            this.refuse(`ResponseHeadersPolicyConfig must be an object`);
-        }
-        return config;
-    }
-    assertModelled(config) {
-        for (const section of unmodelledSections) {
-            // eslint-disable-next-line security/detect-object-injection
-            if (config[section] !== undefined) {
-                this.refuse(`${section} is not modelled by simulated response headers ` +
-                    `policies, so the headers it sets would be missing from the ` +
-                    `response`);
-            }
-        }
-    }
-    policyName(config) {
-        const name = config["Name"];
-        if (typeof name !== "string") {
-            this.refuse(`ResponseHeadersPolicyConfig Name must be a string`);
+            return refuse(`ResponseHeadersPolicyConfig must be an object`);
         }
-        return name;
-    }
-    customHeaders(config) {
-        return this.configItems(config, "CustomHeadersConfig").map((item) => {
-            if (!isRecord(item)) {
-                this.refuse(`CustomHeadersConfig items must be objects`);
-            }
-            return this.customHeader(item);
-        });
-    }
-    customHeader(item) {
-        const name = item["Header"];
-        const value = item["Value"];
-        if (typeof name !== "string" || typeof value !== "string") {
-            this.refuse(`CustomHeadersConfig items need a string Header and Value`);
-        }
-        // Override is required by the CloudFormation schema, so anything else here
-        // is a template that would be refused before it reached a policy at all.
-        const override = item["Override"];
-        if (typeof override !== "boolean") {
-            this.refuse(`CustomHeadersConfig item ${name} needs a boolean Override`);
-        }
-        return new SimCloudFrontResponseHeader({ name, value, override });
-    }
-    headersToRemove(config) {
-        return this.configItems(config, "RemoveHeadersConfig").map((item) => {
-            const name = isRecord(item) ? item["Header"] : undefined;
-            if (typeof name !== "string") {
-                this.refuse(`RemoveHeadersConfig items need a string Header`);
-            }
-            return name;
+        return new SimCloudFrontResponseHeadersPolicy({
+            name: requiredString(config, "Name", "ResponseHeadersPolicyConfig", refuse),
+            customHeaders: simCfnCfResponseHeadersPolicyCustomHeaders(config, refuse),
+            headersToRemove: simCfnCfResponseHeadersPolicyRemoveHeaders(config, refuse),
+            securityHeaders: simCfnCfResponseHeadersPolicySecurityHeaders(config, refuse),
+            serverTiming: simCfnCfResponseHeadersPolicyServerTiming(config, refuse),
+            cors: simCfnCfResponseHeadersPolicyCors(config, refuse),
         });
     }
-    /**
-     * The `Items` of one `<name>Config` section, or nothing when it is absent.
-     */
-    configItems(config, sectionName) {
-        // eslint-disable-next-line security/detect-object-injection
-        const section = config[sectionName];
-        if (section === undefined) {
-            return [];
-        }
-        if (!isRecord(section)) {
-            this.refuse(`${sectionName} must be an object`);
-        }
-        const items = section["Items"];
-        if (items === undefined) {
-            return [];
-        }
-        if (!Array.isArray(items)) {
-            this.refuse(`${sectionName} Items must be an array`);
-        }
-        return items;
-    }
-    /**
-     * Refuse this Resource, saying which part of it could not be read.
-     */
-    refuse(detail) {
-        throw new Error(`Invalid AWS::CloudFront::ResponseHeadersPolicy ${this.resource.logicalId}: ${detail}`);
-    }
 }
 //# sourceMappingURL=sim-cfn-cf-rh-policy-config.js.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cf-rh-policy-config.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAGjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAErH;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG;IACzB,YAAY;IACZ,uBAAuB;IACvB,2BAA2B;CACnB,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,OAAO,mCAAmC;IAC7B,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IAEvD,YAAY,UAGX;QACC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEnC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAE5B,OAAO,IAAI,kCAAkC,CAAC;YAC5C,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YACzC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAEO,YAAY;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,4DAA4D;YAC5D,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,CACT,GAAG,OAAO,iDAAiD;oBACzD,6DAA6D;oBAC7D,UAAU,CACb,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAA+B;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAE5B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa,CACnB,MAA+B;QAE/B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAClE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAClB,IAA6B;QAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAElC,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,4BAA4B,IAAI,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;IAEO,eAAe,CAAC,MAA+B;QACrD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEzD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,WAAW,CACjB,MAA+B,EAC/B,WAAmB;QAEnB,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAEpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,oBAAoB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAE/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,MAAc;QAC3B,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CACvF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-cf-rh-policy-config.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAGjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AACrH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EACL,0CAA0C,EAC1C,0CAA0C,GAC3C,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,cAAc,GAEf,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4CAA4C,EAAE,MAAM,4CAA4C,CAAC;AAC1G,OAAO,EAAE,yCAAyC,EAAE,MAAM,yCAAyC,CAAC;AAEpG;;;;;;;;GAQG;AACH,MAAM,OAAO,mCAAmC;IAC7B,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IAEvD;;OAEG;IACc,MAAM,GAAgC,CAAC,MAAM,EAAE,EAAE;QAChE,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CACvF,CAAC;IACJ,CAAC,CAAC;IAEF,YAAY,UAGX;QACC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,kCAAkC,CAAC;YAC5C,IAAI,EAAE,cAAc,CAClB,MAAM,EACN,MAAM,EACN,6BAA6B,EAC7B,MAAM,CACP;YACD,aAAa,EAAE,0CAA0C,CAAC,MAAM,EAAE,MAAM,CAAC;YACzE,eAAe,EAAE,0CAA0C,CACzD,MAAM,EACN,MAAM,CACP;YACD,eAAe,EAAE,4CAA4C,CAC3D,MAAM,EACN,MAAM,CACP;YACD,YAAY,EAAE,yCAAyC,CAAC,MAAM,EAAE,MAAM,CAAC;YACvE,IAAI,EAAE,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.d.ts

@@ -0,0 +1,13 @@
+import { SimCloudFrontResponseHeadersPolicyCors } from "../../response-headers-policy/sim-cf-response-headers-policy-cors.js";
+import { type SimCfnCfRhPolicyFieldRefuse } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's CorsConfig section into the CORS
+ * model that applies it at request time.
+ *
+ * Split from the config reader that calls it for the same reason as
+ * simCfnCfResponseHeadersPolicySecurityHeaders: this project holds every
+ * source file to a line count, and CORS has enough of its own fields to
+ * reach it alongside the rest of the policy.
+ */
+export declare function simCfnCfResponseHeadersPolicyCors(config: Record<string, unknown>, refuse: SimCfnCfRhPolicyFieldRefuse): SimCloudFrontResponseHeadersPolicyCors | undefined;
+//# sourceMappingURL=sim-cfn-cf-rh-policy-cors-config.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-cors-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sCAAsC,EAAE,MAAM,sEAAsE,CAAC;AAC9H,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,2BAA2B,GAClC,sCAAsC,GAAG,SAAS,CAoCpD"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.js

@@ -0,0 +1,76 @@
+import { simCfCorsOriginPatternIsValid } from "../../response-headers-policy/sim-cf-cors-origin-pattern.js";
+import { SimCloudFrontResponseHeadersPolicyCors } from "../../response-headers-policy/sim-cf-response-headers-policy-cors.js";
+import { optionalObject, requiredBoolean, requiredInteger, } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's CorsConfig section into the CORS
+ * model that applies it at request time.
+ *
+ * Split from the config reader that calls it for the same reason as
+ * simCfnCfResponseHeadersPolicySecurityHeaders: this project holds every
+ * source file to a line count, and CORS has enough of its own fields to
+ * reach it alongside the rest of the policy.
+ */
+export function simCfnCfResponseHeadersPolicyCors(config, refuse) {
+    const section = optionalObject(config, "CorsConfig", "CorsConfig", refuse);
+    if (section === undefined) {
+        return undefined;
+    }
+    const maxAgeSec = section["AccessControlMaxAgeSec"] === undefined
+        ? undefined
+        : requiredInteger(section, "AccessControlMaxAgeSec", "CorsConfig", refuse);
+    return new SimCloudFrontResponseHeadersPolicyCors({
+        allowCredentials: requiredBoolean(section, "AccessControlAllowCredentials", "CorsConfig", refuse),
+        allowHeaders: requiredList(section, "AccessControlAllowHeaders", refuse),
+        allowMethods: requiredList(section, "AccessControlAllowMethods", refuse),
+        allowOrigins: allowOrigins(section, refuse),
+        exposeHeaders: optionalList(section, "AccessControlExposeHeaders", refuse),
+        ...(maxAgeSec !== undefined && { maxAgeSec }),
+        originOverride: requiredBoolean(section, "OriginOverride", "CorsConfig", refuse),
+    });
+}
+/**
+ * The allowed Origins, each of which must place its wildcard where CloudFront
+ * allows one, since an entry it would refuse could never match here either.
+ */
+function allowOrigins(section, refuse) {
+    const origins = requiredList(section, "AccessControlAllowOrigins", refuse);
+    for (const origin of origins) {
+        if (!simCfCorsOriginPatternIsValid(origin)) {
+            refuse(`CorsConfig AccessControlAllowOrigins ${origin} may only use the ` +
+                `wildcard on its own or as the leftmost subdomain, as in ` +
+                `*.example.org`);
+        }
+    }
+    return origins;
+}
+/**
+ * The string `Items` of a field CloudFront requires a CORS section to carry.
+ */
+function requiredList(section, fieldName, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    if (section[fieldName] === undefined) {
+        refuse(`CorsConfig needs an ${fieldName}`);
+    }
+    return optionalList(section, fieldName, refuse);
+}
+/**
+ * The string `Items` of one `AccessControl*` field, or nothing when the field
+ * is absent. `Items` itself is required whenever the field is present.
+ */
+function optionalList(section, fieldName, refuse) {
+    const field = optionalObject(section, fieldName, `CorsConfig ${fieldName}`, refuse);
+    if (field === undefined) {
+        return [];
+    }
+    const items = field["Items"];
+    if (!Array.isArray(items)) {
+        refuse(`CorsConfig ${fieldName} needs an array Items`);
+    }
+    return items.map((item) => {
+        if (typeof item !== "string") {
+            refuse(`CorsConfig ${fieldName} Items must be strings`);
+        }
+        return item;
+    });
+}
+//# sourceMappingURL=sim-cfn-cf-rh-policy-cors-config.js.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-cors-config.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAC5G,OAAO,EAAE,sCAAsC,EAAE,MAAM,sEAAsE,CAAC;AAC9H,OAAO,EACL,cAAc,EACd,eAAe,EACf,eAAe,GAEhB,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAA+B,EAC/B,MAAmC;IAEnC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAE3E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GACb,OAAO,CAAC,wBAAwB,CAAC,KAAK,SAAS;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CACb,OAAO,EACP,wBAAwB,EACxB,YAAY,EACZ,MAAM,CACP,CAAC;IAER,OAAO,IAAI,sCAAsC,CAAC;QAChD,gBAAgB,EAAE,eAAe,CAC/B,OAAO,EACP,+BAA+B,EAC/B,YAAY,EACZ,MAAM,CACP;QACD,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,CAAC;QACxE,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,CAAC;QACxE,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC3C,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,4BAA4B,EAAE,MAAM,CAAC;QAC1E,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,cAAc,EAAE,eAAe,CAC7B,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,MAAM,CACP;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,OAAgC,EAChC,MAAmC;IAEnC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;IAE3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,CACJ,wCAAwC,MAAM,oBAAoB;gBAChE,0DAA0D;gBAC1D,eAAe,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,OAAgC,EAChC,SAAiB,EACjB,MAAmC;IAEnC,4DAA4D;IAC5D,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,OAAgC,EAChC,SAAiB,EACjB,MAAmC;IAEnC,MAAM,KAAK,GAAG,cAAc,CAC1B,OAAO,EACP,SAAS,EACT,cAAc,SAAS,EAAE,EACzB,MAAM,CACP,CAAC;IAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,cAAc,SAAS,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,cAAc,SAAS,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cf-rh-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAG1H,UAAU,8CAA8C;IACtD,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;CACpC;AAED;;;GAGG;AACH,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAE3C,YAAY,UAAU,EAAE,8CAA8C,EAErE;IAED;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,kCAAkC,CASpC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CASrC;CACF"}
+{"version":3,"file":"sim-cfn-cf-rh-policy-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAG1H,UAAU,8CAA8C;IACtD,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;CACpC;AAED;;;GAGG;AACH,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAE3C,YAAY,UAAU,EAAE,8CAA8C,EAErE;IAED;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,kCAAkC,CASpC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAUrC;CACF"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cf-rh-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAMvF;;;GAGG;AACH,MAAM,OAAO,oCAAoC;IAC9B,UAAU,CAAgB;IAE3C,YAAY,UAA0D;QACpE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,QAAwB,EACxB,UAAqC;QAErC,MAAM,MAAM,GAAG,IAAI,mCAAmC,CAAC;YACrD,QAAQ;YACR,UAAU;SACX,CAAC,CAAC,KAAK,EAAE,CAAC;QAEX,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAEjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAwB;QAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,WACwB,CAAC;QAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-cf-rh-policy-creator.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-creator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAMvF;;;GAGG;AACH,MAAM,OAAO,oCAAoC;IAC9B,UAAU,CAAgB;IAE3C,YAAY,UAA0D;QACpE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,QAAwB,EACxB,UAAqC;QAErC,MAAM,MAAM,GAAG,IAAI,mCAAmC,CAAC;YACrD,QAAQ;YACR,UAAU;SACX,CAAC,CAAC,KAAK,EAAE,CAAC;QAEX,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAEjD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAwB;QAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,WAEX,CAAC;QAEd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.d.ts

@@ -0,0 +1,17 @@
+import { SimCloudFrontResponseHeader } from "../../response-headers-policy/sim-cf-response-header.js";
+import { type SimCfnCfRhPolicyFieldRefuse } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's CustomHeadersConfig section into the
+ * headers it adds.
+ *
+ * Split from the config reader that calls it for the same reason as
+ * simCfnCfResponseHeadersPolicySecurityHeaders: this project holds every
+ * source file to a line count.
+ */
+export declare function simCfnCfResponseHeadersPolicyCustomHeaders(config: Record<string, unknown>, refuse: SimCfnCfRhPolicyFieldRefuse): SimCloudFrontResponseHeader[];
+/**
+ * Reads a ResponseHeadersPolicyConfig's RemoveHeadersConfig section into the
+ * header names it removes.
+ */
+export declare function simCfnCfResponseHeadersPolicyRemoveHeaders(config: Record<string, unknown>, refuse: SimCfnCfRhPolicyFieldRefuse): string[];
+//# sourceMappingURL=sim-cfn-cf-rh-policy-custom-headers.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-custom-headers.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,2BAA2B,GAClC,2BAA2B,EAAE,CAwB/B;AAED;;;GAGG;AACH,wBAAgB,0CAA0C,CACxD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,2BAA2B,GAClC,MAAM,EAAE,CAUV"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.js

@@ -0,0 +1,45 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimCloudFrontResponseHeader } from "../../response-headers-policy/sim-cf-response-header.js";
+import { sectionItems, } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's CustomHeadersConfig section into the
+ * headers it adds.
+ *
+ * Split from the config reader that calls it for the same reason as
+ * simCfnCfResponseHeadersPolicySecurityHeaders: this project holds every
+ * source file to a line count.
+ */
+export function simCfnCfResponseHeadersPolicyCustomHeaders(config, refuse) {
+    return sectionItems(config, "CustomHeadersConfig", refuse).map((item) => {
+        if (!isRecord(item)) {
+            refuse(`CustomHeadersConfig items must be objects`);
+        }
+        const name = item["Header"];
+        const value = item["Value"];
+        if (typeof name !== "string" || typeof value !== "string") {
+            refuse(`CustomHeadersConfig items need a string Header and Value`);
+        }
+        // Override is required by the CloudFormation schema, so anything else
+        // here is a template that would be refused before it reached a policy at
+        // all.
+        const override = item["Override"];
+        if (typeof override !== "boolean") {
+            refuse(`CustomHeadersConfig item ${name} needs a boolean Override`);
+        }
+        return new SimCloudFrontResponseHeader({ name, value, override });
+    });
+}
+/**
+ * Reads a ResponseHeadersPolicyConfig's RemoveHeadersConfig section into the
+ * header names it removes.
+ */
+export function simCfnCfResponseHeadersPolicyRemoveHeaders(config, refuse) {
+    return sectionItems(config, "RemoveHeadersConfig", refuse).map((item) => {
+        const name = isRecord(item) ? item["Header"] : undefined;
+        if (typeof name !== "string") {
+            refuse(`RemoveHeadersConfig items need a string Header`);
+        }
+        return name;
+    });
+}
+//# sourceMappingURL=sim-cfn-cf-rh-policy-custom-headers.js.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-custom-headers.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EACL,YAAY,GAEb,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,MAA+B,EAC/B,MAAmC;IAEnC,OAAO,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,CAAC,0DAA0D,CAAC,CAAC;QACrE,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,OAAO;QACP,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAElC,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,4BAA4B,IAAI,2BAA2B,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0CAA0C,CACxD,MAA+B,EAC/B,MAAmC;IAEnC,OAAO,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,gDAAgD,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}