@kensio/yulin 1.10.2 → 1.10.3

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.d.ts

@@ -5,13 +5,18 @@ import { SimCloudFrontResponseHeadersPolicy } from "../../response-headers-polic
  * Reads an AWS::CloudFront::ResponseHeadersPolicy Resource into a simulated
  * policy.
  *
- * Only the custom headers and the removed headers are modelled. The other
- * sections are refused by name rather than stepped over, so a policy that would
- * serve different headers here than in AWS fails where it is written.
+ * Every section is read by its own function in this directory, each taking
+ * the whole config and finding its own section in it. This class only says
+ * which sections a policy has, and carries the refusal that names the
+ * Resource whichever section could not be read.
  */
 export declare class SimCfnCfResponseHeadersPolicyConfig {
     private readonly resource;
     private readonly properties;
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    private readonly refuse;
     constructor(properties: {
         readonly resource: SimCfnResource;
         readonly properties: SimCfnTemplateValueRecord;
@@ -20,19 +25,5 @@ export declare class SimCfnCfResponseHeadersPolicyConfig {
      * Build the simulated policy this Resource describes.
      */
     build(): SimCloudFrontResponseHeadersPolicy;
-    private policyConfig;
-    private assertModelled;
-    private policyName;
-    private customHeaders;
-    private customHeader;
-    private headersToRemove;
-    /**
-     * The `Items` of one `<name>Config` section, or nothing when it is absent.
-     */
-    private configItems;
-    /**
-     * Refuse this Resource, saying which part of it could not be read.
-     */
-    private refuse;
 }
 //# sourceMappingURL=sim-cfn-cf-rh-policy-config.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cf-rh-policy-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAElH,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAgBrH;;;;;;;GAOG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IAEvD,YAAY,UAAU,EAAE;QACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;KAChD,EAGA;IAED;;OAEG;IACH,KAAK,IAAI,kCAAkC,CAU1C;IAED,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,WAAW;IA4BnB;;OAEG;IACH,OAAO,CAAC,MAAM;CAKf"}
+{"version":3,"file":"sim-cfn-cf-rh-policy-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAarH;;;;;;;;GAQG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IAEvD;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAIrB;IAEF,YAAY,UAAU,EAAE;QACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;KAChD,EAGA;IAED;;OAEG;IACH,KAAK,IAAI,kCAAkC,CA2B1C;CACF"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.js

@@ -1,30 +1,28 @@
 import { isRecord } from "../../../../util/type-guard/record.js";
-import { SimCloudFrontResponseHeader } from "../../response-headers-policy/sim-cf-response-header.js";
 import { SimCloudFrontResponseHeadersPolicy } from "../../response-headers-policy/sim-cf-response-headers-policy.js";
-/**
- * The sections of a ResponseHeadersPolicyConfig this simulation does not model.
- *
- * Each of these turns into response headers of its own, so ignoring one would
- * serve a response missing headers the policy promised. A CORS section that
- * quietly does nothing is the worst of them, because the request it breaks is
- * one a browser makes and a test does not.
- */
-const unmodelledSections = [
-    "CorsConfig",
-    "SecurityHeadersConfig",
-    "ServerTimingHeadersConfig",
-];
+import { simCfnCfResponseHeadersPolicyCors } from "./sim-cfn-cf-rh-policy-cors-config.js";
+import { simCfnCfResponseHeadersPolicyCustomHeaders, simCfnCfResponseHeadersPolicyRemoveHeaders, } from "./sim-cfn-cf-rh-policy-custom-headers.js";
+import { requiredString, } from "./sim-cfn-cf-rh-policy-field-reader.js";
+import { simCfnCfResponseHeadersPolicySecurityHeaders } from "./sim-cfn-cf-rh-policy-security-headers.js";
+import { simCfnCfResponseHeadersPolicyServerTiming } from "./sim-cfn-cf-rh-policy-server-timing.js";
 /**
  * Reads an AWS::CloudFront::ResponseHeadersPolicy Resource into a simulated
  * policy.
  *
- * Only the custom headers and the removed headers are modelled. The other
- * sections are refused by name rather than stepped over, so a policy that would
- * serve different headers here than in AWS fails where it is written.
+ * Every section is read by its own function in this directory, each taking
+ * the whole config and finding its own section in it. This class only says
+ * which sections a policy has, and carries the refusal that names the
+ * Resource whichever section could not be read.
  */
 export class SimCfnCfResponseHeadersPolicyConfig {
     resource;
     properties;
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    refuse = (detail) => {
+        throw new Error(`Invalid AWS::CloudFront::ResponseHeadersPolicy ${this.resource.logicalId}: ${detail}`);
+    };
     constructor(properties) {
         this.resource = properties.resource;
         this.properties = properties.properties;
@@ -33,95 +31,19 @@ export class SimCfnCfResponseHeadersPolicyConfig {
      * Build the simulated policy this Resource describes.
      */
     build() {
-        const config = this.policyConfig();
-        this.assertModelled(config);
-        return new SimCloudFrontResponseHeadersPolicy({
-            name: this.policyName(config),
-            customHeaders: this.customHeaders(config),
-            headersToRemove: this.headersToRemove(config),
-        });
-    }
-    policyConfig() {
+        const { refuse } = this;
         const config = this.properties["ResponseHeadersPolicyConfig"];
         if (!isRecord(config)) {
-            this.refuse(`ResponseHeadersPolicyConfig must be an object`);
-        }
-        return config;
-    }
-    assertModelled(config) {
-        for (const section of unmodelledSections) {
-            // oxlint-disable-next-line security/detect-object-injection
-            if (config[section] !== undefined) {
-                this.refuse(`${section} is not modelled by simulated response headers ` +
-                    `policies, so the headers it sets would be missing from the ` +
-                    `response`);
-            }
-        }
-    }
-    policyName(config) {
-        const name = config["Name"];
-        if (typeof name !== "string") {
-            this.refuse(`ResponseHeadersPolicyConfig Name must be a string`);
+            return refuse(`ResponseHeadersPolicyConfig must be an object`);
         }
-        return name;
-    }
-    customHeaders(config) {
-        return this.configItems(config, "CustomHeadersConfig").map((item) => {
-            if (!isRecord(item)) {
-                this.refuse(`CustomHeadersConfig items must be objects`);
-            }
-            return this.customHeader(item);
-        });
-    }
-    customHeader(item) {
-        const name = item["Header"];
-        const value = item["Value"];
-        if (typeof name !== "string" || typeof value !== "string") {
-            this.refuse(`CustomHeadersConfig items need a string Header and Value`);
-        }
-        // Override is required by the CloudFormation schema, so anything else here
-        // is a template that would be refused before it reached a policy at all.
-        const override = item["Override"];
-        if (typeof override !== "boolean") {
-            this.refuse(`CustomHeadersConfig item ${name} needs a boolean Override`);
-        }
-        return new SimCloudFrontResponseHeader({ name, value, override });
-    }
-    headersToRemove(config) {
-        return this.configItems(config, "RemoveHeadersConfig").map((item) => {
-            const name = isRecord(item) ? item["Header"] : undefined;
-            if (typeof name !== "string") {
-                this.refuse(`RemoveHeadersConfig items need a string Header`);
-            }
-            return name;
+        return new SimCloudFrontResponseHeadersPolicy({
+            name: requiredString(config, "Name", "ResponseHeadersPolicyConfig", refuse),
+            customHeaders: simCfnCfResponseHeadersPolicyCustomHeaders(config, refuse),
+            headersToRemove: simCfnCfResponseHeadersPolicyRemoveHeaders(config, refuse),
+            securityHeaders: simCfnCfResponseHeadersPolicySecurityHeaders(config, refuse),
+            serverTiming: simCfnCfResponseHeadersPolicyServerTiming(config, refuse),
+            cors: simCfnCfResponseHeadersPolicyCors(config, refuse),
         });
     }
-    /**
-     * The `Items` of one `<name>Config` section, or nothing when it is absent.
-     */
-    configItems(config, sectionName) {
-        // oxlint-disable-next-line security/detect-object-injection
-        const section = config[sectionName];
-        if (section === undefined) {
-            return [];
-        }
-        if (!isRecord(section)) {
-            this.refuse(`${sectionName} must be an object`);
-        }
-        const items = section["Items"];
-        if (items === undefined) {
-            return [];
-        }
-        if (!Array.isArray(items)) {
-            this.refuse(`${sectionName} Items must be an array`);
-        }
-        return items;
-    }
-    /**
-     * Refuse this Resource, saying which part of it could not be read.
-     */
-    refuse(detail) {
-        throw new Error(`Invalid AWS::CloudFront::ResponseHeadersPolicy ${this.resource.logicalId}: ${detail}`);
-    }
 }
 //# sourceMappingURL=sim-cfn-cf-rh-policy-config.js.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cf-rh-policy-config.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAGjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAErH;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG;IACzB,YAAY;IACZ,uBAAuB;IACvB,2BAA2B;CACnB,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,OAAO,mCAAmC;IAC7B,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IAEvD,YAAY,UAGX;QACC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEnC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAE5B,OAAO,IAAI,kCAAkC,CAAC;YAC5C,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YACzC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAEO,YAAY;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,4DAA4D;YAC5D,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,CACT,GAAG,OAAO,iDAAiD;oBACzD,6DAA6D;oBAC7D,UAAU,CACb,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAA+B;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAE5B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa,CACnB,MAA+B;QAE/B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAClE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAClB,IAA6B;QAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;QAC1E,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAElC,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,4BAA4B,IAAI,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;IAEO,eAAe,CAAC,MAA+B;QACrD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEzD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,WAAW,CACjB,MAA+B,EAC/B,WAAmB;QAEnB,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAEpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,oBAAoB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAE/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,yBAAyB,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,MAAc;QAC3B,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CACvF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-cf-rh-policy-config.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAGjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AACrH,OAAO,EAAE,iCAAiC,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EACL,0CAA0C,EAC1C,0CAA0C,GAC3C,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,cAAc,GAEf,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4CAA4C,EAAE,MAAM,4CAA4C,CAAC;AAC1G,OAAO,EAAE,yCAAyC,EAAE,MAAM,yCAAyC,CAAC;AAEpG;;;;;;;;GAQG;AACH,MAAM,OAAO,mCAAmC;IAC7B,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IAEvD;;OAEG;IACc,MAAM,GAAgC,CAAC,MAAM,EAAE,EAAE;QAChE,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CACvF,CAAC;IACJ,CAAC,CAAC;IAEF,YAAY,UAGX;QACC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,kCAAkC,CAAC;YAC5C,IAAI,EAAE,cAAc,CAClB,MAAM,EACN,MAAM,EACN,6BAA6B,EAC7B,MAAM,CACP;YACD,aAAa,EAAE,0CAA0C,CAAC,MAAM,EAAE,MAAM,CAAC;YACzE,eAAe,EAAE,0CAA0C,CACzD,MAAM,EACN,MAAM,CACP;YACD,eAAe,EAAE,4CAA4C,CAC3D,MAAM,EACN,MAAM,CACP;YACD,YAAY,EAAE,yCAAyC,CAAC,MAAM,EAAE,MAAM,CAAC;YACvE,IAAI,EAAE,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.d.ts

@@ -0,0 +1,13 @@
+import { SimCloudFrontResponseHeadersPolicyCors } from "../../response-headers-policy/sim-cf-response-headers-policy-cors.js";
+import { type SimCfnCfRhPolicyFieldRefuse } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's CorsConfig section into the CORS
+ * model that applies it at request time.
+ *
+ * Split from the config reader that calls it for the same reason as
+ * simCfnCfResponseHeadersPolicySecurityHeaders: this project holds every
+ * source file to a line count, and CORS has enough of its own fields to
+ * reach it alongside the rest of the policy.
+ */
+export declare function simCfnCfResponseHeadersPolicyCors(config: Record<string, unknown>, refuse: SimCfnCfRhPolicyFieldRefuse): SimCloudFrontResponseHeadersPolicyCors | undefined;
+//# sourceMappingURL=sim-cfn-cf-rh-policy-cors-config.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-cors-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sCAAsC,EAAE,MAAM,sEAAsE,CAAC;AAC9H,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,2BAA2B,GAClC,sCAAsC,GAAG,SAAS,CAoCpD"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.js

@@ -0,0 +1,76 @@
+import { simCfCorsOriginPatternIsValid } from "../../response-headers-policy/sim-cf-cors-origin-pattern.js";
+import { SimCloudFrontResponseHeadersPolicyCors } from "../../response-headers-policy/sim-cf-response-headers-policy-cors.js";
+import { optionalObject, requiredBoolean, requiredInteger, } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's CorsConfig section into the CORS
+ * model that applies it at request time.
+ *
+ * Split from the config reader that calls it for the same reason as
+ * simCfnCfResponseHeadersPolicySecurityHeaders: this project holds every
+ * source file to a line count, and CORS has enough of its own fields to
+ * reach it alongside the rest of the policy.
+ */
+export function simCfnCfResponseHeadersPolicyCors(config, refuse) {
+    const section = optionalObject(config, "CorsConfig", "CorsConfig", refuse);
+    if (section === undefined) {
+        return undefined;
+    }
+    const maxAgeSec = section["AccessControlMaxAgeSec"] === undefined
+        ? undefined
+        : requiredInteger(section, "AccessControlMaxAgeSec", "CorsConfig", refuse);
+    return new SimCloudFrontResponseHeadersPolicyCors({
+        allowCredentials: requiredBoolean(section, "AccessControlAllowCredentials", "CorsConfig", refuse),
+        allowHeaders: requiredList(section, "AccessControlAllowHeaders", refuse),
+        allowMethods: requiredList(section, "AccessControlAllowMethods", refuse),
+        allowOrigins: allowOrigins(section, refuse),
+        exposeHeaders: optionalList(section, "AccessControlExposeHeaders", refuse),
+        ...(maxAgeSec !== undefined && { maxAgeSec }),
+        originOverride: requiredBoolean(section, "OriginOverride", "CorsConfig", refuse),
+    });
+}
+/**
+ * The allowed Origins, each of which must place its wildcard where CloudFront
+ * allows one, since an entry it would refuse could never match here either.
+ */
+function allowOrigins(section, refuse) {
+    const origins = requiredList(section, "AccessControlAllowOrigins", refuse);
+    for (const origin of origins) {
+        if (!simCfCorsOriginPatternIsValid(origin)) {
+            refuse(`CorsConfig AccessControlAllowOrigins ${origin} may only use the ` +
+                `wildcard on its own or as the leftmost subdomain, as in ` +
+                `*.example.org`);
+        }
+    }
+    return origins;
+}
+/**
+ * The string `Items` of a field CloudFront requires a CORS section to carry.
+ */
+function requiredList(section, fieldName, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    if (section[fieldName] === undefined) {
+        refuse(`CorsConfig needs an ${fieldName}`);
+    }
+    return optionalList(section, fieldName, refuse);
+}
+/**
+ * The string `Items` of one `AccessControl*` field, or nothing when the field
+ * is absent. `Items` itself is required whenever the field is present.
+ */
+function optionalList(section, fieldName, refuse) {
+    const field = optionalObject(section, fieldName, `CorsConfig ${fieldName}`, refuse);
+    if (field === undefined) {
+        return [];
+    }
+    const items = field["Items"];
+    if (!Array.isArray(items)) {
+        refuse(`CorsConfig ${fieldName} needs an array Items`);
+    }
+    return items.map((item) => {
+        if (typeof item !== "string") {
+            refuse(`CorsConfig ${fieldName} Items must be strings`);
+        }
+        return item;
+    });
+}
+//# sourceMappingURL=sim-cfn-cf-rh-policy-cors-config.js.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-cors-config.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-cors-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAC5G,OAAO,EAAE,sCAAsC,EAAE,MAAM,sEAAsE,CAAC;AAC9H,OAAO,EACL,cAAc,EACd,eAAe,EACf,eAAe,GAEhB,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAA+B,EAC/B,MAAmC;IAEnC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAE3E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GACb,OAAO,CAAC,wBAAwB,CAAC,KAAK,SAAS;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CACb,OAAO,EACP,wBAAwB,EACxB,YAAY,EACZ,MAAM,CACP,CAAC;IAER,OAAO,IAAI,sCAAsC,CAAC;QAChD,gBAAgB,EAAE,eAAe,CAC/B,OAAO,EACP,+BAA+B,EAC/B,YAAY,EACZ,MAAM,CACP;QACD,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,CAAC;QACxE,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,CAAC;QACxE,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC3C,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,4BAA4B,EAAE,MAAM,CAAC;QAC1E,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,cAAc,EAAE,eAAe,CAC7B,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,MAAM,CACP;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,OAAgC,EAChC,MAAmC;IAEnC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;IAE3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,CACJ,wCAAwC,MAAM,oBAAoB;gBAChE,0DAA0D;gBAC1D,eAAe,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,OAAgC,EAChC,SAAiB,EACjB,MAAmC;IAEnC,4DAA4D;IAC5D,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,OAAgC,EAChC,SAAiB,EACjB,MAAmC;IAEnC,MAAM,KAAK,GAAG,cAAc,CAC1B,OAAO,EACP,SAAS,EACT,cAAc,SAAS,EAAE,EACzB,MAAM,CACP,CAAC;IAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,cAAc,SAAS,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,cAAc,SAAS,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.d.ts

@@ -0,0 +1,17 @@
+import { SimCloudFrontResponseHeader } from "../../response-headers-policy/sim-cf-response-header.js";
+import { type SimCfnCfRhPolicyFieldRefuse } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's CustomHeadersConfig section into the
+ * headers it adds.
+ *
+ * Split from the config reader that calls it for the same reason as
+ * simCfnCfResponseHeadersPolicySecurityHeaders: this project holds every
+ * source file to a line count.
+ */
+export declare function simCfnCfResponseHeadersPolicyCustomHeaders(config: Record<string, unknown>, refuse: SimCfnCfRhPolicyFieldRefuse): SimCloudFrontResponseHeader[];
+/**
+ * Reads a ResponseHeadersPolicyConfig's RemoveHeadersConfig section into the
+ * header names it removes.
+ */
+export declare function simCfnCfResponseHeadersPolicyRemoveHeaders(config: Record<string, unknown>, refuse: SimCfnCfRhPolicyFieldRefuse): string[];
+//# sourceMappingURL=sim-cfn-cf-rh-policy-custom-headers.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-custom-headers.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,2BAA2B,GAClC,2BAA2B,EAAE,CAwB/B;AAED;;;GAGG;AACH,wBAAgB,0CAA0C,CACxD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,2BAA2B,GAClC,MAAM,EAAE,CAUV"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.js

@@ -0,0 +1,45 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimCloudFrontResponseHeader } from "../../response-headers-policy/sim-cf-response-header.js";
+import { sectionItems, } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's CustomHeadersConfig section into the
+ * headers it adds.
+ *
+ * Split from the config reader that calls it for the same reason as
+ * simCfnCfResponseHeadersPolicySecurityHeaders: this project holds every
+ * source file to a line count.
+ */
+export function simCfnCfResponseHeadersPolicyCustomHeaders(config, refuse) {
+    return sectionItems(config, "CustomHeadersConfig", refuse).map((item) => {
+        if (!isRecord(item)) {
+            refuse(`CustomHeadersConfig items must be objects`);
+        }
+        const name = item["Header"];
+        const value = item["Value"];
+        if (typeof name !== "string" || typeof value !== "string") {
+            refuse(`CustomHeadersConfig items need a string Header and Value`);
+        }
+        // Override is required by the CloudFormation schema, so anything else
+        // here is a template that would be refused before it reached a policy at
+        // all.
+        const override = item["Override"];
+        if (typeof override !== "boolean") {
+            refuse(`CustomHeadersConfig item ${name} needs a boolean Override`);
+        }
+        return new SimCloudFrontResponseHeader({ name, value, override });
+    });
+}
+/**
+ * Reads a ResponseHeadersPolicyConfig's RemoveHeadersConfig section into the
+ * header names it removes.
+ */
+export function simCfnCfResponseHeadersPolicyRemoveHeaders(config, refuse) {
+    return sectionItems(config, "RemoveHeadersConfig", refuse).map((item) => {
+        const name = isRecord(item) ? item["Header"] : undefined;
+        if (typeof name !== "string") {
+            refuse(`RemoveHeadersConfig items need a string Header`);
+        }
+        return name;
+    });
+}
+//# sourceMappingURL=sim-cfn-cf-rh-policy-custom-headers.js.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-custom-headers.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-custom-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EACL,YAAY,GAEb,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,MAA+B,EAC/B,MAAmC;IAEnC,OAAO,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,CAAC,0DAA0D,CAAC,CAAC;QACrE,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,OAAO;QACP,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAElC,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,4BAA4B,IAAI,2BAA2B,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0CAA0C,CACxD,MAA+B,EAC/B,MAAmC;IAEnC,OAAO,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,gDAAgD,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-field-reader.d.ts

@@ -0,0 +1,37 @@
+export type SimCfnCfRhPolicyFieldRefuse = (detail: string) => never;
+/**
+ * Shared field readers for a ResponseHeadersPolicyConfig section, used by
+ * both the SecurityHeadersConfig and CorsConfig readers so the type checks
+ * every field needs are written once rather than once per section.
+ */
+/**
+ * A named field that must be a string.
+ */
+export declare function requiredString(item: Record<string, unknown>, field: string, context: string, refuse: SimCfnCfRhPolicyFieldRefuse): string;
+/**
+ * A named field that must be a whole number of the kind CloudFormation calls
+ * an Integer.
+ *
+ * A template is often a JavaScript object rather than parsed JSON here, so a
+ * fraction, a NaN or an Infinity can reach this where JSON could not carry
+ * one, and each would reach a header as a value no client can read.
+ */
+export declare function requiredInteger(item: Record<string, unknown>, field: string, context: string, refuse: SimCfnCfRhPolicyFieldRefuse): number;
+/**
+ * One of a fixed set of values a field is allowed to take.
+ */
+export declare function requiredEnum(item: Record<string, unknown>, field: string, allowed: readonly string[], context: string, refuse: SimCfnCfRhPolicyFieldRefuse): string;
+/**
+ * A named field that must be a boolean.
+ */
+export declare function requiredBoolean(item: Record<string, unknown>, field: string, context: string, refuse: SimCfnCfRhPolicyFieldRefuse): boolean;
+/**
+ * A named field that must be an object, or nothing when the field is absent.
+ */
+export declare function optionalObject(item: Record<string, unknown>, field: string, context: string, refuse: SimCfnCfRhPolicyFieldRefuse): Record<string, unknown> | undefined;
+/**
+ * The `Items` of one `<name>Config` section, or nothing when the section or
+ * its `Items` is absent.
+ */
+export declare function sectionItems(config: Record<string, unknown>, sectionName: string, refuse: SimCfnCfRhPolicyFieldRefuse): unknown[];
+//# sourceMappingURL=sim-cfn-cf-rh-policy-field-reader.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-field-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-field-reader.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-field-reader.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,KAAK,CAAC;AAEpE;;;;GAIG;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,2BAA2B,GAClC,MAAM,CAOR;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,2BAA2B,GAClC,MAAM,CAOR;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,2BAA2B,GAClC,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAOT;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,2BAA2B,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,2BAA2B,GAClC,OAAO,EAAE,CAYX"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-field-reader.js

@@ -0,0 +1,75 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+/**
+ * Shared field readers for a ResponseHeadersPolicyConfig section, used by
+ * both the SecurityHeadersConfig and CorsConfig readers so the type checks
+ * every field needs are written once rather than once per section.
+ */
+/**
+ * A named field that must be a string.
+ */
+export function requiredString(item, field, context, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    const value = item[field];
+    return typeof value === "string"
+        ? value
+        : refuse(`${context} needs a string ${field}`);
+}
+/**
+ * A named field that must be a whole number of the kind CloudFormation calls
+ * an Integer.
+ *
+ * A template is often a JavaScript object rather than parsed JSON here, so a
+ * fraction, a NaN or an Infinity can reach this where JSON could not carry
+ * one, and each would reach a header as a value no client can read.
+ */
+export function requiredInteger(item, field, context, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    const value = item[field];
+    return typeof value === "number" && Number.isSafeInteger(value)
+        ? value
+        : refuse(`${context} needs a whole number ${field}`);
+}
+/**
+ * One of a fixed set of values a field is allowed to take.
+ */
+export function requiredEnum(item, field, allowed, context, refuse) {
+    const value = requiredString(item, field, context, refuse);
+    return allowed.includes(value)
+        ? value
+        : refuse(`${context} ${field} must be one of ${allowed.join(", ")}`);
+}
+/**
+ * A named field that must be a boolean.
+ */
+export function requiredBoolean(item, field, context, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    const value = item[field];
+    return typeof value === "boolean"
+        ? value
+        : refuse(`${context} needs a boolean ${field}`);
+}
+/**
+ * A named field that must be an object, or nothing when the field is absent.
+ */
+export function optionalObject(item, field, context, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    const value = item[field];
+    if (value === undefined) {
+        return undefined;
+    }
+    return isRecord(value) ? value : refuse(`${context} must be an object`);
+}
+/**
+ * The `Items` of one `<name>Config` section, or nothing when the section or
+ * its `Items` is absent.
+ */
+export function sectionItems(config, sectionName, refuse) {
+    const items = optionalObject(config, sectionName, sectionName, refuse)?.["Items"];
+    if (items === undefined) {
+        return [];
+    }
+    return Array.isArray(items)
+        ? items
+        : refuse(`${sectionName} Items must be an array`);
+}
+//# sourceMappingURL=sim-cfn-cf-rh-policy-field-reader.js.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-field-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-field-reader.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-field-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAIjE;;;;GAIG;AAEH;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,IAA6B,EAC7B,KAAa,EACb,OAAe,EACf,MAAmC;IAEnC,4DAA4D;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAE1B,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,mBAAmB,KAAK,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,KAAa,EACb,OAAe,EACf,MAAmC;IAEnC,4DAA4D;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAE1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC7D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,yBAAyB,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,IAA6B,EAC7B,KAAa,EACb,OAA0B,EAC1B,OAAe,EACf,MAAmC;IAEnC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,KAAa,EACb,OAAe,EACf,MAAmC;IAEnC,4DAA4D;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAE1B,OAAO,OAAO,KAAK,KAAK,SAAS;QAC/B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,oBAAoB,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,IAA6B,EAC7B,KAAa,EACb,OAAe,EACf,MAAmC;IAEnC,4DAA4D;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAE1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA+B,EAC/B,WAAmB,EACnB,MAAmC;IAEnC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CACtE,OAAO,CACR,CAAC;IAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,yBAAyB,CAAC,CAAC;AACtD,CAAC"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-headers.d.ts

@@ -0,0 +1,11 @@
+import { SimCloudFrontResponseHeader } from "../../response-headers-policy/sim-cf-response-header.js";
+import { type SimCfnCfRhPolicyFieldRefuse } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's SecurityHeadersConfig section into
+ * the header CloudFront documents for each of its sub-sections.
+ *
+ * Every sub-section carries its own `Override`, unlike the CORS section whose
+ * one `OriginOverride` decides all of its headers together.
+ */
+export declare function simCfnCfResponseHeadersPolicySecurityHeaders(config: Record<string, unknown>, refuse: SimCfnCfRhPolicyFieldRefuse): SimCloudFrontResponseHeader[];
+//# sourceMappingURL=sim-cfn-cf-rh-policy-security-headers.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-security-headers.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wCAAwC,CAAC;AAGhD;;;;;;GAMG;AACH,wBAAgB,4CAA4C,CAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,2BAA2B,GAClC,2BAA2B,EAAE,CA0B/B"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-headers.js

@@ -0,0 +1,30 @@
+import { SimCloudFrontResponseHeader } from "../../response-headers-policy/sim-cf-response-header.js";
+import { optionalObject, requiredBoolean, } from "./sim-cfn-cf-rh-policy-field-reader.js";
+import { simCfnCfRhPolicySecurityHeaders } from "./sim-cfn-cf-rh-policy-security-values.js";
+/**
+ * Reads a ResponseHeadersPolicyConfig's SecurityHeadersConfig section into
+ * the header CloudFront documents for each of its sub-sections.
+ *
+ * Every sub-section carries its own `Override`, unlike the CORS section whose
+ * one `OriginOverride` decides all of its headers together.
+ */
+export function simCfnCfResponseHeadersPolicySecurityHeaders(config, refuse) {
+    const section = optionalObject(config, "SecurityHeadersConfig", "SecurityHeadersConfig", refuse);
+    if (section === undefined) {
+        return [];
+    }
+    return simCfnCfRhPolicySecurityHeaders
+        .map(([subsection, name, value]) => {
+        const context = `SecurityHeadersConfig ${subsection}`;
+        const item = optionalObject(section, subsection, context, refuse);
+        return item === undefined
+            ? undefined
+            : new SimCloudFrontResponseHeader({
+                name,
+                value: value(item, context, refuse),
+                override: requiredBoolean(item, "Override", context, refuse),
+            });
+    })
+        .filter((h) => h !== undefined);
+}
+//# sourceMappingURL=sim-cfn-cf-rh-policy-security-headers.js.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-security-headers.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EACL,cAAc,EACd,eAAe,GAEhB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,UAAU,4CAA4C,CAC1D,MAA+B,EAC/B,MAAmC;IAEnC,MAAM,OAAO,GAAG,cAAc,CAC5B,MAAM,EACN,uBAAuB,EACvB,uBAAuB,EACvB,MAAM,CACP,CAAC;IAEF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,+BAA+B;SACnC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,yBAAyB,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,2BAA2B,CAAC;gBAC9B,IAAI;gBACJ,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;gBACnC,QAAQ,EAAE,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC;aAC7D,CAAC,CAAC;IACT,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAoC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AACtE,CAAC"}

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-values.d.ts

@@ -0,0 +1,19 @@
+import { type SimCfnCfRhPolicyFieldRefuse } from "./sim-cfn-cf-rh-policy-field-reader.js";
+/**
+ * The header value each SecurityHeadersConfig sub-section describes.
+ *
+ * Split from the section reader that dispatches to them so that file stays a
+ * table of which sub-section sets which header, under the line count this
+ * project holds every source file to.
+ */
+export type SimCfnCfRhPolicySecurityValue = (item: Record<string, unknown>, context: string, refuse: SimCfnCfRhPolicyFieldRefuse) => string;
+/**
+ * Which sub-section of a SecurityHeadersConfig sets which response header,
+ * and what builds its value.
+ */
+export declare const simCfnCfRhPolicySecurityHeaders: readonly (readonly [
+    string,
+    string,
+    SimCfnCfRhPolicySecurityValue
+])[];
+//# sourceMappingURL=sim-cfn-cf-rh-policy-security-values.d.ts.map

package/dist/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cf-rh-policy-security-values.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/cfn/response-headers-policy/sim-cfn-cf-rh-policy-security-values.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,2BAA2B,EACjC,MAAM,wCAAwC,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,2BAA2B,KAChC,MAAM,CAAC;AAwFZ;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,SAAS,CAAC,SAAS;IAC/D,MAAM;IACN,MAAM;IACN,6BAA6B;CAC9B,CAAC,EAeD,CAAC"}