@kensio/yulin 1.20.0 → 1.20.2

package/dist/service/cloudfront/edge/adapter/sim-lambda-edge-request-adapter.js

@@ -0,0 +1,90 @@
+import { simAwsRequestHostname } from "../../../../serve/http/url/sim-aws-request-hostname.js";
+import { edgeRequestBody, replacementBody } from "./sim-lambda-edge-body.js";
+import { fromEdgeHeaders, toEdgeHeaders } from "./sim-lambda-edge-headers.js";
+/**
+ * The client IP a simulated edge function is told the request came from.
+ *
+ * Everything reaching the simulator arrives in process, so there is no viewer
+ * address to report. The CloudFront Functions adapter reports the same one.
+ */
+const simEdgeClientIp = "127.0.0.1";
+/**
+ * Converts a Fetch API Request into the Lambda@Edge request shape, and a
+ * handler's request back again. `SimLambdaEdgeResponseAdapter` does the same
+ * for a response.
+ */
+export class SimLambdaEdgeRequestAdapter {
+    /**
+     * Convert a Node fetch Request into the Lambda@Edge request shape.
+     *
+     * The body is read only when the association asked for it, because
+     * CloudFront sends one only where `IncludeBody` is set and reading it here
+     * would otherwise consume a stream nothing wants.
+     */
+    async toEdgeRequest(request, includeBody) {
+        const url = new URL(request.url);
+        return {
+            clientIp: simEdgeClientIp,
+            method: request.method,
+            uri: url.pathname,
+            querystring: url.search.replace(/^\?/u, ""),
+            headers: this.viewerEdgeHeaders(request),
+            ...(includeBody && { body: await edgeRequestBody(request) }),
+        };
+    }
+    /**
+     * Convert a handler's request back into a Node fetch Request.
+     */
+    fromEdgeRequest(edgeRequest, originalRequest) {
+        const url = new URL(originalRequest.url);
+        url.pathname = edgeRequest.uri;
+        url.search = edgeRequest.querystring;
+        const headers = fromEdgeHeaders(edgeRequest.headers);
+        restoreViewerHost(headers, originalRequest);
+        // A replaced body is a different length from the one the viewer sent, and
+        // `Content-Length` is read-only to the handler, so the header it hands
+        // back still describes the old body. Real CloudFront works the new length
+        // out for itself, and dropping the header leaves the transport to do the
+        // same.
+        if (edgeRequest.body?.action === "replace") {
+            headers.delete("content-length");
+        }
+        return new Request(url, {
+            method: edgeRequest.method,
+            headers,
+            body: replacementBody(edgeRequest, originalRequest),
+            duplex: "half",
+            redirect: originalRequest.redirect,
+            signal: originalRequest.signal,
+        });
+    }
+    /**
+     * Request headers as the edge function sees them, with the host CloudFront
+     * presents.
+     *
+     * A request served on localhost arrives with the Yulin-local host, and the
+     * function is told the Distribution domain name or alternate domain name the
+     * viewer used, as it would be on AWS.
+     */
+    viewerEdgeHeaders(request) {
+        const headers = toEdgeHeaders(request.headers);
+        headers["host"] = [{ key: "Host", value: simAwsRequestHostname(request) }];
+        return headers;
+    }
+}
+/**
+ * Restore the host the request arrived with.
+ *
+ * `Host` is read-only in a viewer-request event, so a host a handler wrote is
+ * discarded. That also keeps the Yulin-local host on the request continuing to
+ * the origin, which is the name the rest of the simulation resolves.
+ */
+function restoreViewerHost(headers, originalRequest) {
+    const viewerHost = originalRequest.headers.get("host");
+    if (viewerHost === null) {
+        headers.delete("host");
+        return;
+    }
+    headers.set("host", viewerHost);
+}
+//# sourceMappingURL=sim-lambda-edge-request-adapter.js.map

package/dist/service/cloudfront/edge/adapter/sim-lambda-edge-request-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-edge-request-adapter.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/edge/adapter/sim-lambda-edge-request-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,eAAe,GAAG,WAAW,CAAC;AAEpC;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IACtC;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgB,EAChB,WAAoB;QAEpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,OAAO;YACL,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,GAAG,CAAC,QAAQ;YACjB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACxC,GAAG,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CACb,WAAiC,EACjC,eAAwB;QAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC;QAErC,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACrD,iBAAiB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAE5C,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,QAAQ;QACR,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;YACtB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,OAAO;YACP,IAAI,EAAE,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC;YACnD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,MAAM,EAAE,eAAe,CAAC,MAAM;SAC/B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,OAAgB;QACxC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE3E,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,OAAgB,EAAE,eAAwB;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEvD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAClC,CAAC"}

package/dist/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.d.ts

@@ -0,0 +1,26 @@
+import type { LambdaAtEdge } from "../../typings/lambda-at-edge.namespace.js";
+/**
+ * Converts between Fetch API Response objects and the Lambda@Edge response
+ * shape.
+ */
+export declare class SimLambdaEdgeResponseAdapter {
+    /**
+     * Convert a Node fetch Response into the Lambda@Edge response shape.
+     */
+    toEdgeResponse(response: Response): LambdaAtEdge.Response;
+    /**
+     * Convert a handler's generated response into a Node fetch Response.
+     */
+    fromEdgeResponse(edgeResponse: LambdaAtEdge.Response): Response;
+    /**
+     * Convert a viewer-response handler's result into a Node fetch Response,
+     * keeping the origin's body.
+     *
+     * A viewer-response event carries no body, and a handler that returns
+     * `event.Records[0].cf.response` returns none either. Treating that as an
+     * empty body would drop the page while leaving the origin's content-length
+     * header describing it. A handler that did write a body replaces it.
+     */
+    fromEdgeViewerResponse(edgeResponse: LambdaAtEdge.Response, originalResponse: Response): Response;
+}
+//# sourceMappingURL=sim-lambda-edge-response-adapter.d.ts.map

package/dist/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-edge-response-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAI9E;;;GAGG;AACH,qBAAa,4BAA4B;IACvC;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAMxD;IAED;;OAEG;IACH,gBAAgB,CAAC,YAAY,EAAE,YAAY,CAAC,QAAQ,GAAG,QAAQ,CAM9D;IAED;;;;;;;;OAQG;IACH,sBAAsB,CACpB,YAAY,EAAE,YAAY,CAAC,QAAQ,EACnC,gBAAgB,EAAE,QAAQ,GACzB,QAAQ,CAWV;CACF"}

package/dist/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.js

@@ -0,0 +1,47 @@
+import { edgeResponseBody } from "./sim-lambda-edge-body.js";
+import { fromEdgeHeaders, toEdgeHeaders } from "./sim-lambda-edge-headers.js";
+/**
+ * Converts between Fetch API Response objects and the Lambda@Edge response
+ * shape.
+ */
+export class SimLambdaEdgeResponseAdapter {
+    /**
+     * Convert a Node fetch Response into the Lambda@Edge response shape.
+     */
+    toEdgeResponse(response) {
+        return {
+            status: String(response.status),
+            statusDescription: response.statusText,
+            headers: toEdgeHeaders(response.headers),
+        };
+    }
+    /**
+     * Convert a handler's generated response into a Node fetch Response.
+     */
+    fromEdgeResponse(edgeResponse) {
+        return new Response(edgeResponseBody(edgeResponse), {
+            status: Number(edgeResponse.status),
+            statusText: edgeResponse.statusDescription ?? "",
+            headers: fromEdgeHeaders(edgeResponse.headers),
+        });
+    }
+    /**
+     * Convert a viewer-response handler's result into a Node fetch Response,
+     * keeping the origin's body.
+     *
+     * A viewer-response event carries no body, and a handler that returns
+     * `event.Records[0].cf.response` returns none either. Treating that as an
+     * empty body would drop the page while leaving the origin's content-length
+     * header describing it. A handler that did write a body replaces it.
+     */
+    fromEdgeViewerResponse(edgeResponse, originalResponse) {
+        return new Response(edgeResponse.body === undefined
+            ? originalResponse.body
+            : edgeResponseBody(edgeResponse), {
+            status: Number(edgeResponse.status),
+            statusText: edgeResponse.statusDescription ?? "",
+            headers: fromEdgeHeaders(edgeResponse.headers),
+        });
+    }
+}
+//# sourceMappingURL=sim-lambda-edge-response-adapter.js.map

package/dist/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-edge-response-adapter.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;GAGG;AACH,MAAM,OAAO,4BAA4B;IACvC;;OAEG;IACH,cAAc,CAAC,QAAkB;QAC/B,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/B,iBAAiB,EAAE,QAAQ,CAAC,UAAU;YACtC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,YAAmC;QAClD,OAAO,IAAI,QAAQ,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAClD,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YACnC,UAAU,EAAE,YAAY,CAAC,iBAAiB,IAAI,EAAE;YAChD,OAAO,EAAE,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,sBAAsB,CACpB,YAAmC,EACnC,gBAA0B;QAE1B,OAAO,IAAI,QAAQ,CACjB,YAAY,CAAC,IAAI,KAAK,SAAS;YAC7B,CAAC,CAAC,gBAAgB,CAAC,IAAI;YACvB,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAClC;YACE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YACnC,UAAU,EAAE,YAAY,CAAC,iBAAiB,IAAI,EAAE;YAChD,OAAO,EAAE,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC;SAC/C,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/edge/sim-aws-cf-edge-functions.d.ts

@@ -0,0 +1,44 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfEdgeFunctions } from "./sim-cf-edge-functions.js";
+/**
+ * The service principal Lambda@Edge runs a function's execution role as.
+ *
+ * A role for an ordinary function trusts `lambda.amazonaws.com` alone, and
+ * CloudFront refuses to associate that function. Adding this principal to the
+ * trust policy is the step people miss.
+ */
+export declare const simLambdaEdgeServicePrincipal = "edgelambda.amazonaws.com";
+/**
+ * The simulated Lambda functions of one simulated AWS instance, as Lambda@Edge
+ * targets.
+ */
+export declare class SimAwsCfEdgeFunctions implements SimCfEdgeFunctions {
+    private readonly simAws;
+    constructor(simAws: SimAws);
+    /**
+     * Check the function is there and that Lambda@Edge could run it.
+     */
+    assertAssociable(functionArn: string): Promise<void>;
+    /**
+     * Run the function for one edge event.
+     *
+     * The function is invoked directly rather than through an Invoke command,
+     * because real CloudFront runs the replica as the service rather than as
+     * whoever made the request, and because a handler that throws has to reach
+     * the request pipeline as a failure rather than as an invocation result.
+     */
+    invoke(functionArn: string, event: object): Promise<unknown>;
+    /**
+     * What this ARN names, refusing an ARN that names nothing here.
+     */
+    private target;
+    /**
+     * Refuse a function whose execution role Lambda@Edge could not assume.
+     *
+     * Whether a role can be assumed is IAM's own rule, so the decision is made
+     * by the shared service-role helper and CloudFront only says what it means
+     * here.
+     */
+    private assertExecutionRoleTrust;
+}
+//# sourceMappingURL=sim-aws-cf-edge-functions.d.ts.map

package/dist/service/cloudfront/edge/sim-aws-cf-edge-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-cf-edge-functions.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-aws-cf-edge-functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AASnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAOxE;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,kBAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAE/C;;OAEG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAED;;;;;;;OAOG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjE;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;IAiBd;;;;;;OAMG;YACW,wBAAwB;CAcvC"}

package/dist/service/cloudfront/edge/sim-aws-cf-edge-functions.js

@@ -0,0 +1,89 @@
+import { assumeSimServiceRole, simServiceRoleTarget, } from "../../sts/service-role/sim-service-role.js";
+import { SimCloudFrontInvalidLambdaFunctionAssociation } from "../error/sim-cloudfront.error.js";
+import { edgeFunctionArnParts } from "./sim-cf-edge-function-arn.js";
+/**
+ * The service principal Lambda@Edge runs a function's execution role as.
+ *
+ * A role for an ordinary function trusts `lambda.amazonaws.com` alone, and
+ * CloudFront refuses to associate that function. Adding this principal to the
+ * trust policy is the step people miss.
+ */
+export const simLambdaEdgeServicePrincipal = "edgelambda.amazonaws.com";
+/**
+ * The session name AWS gives a role Lambda@Edge assumes.
+ */
+const sessionName = "LambdaEdge";
+/**
+ * The simulated Lambda functions of one simulated AWS instance, as Lambda@Edge
+ * targets.
+ */
+export class SimAwsCfEdgeFunctions {
+    simAws;
+    constructor(simAws) {
+        this.simAws = simAws;
+    }
+    /**
+     * Check the function is there and that Lambda@Edge could run it.
+     */
+    async assertAssociable(functionArn) {
+        await this.assertExecutionRoleTrust(this.target(functionArn), functionArn);
+    }
+    /**
+     * Run the function for one edge event.
+     *
+     * The function is invoked directly rather than through an Invoke command,
+     * because real CloudFront runs the replica as the service rather than as
+     * whoever made the request, and because a handler that throws has to reach
+     * the request pipeline as a failure rather than as an invocation result.
+     */
+    async invoke(functionArn, event) {
+        return await this.target(functionArn).simFunction.invoke(event);
+    }
+    /**
+     * What this ARN names, refusing an ARN that names nothing here.
+     */
+    target(functionArn) {
+        const arn = edgeFunctionArnParts(functionArn);
+        const found = this.simAws
+            .accountRegionScope(arn.accountId, arn.regionName)
+            .lambda()
+            .getSimFunctionTarget(arn.functionName, arn.qualifier);
+        if (found === undefined) {
+            throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront LambdaFunctionARN ${functionArn} names no simulated ` +
+                `Lambda function version`);
+        }
+        return found;
+    }
+    /**
+     * Refuse a function whose execution role Lambda@Edge could not assume.
+     *
+     * Whether a role can be assumed is IAM's own rule, so the decision is made
+     * by the shared service-role helper and CloudFront only says what it means
+     * here.
+     */
+    async assertExecutionRoleTrust(target, functionArn) {
+        const { accountId, regionName } = target.simFunction.accountRegionScope;
+        await assumeSimServiceRole({
+            target: simServiceRoleTarget(target.simFunction.roleArn),
+            servicePrincipal: simLambdaEdgeServicePrincipal,
+            sessionName,
+            iam: this.simAws.accountRegionScope(accountId, regionName).iam(),
+            refusals: executionRoleRefusals(functionArn),
+        });
+    }
+}
+/**
+ * What CloudFront says when a Lambda@Edge execution role is unusable.
+ */
+function executionRoleRefusals(functionArn) {
+    return {
+        missingRole: (target) => new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront Lambda@Edge function ${functionArn} has execution ` +
+            `role ${target.roleArn}, which is not a simulated IAM role`),
+        untrustedRole: (target, servicePrincipal) => new SimCloudFrontInvalidLambdaFunctionAssociation(`The trust policy of ${target.roleArn} does not allow ` +
+            `${servicePrincipal} to assume it, so Lambda@Edge could not run ` +
+            `${functionArn}. A Lambda@Edge execution role trusts both ` +
+            `lambda.amazonaws.com and ${servicePrincipal}. Add it to the ` +
+            `role's AssumeRolePolicyDocument.`),
+    };
+}
+//# sourceMappingURL=sim-aws-cf-edge-functions.js.map

package/dist/service/cloudfront/edge/sim-aws-cf-edge-functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-cf-edge-functions.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-aws-cf-edge-functions.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,6CAA6C,EAAE,MAAM,kCAAkC,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACH,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,KAAa;QAC7C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,WAAmB;QAChC,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;aACtB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;aACjD,MAAM,EAAE;aACR,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAEzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,6CAA6C,CACrD,oCAAoC,WAAW,sBAAsB;gBACnE,yBAAyB,CAC5B,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,wBAAwB,CACpC,MAA+B,EAC/B,WAAmB;QAEnB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC;QAExE,MAAM,oBAAoB,CAAC;YACzB,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;YACxD,gBAAgB,EAAE,6BAA6B;YAC/C,WAAW;YACX,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE;YAChE,QAAQ,EAAE,qBAAqB,CAAC,WAAW,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,OAAO;QACL,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACtB,IAAI,6CAA6C,CAC/C,uCAAuC,WAAW,iBAAiB;YACjE,QAAQ,MAAM,CAAC,OAAO,qCAAqC,CAC9D;QACH,aAAa,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAC1C,IAAI,6CAA6C,CAC/C,uBAAuB,MAAM,CAAC,OAAO,kBAAkB;YACrD,GAAG,gBAAgB,8CAA8C;YACjE,GAAG,WAAW,6CAA6C;YAC3D,4BAA4B,gBAAgB,kBAAkB;YAC9D,kCAAkC,CACrC;KACJ,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.d.ts

@@ -0,0 +1,7 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+/**
+ * Check the caller may put this function version in front of a Distribution.
+ */
+export declare function authorizeEdgeAssociation(iam: SimIamInterServiceAuthZ, functionArn: string, caller?: SimAwsCaller): void;
+//# sourceMappingURL=sim-cf-edge-association-auth-z.d.ts.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAcnG;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,uBAAuB,EAC5B,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAYN"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.js

@@ -0,0 +1,27 @@
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+/**
+ * What a caller needs on the function version to put it in front of a
+ * Distribution.
+ *
+ * `GetFunction` is how CloudFront reads the code and configuration, and
+ * `EnableReplication` is what lets the replication service copy it out to the
+ * edge. A policy written the way the AWS docs write it grants
+ * `lambda:EnableReplication*`, which matches this.
+ */
+const associationActions = ["lambda:GetFunction", "lambda:EnableReplication"];
+/**
+ * Check the caller may put this function version in front of a Distribution.
+ */
+export function authorizeEdgeAssociation(iam, functionArn, caller) {
+    for (const action of associationActions) {
+        const decision = iam.authorize({ action, resource: functionArn, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource: functionArn,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-cf-edge-association-auth-z.js.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-auth-z.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-auth-z.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,EAAE,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAA4B,EAC5B,WAAmB,EACnB,MAAqB;IAErB,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1E,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-checks.d.ts

@@ -0,0 +1,47 @@
+import type { SimCloudFrontCacheBehaviorConfig, SimCloudFrontDefaultCacheBehaviorConfig } from "../command/create-distribution/create-distribution.command.js";
+/**
+ * The checks a Lambda@Edge association needs that read the Behavior config
+ * alone, held apart from the validator that also reaches simulated Lambda and
+ * simulated IAM.
+ */
+/**
+ * The event types this simulation runs a Lambda@Edge function at.
+ */
+export type SimulatedEdgeEventType = "viewer-request" | "viewer-response";
+type BehaviorConfig = SimCloudFrontDefaultCacheBehaviorConfig | SimCloudFrontCacheBehaviorConfig;
+/**
+ * Refuse an event type this simulation has no hook for.
+ *
+ * CloudFront runs a Lambda@Edge function at all four events, and this runs one
+ * at the two viewer events. An origin association is told so here rather than
+ * being configured into a Behavior that would never run it.
+ */
+export declare function assertSimulatedEventType(eventType: string | undefined): asserts eventType is SimulatedEdgeEventType;
+/**
+ * Refuse a Behavior that runs both kinds of edge function at the viewer.
+ *
+ * CloudFront takes one function per event type, and it takes CloudFront
+ * Functions and Lambda@Edge together only where the Lambda@Edge function is on
+ * an origin event. A viewer-request CloudFront Function alongside a
+ * viewer-response Lambda@Edge function is refused too, which is the part of
+ * the rule that surprises people.
+ */
+export declare function assertNoViewerFunctionMix(behavior: BehaviorConfig): void;
+/**
+ * Refuse a Behavior associating two functions with one event type.
+ *
+ * CloudFront takes one edge function per event type. Two entries naming the
+ * same one would otherwise be configured last-wins, leaving a Distribution
+ * running a function the template did not put first.
+ */
+export declare function assertOneFunctionPerEvent(seen: Set<string>, eventType: string): void;
+/**
+ * Refuse an association with no function to run.
+ *
+ * `LambdaFunctionARN` is required on a real association. Left out, it has to
+ * be refused here, because the Behavior configurator reads it well after a
+ * Distribution ID has been allocated and the Distribution built.
+ */
+export declare function assertAssociatedFunctionArn(functionArn: string | undefined, eventType: string): asserts functionArn is string;
+export {};
+//# sourceMappingURL=sim-cf-edge-association-checks.d.ts.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-checks.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAGvE;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAE1E,KAAK,cAAc,GACf,uCAAuC,GACvC,gCAAgC,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAU7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAmBxE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EACjB,SAAS,EAAE,MAAM,GAChB,IAAI,CAWN;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,IAAI,MAAM,CAS/B"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-checks.js

@@ -0,0 +1,71 @@
+import { SimCloudFrontInvalidLambdaFunctionAssociation } from "../error/sim-cloudfront.error.js";
+/**
+ * Refuse an event type this simulation has no hook for.
+ *
+ * CloudFront runs a Lambda@Edge function at all four events, and this runs one
+ * at the two viewer events. An origin association is told so here rather than
+ * being configured into a Behavior that would never run it.
+ */
+export function assertSimulatedEventType(eventType) {
+    if (eventType === "viewer-request" || eventType === "viewer-response") {
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront Lambda@Edge association EventType ${eventType} is not ` +
+        `simulated. Simulated CloudFront runs a Lambda@Edge function at ` +
+        `viewer-request and viewer-response.`);
+}
+/**
+ * Refuse a Behavior that runs both kinds of edge function at the viewer.
+ *
+ * CloudFront takes one function per event type, and it takes CloudFront
+ * Functions and Lambda@Edge together only where the Lambda@Edge function is on
+ * an origin event. A viewer-request CloudFront Function alongside a
+ * viewer-response Lambda@Edge function is refused too, which is the part of
+ * the rule that surprises people.
+ */
+export function assertNoViewerFunctionMix(behavior) {
+    const cffEvents = (behavior.FunctionAssociations?.Items ?? [])
+        .map((association) => association.EventType)
+        .filter((eventType) => eventType?.startsWith("viewer-") === true);
+    const edgeEvents = (behavior.LambdaFunctionAssociations?.Items ?? [])
+        .map((association) => association.EventType)
+        .filter((eventType) => eventType?.startsWith("viewer-") === true);
+    if (cffEvents.length === 0 || edgeEvents.length === 0) {
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront cache Behavior associates CloudFront Function ` +
+        `${cffEvents.join(", ")} and Lambda@Edge ${edgeEvents.join(", ")}. ` +
+        `CloudFront does not combine the two kinds of edge function at the ` +
+        `viewer events, whether or not they are on the same event type.`);
+}
+/**
+ * Refuse a Behavior associating two functions with one event type.
+ *
+ * CloudFront takes one edge function per event type. Two entries naming the
+ * same one would otherwise be configured last-wins, leaving a Distribution
+ * running a function the template did not put first.
+ */
+export function assertOneFunctionPerEvent(seen, eventType) {
+    if (!seen.has(eventType)) {
+        seen.add(eventType);
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront cache Behavior associates more than one Lambda@Edge ` +
+        `function with ${eventType}. CloudFront takes one edge function per ` +
+        `event type.`);
+}
+/**
+ * Refuse an association with no function to run.
+ *
+ * `LambdaFunctionARN` is required on a real association. Left out, it has to
+ * be refused here, because the Behavior configurator reads it well after a
+ * Distribution ID has been allocated and the Distribution built.
+ */
+export function assertAssociatedFunctionArn(functionArn, eventType) {
+    if (functionArn !== undefined) {
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront Lambda@Edge association for ${eventType} has no ` +
+        `LambdaFunctionARN`);
+}
+//# sourceMappingURL=sim-cf-edge-association-checks.js.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-checks.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-checks.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6CAA6C,EAAE,MAAM,kCAAkC,CAAC;AAiBjG;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAA6B;IAE7B,IAAI,SAAS,KAAK,gBAAgB,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACtE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,oDAAoD,SAAS,UAAU;QACrE,iEAAiE;QACjE,qCAAqC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAwB;IAChE,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;SAC3C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;IAEpE,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC;SAClE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;SAC3C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;IAEpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,+DAA+D;QAC7D,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpE,oEAAoE;QACpE,gEAAgE,CACnE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,qEAAqE;QACnE,iBAAiB,SAAS,2CAA2C;QACrE,aAAa,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAA+B,EAC/B,SAAiB;IAEjB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,8CAA8C,SAAS,UAAU;QAC/D,mBAAmB,CACtB,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-validator.d.ts

@@ -0,0 +1,36 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimCloudFrontDistributionConfig } from "../command/create-distribution/create-distribution.command.js";
+import type { SimCfEdgeFunctions } from "./sim-cf-edge-functions.js";
+interface SimCfEdgeAssociationValidatorProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly edgeFunctions?: SimCfEdgeFunctions | undefined;
+}
+/**
+ * Checks the Lambda@Edge associations a DistributionConfig asks for.
+ *
+ * Real CloudFront refuses all of these when the Distribution is written rather
+ * than when a request arrives, and that is the point of doing it here. An
+ * association CloudFront would have refused otherwise turns into a test that
+ * passes with the edge function never running.
+ *
+ * With no edge functions collaborator there is no simulated Lambda to look
+ * anything up in, as in a standalone `SimCloudFront`, so the ARN itself is
+ * still checked and the function behind it is not.
+ */
+export declare class SimCfEdgeAssociationValidator {
+    private readonly iam;
+    private readonly edgeFunctions;
+    constructor(properties: SimCfEdgeAssociationValidatorProperties);
+    /**
+     * Validate every Behavior of a DistributionConfig.
+     */
+    validate(distributionConfig: SimCloudFrontDistributionConfig, caller?: SimAwsCaller): Promise<void>;
+    /**
+     * Check what one Behavior's config says, answering with the function ARNs it
+     * associates.
+     */
+    private checkBehavior;
+}
+export {};
+//# sourceMappingURL=sim-cf-edge-association-validator.d.ts.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-validator.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,KAAK,EAGV,+BAA+B,EAChC,MAAM,+DAA+D,CAAC;AASvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAE/D,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;OAEG;IACG,QAAQ,CACZ,kBAAkB,EAAE,+BAA+B,EACnD,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAqBf;IAED;;;OAGG;IACH,OAAO,CAAC,aAAa;CAiCtB"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-validator.js

@@ -0,0 +1,79 @@
+import { authorizeEdgeAssociation } from "./sim-cf-edge-association-auth-z.js";
+import { assertAssociatedFunctionArn, assertNoViewerFunctionMix, assertOneFunctionPerEvent, assertSimulatedEventType, } from "./sim-cf-edge-association-checks.js";
+import { edgeFunctionArnParts } from "./sim-cf-edge-function-arn.js";
+/**
+ * Checks the Lambda@Edge associations a DistributionConfig asks for.
+ *
+ * Real CloudFront refuses all of these when the Distribution is written rather
+ * than when a request arrives, and that is the point of doing it here. An
+ * association CloudFront would have refused otherwise turns into a test that
+ * passes with the edge function never running.
+ *
+ * With no edge functions collaborator there is no simulated Lambda to look
+ * anything up in, as in a standalone `SimCloudFront`, so the ARN itself is
+ * still checked and the function behind it is not.
+ */
+export class SimCfEdgeAssociationValidator {
+    iam;
+    edgeFunctions;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.edgeFunctions = properties.edgeFunctions;
+    }
+    /**
+     * Validate every Behavior of a DistributionConfig.
+     */
+    async validate(distributionConfig, caller) {
+        const associated = [];
+        for (const behavior of behaviors(distributionConfig)) {
+            associated.push(...this.checkBehavior(behavior, caller));
+        }
+        const edgeFunctions = this.edgeFunctions;
+        if (edgeFunctions === undefined) {
+            return;
+        }
+        // Every check above reads the config alone. Reaching the function behind
+        // each ARN is the only part that waits on anything, and one Behavior's
+        // functions have nothing to say about another's.
+        await Promise.all(associated.map(async (functionArn) => {
+            await edgeFunctions.assertAssociable(functionArn);
+        }));
+    }
+    /**
+     * Check what one Behavior's config says, answering with the function ARNs it
+     * associates.
+     */
+    checkBehavior(behavior, caller) {
+        const associations = behavior.LambdaFunctionAssociations?.Items ?? [];
+        if (associations.length === 0) {
+            return [];
+        }
+        assertNoViewerFunctionMix(behavior);
+        const functionArns = [];
+        const eventTypes = new Set();
+        for (const association of associations) {
+            const { EventType, LambdaFunctionARN } = association;
+            assertSimulatedEventType(EventType);
+            assertOneFunctionPerEvent(eventTypes, EventType);
+            assertAssociatedFunctionArn(LambdaFunctionARN, EventType);
+            // Read for the refusals reading it produces. The parts themselves
+            // matter only where the function behind the ARN is looked up.
+            edgeFunctionArnParts(LambdaFunctionARN);
+            authorizeEdgeAssociation(this.iam, LambdaFunctionARN, caller);
+            functionArns.push(LambdaFunctionARN);
+        }
+        return functionArns;
+    }
+}
+/**
+ * Every Behavior a DistributionConfig describes, default one first.
+ */
+function behaviors(distributionConfig) {
+    return [
+        ...(distributionConfig.DefaultCacheBehavior === undefined
+            ? []
+            : [distributionConfig.DefaultCacheBehavior]),
+        ...(distributionConfig.CacheBehaviors?.Items ?? []),
+    ];
+}
+//# sourceMappingURL=sim-cf-edge-association-validator.js.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-validator.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-validator.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAA0B;IAC7B,aAAa,CAAiC;IAE/D,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,kBAAmD,EACnD,MAAqB;QAErB,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QAEzC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,iDAAiD;QACjD,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACnC,MAAM,aAAa,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,aAAa,CACnB,QAEoC,EACpC,MAAqB;QAErB,MAAM,YAAY,GAAG,QAAQ,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC;QAEtE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,WAAW,CAAC;YAErD,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACpC,yBAAyB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACjD,2BAA2B,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;YAE1D,kEAAkE;YAClE,8DAA8D;YAC9D,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;YACxC,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC9D,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;CACF;AAED;;GAEG;AACH,SAAS,SAAS,CAChB,kBAAmD;IAKnD,OAAO;QACL,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QAC9C,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC"}