@kensio/yulin 1.20.1 → 1.20.3

package/dist/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.js

@@ -0,0 +1,47 @@
+import { edgeResponseBody } from "./sim-lambda-edge-body.js";
+import { fromEdgeHeaders, toEdgeHeaders } from "./sim-lambda-edge-headers.js";
+/**
+ * Converts between Fetch API Response objects and the Lambda@Edge response
+ * shape.
+ */
+export class SimLambdaEdgeResponseAdapter {
+    /**
+     * Convert a Node fetch Response into the Lambda@Edge response shape.
+     */
+    toEdgeResponse(response) {
+        return {
+            status: String(response.status),
+            statusDescription: response.statusText,
+            headers: toEdgeHeaders(response.headers),
+        };
+    }
+    /**
+     * Convert a handler's generated response into a Node fetch Response.
+     */
+    fromEdgeResponse(edgeResponse) {
+        return new Response(edgeResponseBody(edgeResponse), {
+            status: Number(edgeResponse.status),
+            statusText: edgeResponse.statusDescription ?? "",
+            headers: fromEdgeHeaders(edgeResponse.headers),
+        });
+    }
+    /**
+     * Convert a response handler's result into a Node fetch Response, keeping
+     * the origin's body.
+     *
+     * Neither response event carries a body, and a handler that returns
+     * `event.Records[0].cf.response` returns none either. Treating that as an
+     * empty body would drop the page while leaving the origin's content-length
+     * header describing it. A handler that did write a body replaces it.
+     */
+    fromEdgeHandlerResponse(edgeResponse, originalResponse) {
+        return new Response(edgeResponse.body === undefined
+            ? originalResponse.body
+            : edgeResponseBody(edgeResponse), {
+            status: Number(edgeResponse.status),
+            statusText: edgeResponse.statusDescription ?? "",
+            headers: fromEdgeHeaders(edgeResponse.headers),
+        });
+    }
+}
+//# sourceMappingURL=sim-lambda-edge-response-adapter.js.map

package/dist/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-edge-response-adapter.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/edge/adapter/sim-lambda-edge-response-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE9E;;;GAGG;AACH,MAAM,OAAO,4BAA4B;IACvC;;OAEG;IACH,cAAc,CAAC,QAAkB;QAC/B,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/B,iBAAiB,EAAE,QAAQ,CAAC,UAAU;YACtC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,YAAmC;QAClD,OAAO,IAAI,QAAQ,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE;YAClD,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YACnC,UAAU,EAAE,YAAY,CAAC,iBAAiB,IAAI,EAAE;YAChD,OAAO,EAAE,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,uBAAuB,CACrB,YAAmC,EACnC,gBAA0B;QAE1B,OAAO,IAAI,QAAQ,CACjB,YAAY,CAAC,IAAI,KAAK,SAAS;YAC7B,CAAC,CAAC,gBAAgB,CAAC,IAAI;YACvB,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAClC;YACE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YACnC,UAAU,EAAE,YAAY,CAAC,iBAAiB,IAAI,EAAE;YAChD,OAAO,EAAE,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC;SAC/C,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/edge/sim-aws-cf-edge-functions.d.ts

@@ -0,0 +1,44 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfEdgeFunctions } from "./sim-cf-edge-functions.js";
+/**
+ * The service principal Lambda@Edge runs a function's execution role as.
+ *
+ * A role for an ordinary function trusts `lambda.amazonaws.com` alone, and
+ * CloudFront refuses to associate that function. Adding this principal to the
+ * trust policy is the step people miss.
+ */
+export declare const simLambdaEdgeServicePrincipal = "edgelambda.amazonaws.com";
+/**
+ * The simulated Lambda functions of one simulated AWS instance, as Lambda@Edge
+ * targets.
+ */
+export declare class SimAwsCfEdgeFunctions implements SimCfEdgeFunctions {
+    private readonly simAws;
+    constructor(simAws: SimAws);
+    /**
+     * Check the function is there and that Lambda@Edge could run it.
+     */
+    assertAssociable(functionArn: string): Promise<void>;
+    /**
+     * Run the function for one edge event.
+     *
+     * The function is invoked directly rather than through an Invoke command,
+     * because real CloudFront runs the replica as the service rather than as
+     * whoever made the request, and because a handler that throws has to reach
+     * the request pipeline as a failure rather than as an invocation result.
+     */
+    invoke(functionArn: string, event: object): Promise<unknown>;
+    /**
+     * What this ARN names, refusing an ARN that names nothing here.
+     */
+    private target;
+    /**
+     * Refuse a function whose execution role Lambda@Edge could not assume.
+     *
+     * Whether a role can be assumed is IAM's own rule, so the decision is made
+     * by the shared service-role helper and CloudFront only says what it means
+     * here.
+     */
+    private assertExecutionRoleTrust;
+}
+//# sourceMappingURL=sim-aws-cf-edge-functions.d.ts.map

package/dist/service/cloudfront/edge/sim-aws-cf-edge-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-cf-edge-functions.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-aws-cf-edge-functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AASnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGrE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAOxE;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,kBAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAE/C;;OAEG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;IAED;;;;;;;OAOG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjE;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;IAcd;;;;;;OAMG;YACW,wBAAwB;CAcvC"}

package/dist/service/cloudfront/edge/sim-aws-cf-edge-functions.js

@@ -0,0 +1,87 @@
+import { assumeSimServiceRole, simServiceRoleTarget, } from "../../sts/service-role/sim-service-role.js";
+import { SimCloudFrontInvalidLambdaFunctionAssociation } from "../error/sim-cloudfront.error.js";
+import { edgeFunctionArnParts } from "./sim-cf-edge-function-arn.js";
+import { findSimCfEdgeFunctionVersion } from "./sim-cf-edge-function-version.js";
+/**
+ * The service principal Lambda@Edge runs a function's execution role as.
+ *
+ * A role for an ordinary function trusts `lambda.amazonaws.com` alone, and
+ * CloudFront refuses to associate that function. Adding this principal to the
+ * trust policy is the step people miss.
+ */
+export const simLambdaEdgeServicePrincipal = "edgelambda.amazonaws.com";
+/**
+ * The session name AWS gives a role Lambda@Edge assumes.
+ */
+const sessionName = "LambdaEdge";
+/**
+ * The simulated Lambda functions of one simulated AWS instance, as Lambda@Edge
+ * targets.
+ */
+export class SimAwsCfEdgeFunctions {
+    simAws;
+    constructor(simAws) {
+        this.simAws = simAws;
+    }
+    /**
+     * Check the function is there and that Lambda@Edge could run it.
+     */
+    async assertAssociable(functionArn) {
+        await this.assertExecutionRoleTrust(this.target(functionArn), functionArn);
+    }
+    /**
+     * Run the function for one edge event.
+     *
+     * The function is invoked directly rather than through an Invoke command,
+     * because real CloudFront runs the replica as the service rather than as
+     * whoever made the request, and because a handler that throws has to reach
+     * the request pipeline as a failure rather than as an invocation result.
+     */
+    async invoke(functionArn, event) {
+        return await this.target(functionArn).simFunction.invoke(event);
+    }
+    /**
+     * What this ARN names, refusing an ARN that names nothing here.
+     */
+    target(functionArn) {
+        const arn = edgeFunctionArnParts(functionArn);
+        const found = findSimCfEdgeFunctionVersion(this.simAws, arn);
+        if (found === undefined) {
+            throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront LambdaFunctionARN ${functionArn} names no simulated ` +
+                `Lambda function version`);
+        }
+        return found;
+    }
+    /**
+     * Refuse a function whose execution role Lambda@Edge could not assume.
+     *
+     * Whether a role can be assumed is IAM's own rule, so the decision is made
+     * by the shared service-role helper and CloudFront only says what it means
+     * here.
+     */
+    async assertExecutionRoleTrust(target, functionArn) {
+        const { accountId, regionName } = target.simFunction.accountRegionScope;
+        await assumeSimServiceRole({
+            target: simServiceRoleTarget(target.simFunction.roleArn),
+            servicePrincipal: simLambdaEdgeServicePrincipal,
+            sessionName,
+            iam: this.simAws.accountRegionScope(accountId, regionName).iam(),
+            refusals: executionRoleRefusals(functionArn),
+        });
+    }
+}
+/**
+ * What CloudFront says when a Lambda@Edge execution role is unusable.
+ */
+function executionRoleRefusals(functionArn) {
+    return {
+        missingRole: (target) => new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront Lambda@Edge function ${functionArn} has execution ` +
+            `role ${target.roleArn}, which is not a simulated IAM role`),
+        untrustedRole: (target, servicePrincipal) => new SimCloudFrontInvalidLambdaFunctionAssociation(`The trust policy of ${target.roleArn} does not allow ` +
+            `${servicePrincipal} to assume it, so Lambda@Edge could not run ` +
+            `${functionArn}. A Lambda@Edge execution role trusts both ` +
+            `lambda.amazonaws.com and ${servicePrincipal}. Add it to the ` +
+            `role's AssumeRolePolicyDocument.`),
+    };
+}
+//# sourceMappingURL=sim-aws-cf-edge-functions.js.map

package/dist/service/cloudfront/edge/sim-aws-cf-edge-functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-cf-edge-functions.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-aws-cf-edge-functions.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,6CAA6C,EAAE,MAAM,kCAAkC,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACH,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,KAAa;QAC7C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,WAAmB;QAChC,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,6CAA6C,CACrD,oCAAoC,WAAW,sBAAsB;gBACnE,yBAAyB,CAC5B,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,wBAAwB,CACpC,MAA+B,EAC/B,WAAmB;QAEnB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC;QAExE,MAAM,oBAAoB,CAAC;YACzB,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;YACxD,gBAAgB,EAAE,6BAA6B;YAC/C,WAAW;YACX,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE;YAChE,QAAQ,EAAE,qBAAqB,CAAC,WAAW,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,OAAO;QACL,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACtB,IAAI,6CAA6C,CAC/C,uCAAuC,WAAW,iBAAiB;YACjE,QAAQ,MAAM,CAAC,OAAO,qCAAqC,CAC9D;QACH,aAAa,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAC1C,IAAI,6CAA6C,CAC/C,uBAAuB,MAAM,CAAC,OAAO,kBAAkB;YACrD,GAAG,gBAAgB,8CAA8C;YACjE,GAAG,WAAW,6CAA6C;YAC3D,4BAA4B,gBAAgB,kBAAkB;YAC9D,kCAAkC,CACrC;KACJ,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.d.ts

@@ -0,0 +1,7 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+/**
+ * Check the caller may put this function version in front of a Distribution.
+ */
+export declare function authorizeEdgeAssociation(iam: SimIamInterServiceAuthZ, functionArn: string, caller?: SimAwsCaller): void;
+//# sourceMappingURL=sim-cf-edge-association-auth-z.d.ts.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-auth-z.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-auth-z.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAcnG;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,uBAAuB,EAC5B,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAYN"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.js

@@ -0,0 +1,27 @@
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+/**
+ * What a caller needs on the function version to put it in front of a
+ * Distribution.
+ *
+ * `GetFunction` is how CloudFront reads the code and configuration, and
+ * `EnableReplication` is what lets the replication service copy it out to the
+ * edge. A policy written the way the AWS docs write it grants
+ * `lambda:EnableReplication*`, which matches this.
+ */
+const associationActions = ["lambda:GetFunction", "lambda:EnableReplication"];
+/**
+ * Check the caller may put this function version in front of a Distribution.
+ */
+export function authorizeEdgeAssociation(iam, functionArn, caller) {
+    for (const action of associationActions) {
+        const decision = iam.authorize({ action, resource: functionArn, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource: functionArn,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-cf-edge-association-auth-z.js.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-auth-z.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-auth-z.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-auth-z.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,EAAE,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAA4B,EAC5B,WAAmB,EACnB,MAAqB;IAErB,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1E,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-checks.d.ts

@@ -0,0 +1,61 @@
+import type { SimCloudFrontCacheBehaviorConfig, SimCloudFrontDefaultCacheBehaviorConfig } from "../command/create-distribution/create-distribution.command.js";
+/**
+ * The checks a Lambda@Edge association needs that read the Behavior config
+ * alone, held apart from the validator that also reaches simulated Lambda and
+ * simulated IAM.
+ */
+/**
+ * The event types this simulation runs a Lambda@Edge function at, which are
+ * all four of CloudFront's own.
+ */
+export type SimulatedEdgeEventType = "viewer-request" | "origin-request" | "origin-response" | "viewer-response";
+type BehaviorConfig = SimCloudFrontDefaultCacheBehaviorConfig | SimCloudFrontCacheBehaviorConfig;
+/**
+ * Refuse an event type CloudFront has no such event for.
+ *
+ * All four of CloudFront's own event types run here, so what this catches is a
+ * name that is not one of them, rather than one this simulation has no hook
+ * for.
+ */
+export declare function assertSimulatedEventType(eventType: string | undefined): asserts eventType is SimulatedEdgeEventType;
+/**
+ * Whether this simulation runs a Lambda@Edge function at this event type.
+ */
+export declare function isSimulatedEdgeEventType(eventType: string | undefined): eventType is SimulatedEdgeEventType;
+/**
+ * Refuse an association reading a body at an event that carries none.
+ *
+ * `IncludeBody` is valid at `viewer-request` and `origin-request`, and
+ * CloudFront documents it that way. A response event runs once the request has
+ * been forwarded, and the event it builds carries no body for the flag to
+ * apply to.
+ */
+export declare function assertIncludableBody(eventType: SimulatedEdgeEventType, includeBody: boolean | undefined): void;
+/**
+ * Refuse a Behavior that runs both kinds of edge function at the viewer.
+ *
+ * CloudFront takes one function per event type, and it takes CloudFront
+ * Functions and Lambda@Edge together only where the Lambda@Edge function is on
+ * an origin event. A viewer-request CloudFront Function alongside a
+ * viewer-response Lambda@Edge function is refused too, which is the part of
+ * the rule that surprises people.
+ */
+export declare function assertNoViewerFunctionMix(behavior: BehaviorConfig): void;
+/**
+ * Refuse a Behavior associating two functions with one event type.
+ *
+ * CloudFront takes one edge function per event type. Two entries naming the
+ * same one would otherwise be configured last-wins, leaving a Distribution
+ * running a function the template did not put first.
+ */
+export declare function assertOneFunctionPerEvent(seen: Set<string>, eventType: string): void;
+/**
+ * Refuse an association with no function to run.
+ *
+ * `LambdaFunctionARN` is required on a real association. Left out, it has to
+ * be refused here, because the Behavior configurator reads it well after a
+ * Distribution ID has been allocated and the Distribution built.
+ */
+export declare function assertAssociatedFunctionArn(functionArn: string | undefined, eventType: string): asserts functionArn is string;
+export {};
+//# sourceMappingURL=sim-cf-edge-association-checks.d.ts.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-checks.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAGvE;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,CAAC;AAatB,KAAK,cAAc,GACf,uCAAuC,GACvC,gCAAgC,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAU7C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,SAAS,IAAI,sBAAsB,CAErC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,sBAAsB,EACjC,WAAW,EAAE,OAAO,GAAG,SAAS,GAC/B,IAAI,CAcN;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAmBxE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EACjB,SAAS,EAAE,MAAM,GAChB,IAAI,CAWN;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,IAAI,MAAM,CAS/B"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-checks.js

@@ -0,0 +1,106 @@
+import { SimCloudFrontInvalidLambdaFunctionAssociation } from "../error/sim-cloudfront.error.js";
+/**
+ * The same event types to match a name against, in the order a request meets
+ * them.
+ */
+const simulatedEdgeEventTypes = new Set([
+    "viewer-request",
+    "origin-request",
+    "origin-response",
+    "viewer-response",
+]);
+/**
+ * Refuse an event type CloudFront has no such event for.
+ *
+ * All four of CloudFront's own event types run here, so what this catches is a
+ * name that is not one of them, rather than one this simulation has no hook
+ * for.
+ */
+export function assertSimulatedEventType(eventType) {
+    if (isSimulatedEdgeEventType(eventType)) {
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront Lambda@Edge association EventType ${eventType} is not a ` +
+        `CloudFront event type. A Lambda@Edge function runs at viewer-request, ` +
+        `origin-request, origin-response or viewer-response.`);
+}
+/**
+ * Whether this simulation runs a Lambda@Edge function at this event type.
+ */
+export function isSimulatedEdgeEventType(eventType) {
+    return eventType !== undefined && simulatedEdgeEventTypes.has(eventType);
+}
+/**
+ * Refuse an association reading a body at an event that carries none.
+ *
+ * `IncludeBody` is valid at `viewer-request` and `origin-request`, and
+ * CloudFront documents it that way. A response event runs once the request has
+ * been forwarded, and the event it builds carries no body for the flag to
+ * apply to.
+ */
+export function assertIncludableBody(eventType, includeBody) {
+    if (includeBody !== true) {
+        return;
+    }
+    if (eventType === "viewer-request" || eventType === "origin-request") {
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront Lambda@Edge association for ${eventType} sets ` +
+        `IncludeBody. CloudFront takes IncludeBody at viewer-request and ` +
+        `origin-request, the events that carry a request body.`);
+}
+/**
+ * Refuse a Behavior that runs both kinds of edge function at the viewer.
+ *
+ * CloudFront takes one function per event type, and it takes CloudFront
+ * Functions and Lambda@Edge together only where the Lambda@Edge function is on
+ * an origin event. A viewer-request CloudFront Function alongside a
+ * viewer-response Lambda@Edge function is refused too, which is the part of
+ * the rule that surprises people.
+ */
+export function assertNoViewerFunctionMix(behavior) {
+    const cffEvents = (behavior.FunctionAssociations?.Items ?? [])
+        .map((association) => association.EventType)
+        .filter((eventType) => eventType?.startsWith("viewer-") === true);
+    const edgeEvents = (behavior.LambdaFunctionAssociations?.Items ?? [])
+        .map((association) => association.EventType)
+        .filter((eventType) => eventType?.startsWith("viewer-") === true);
+    if (cffEvents.length === 0 || edgeEvents.length === 0) {
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront cache Behavior associates CloudFront Function ` +
+        `${cffEvents.join(", ")} and Lambda@Edge ${edgeEvents.join(", ")}. ` +
+        `CloudFront does not combine the two kinds of edge function at the ` +
+        `viewer events, whether or not they are on the same event type.`);
+}
+/**
+ * Refuse a Behavior associating two functions with one event type.
+ *
+ * CloudFront takes one edge function per event type. Two entries naming the
+ * same one would otherwise be configured last-wins, leaving a Distribution
+ * running a function the template did not put first.
+ */
+export function assertOneFunctionPerEvent(seen, eventType) {
+    if (!seen.has(eventType)) {
+        seen.add(eventType);
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront cache Behavior associates more than one Lambda@Edge ` +
+        `function with ${eventType}. CloudFront takes one edge function per ` +
+        `event type.`);
+}
+/**
+ * Refuse an association with no function to run.
+ *
+ * `LambdaFunctionARN` is required on a real association. Left out, it has to
+ * be refused here, because the Behavior configurator reads it well after a
+ * Distribution ID has been allocated and the Distribution built.
+ */
+export function assertAssociatedFunctionArn(functionArn, eventType) {
+    if (functionArn !== undefined) {
+        return;
+    }
+    throw new SimCloudFrontInvalidLambdaFunctionAssociation(`Sim CloudFront Lambda@Edge association for ${eventType} has no ` +
+        `LambdaFunctionARN`);
+}
+//# sourceMappingURL=sim-cf-edge-association-checks.js.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-checks.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-checks.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6CAA6C,EAAE,MAAM,kCAAkC,CAAC;AAkBjG;;;GAGG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;CACiB,CAAC,CAAC;AAMtC;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAA6B;IAE7B,IAAI,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,oDAAoD,SAAS,YAAY;QACvE,wEAAwE;QACxE,qDAAqD,CACxD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAA6B;IAE7B,OAAO,SAAS,KAAK,SAAS,IAAI,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiC,EACjC,WAAgC;IAEhC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,IAAI,SAAS,KAAK,gBAAgB,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,8CAA8C,SAAS,QAAQ;QAC7D,kEAAkE;QAClE,uDAAuD,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAwB;IAChE,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;SAC3C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;IAEpE,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC;SAClE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;SAC3C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;IAEpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,+DAA+D;QAC7D,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpE,oEAAoE;QACpE,gEAAgE,CACnE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,qEAAqE;QACnE,iBAAiB,SAAS,2CAA2C;QACrE,aAAa,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAA+B,EAC/B,SAAiB;IAEjB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,6CAA6C,CACrD,8CAA8C,SAAS,UAAU;QAC/D,mBAAmB,CACtB,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-validator.d.ts

@@ -0,0 +1,36 @@
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimCloudFrontDistributionConfig } from "../command/create-distribution/create-distribution.command.js";
+import type { SimCfEdgeFunctions } from "./sim-cf-edge-functions.js";
+interface SimCfEdgeAssociationValidatorProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly edgeFunctions?: SimCfEdgeFunctions | undefined;
+}
+/**
+ * Checks the Lambda@Edge associations a DistributionConfig asks for.
+ *
+ * Real CloudFront refuses all of these when the Distribution is written rather
+ * than when a request arrives, and that is the point of doing it here. An
+ * association CloudFront would have refused otherwise turns into a test that
+ * passes with the edge function never running.
+ *
+ * With no edge functions collaborator there is no simulated Lambda to look
+ * anything up in, as in a standalone `SimCloudFront`, so the ARN itself is
+ * still checked and the function behind it is not.
+ */
+export declare class SimCfEdgeAssociationValidator {
+    private readonly iam;
+    private readonly edgeFunctions;
+    constructor(properties: SimCfEdgeAssociationValidatorProperties);
+    /**
+     * Validate every Behavior of a DistributionConfig.
+     */
+    validate(distributionConfig: SimCloudFrontDistributionConfig, caller?: SimAwsCaller): Promise<void>;
+    /**
+     * Check what one Behavior's config says, answering with the function ARNs it
+     * associates.
+     */
+    private checkBehavior;
+}
+export {};
+//# sourceMappingURL=sim-cf-edge-association-validator.d.ts.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-validator.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,KAAK,EAGV,+BAA+B,EAChC,MAAM,+DAA+D,CAAC;AAUvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAE/D,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;OAEG;IACG,QAAQ,CACZ,kBAAkB,EAAE,+BAA+B,EACnD,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAqBf;IAED;;;OAGG;IACH,OAAO,CAAC,aAAa;CAkCtB"}

package/dist/service/cloudfront/edge/sim-cf-edge-association-validator.js

@@ -0,0 +1,80 @@
+import { authorizeEdgeAssociation } from "./sim-cf-edge-association-auth-z.js";
+import { assertAssociatedFunctionArn, assertIncludableBody, assertNoViewerFunctionMix, assertOneFunctionPerEvent, assertSimulatedEventType, } from "./sim-cf-edge-association-checks.js";
+import { edgeFunctionArnParts } from "./sim-cf-edge-function-arn.js";
+/**
+ * Checks the Lambda@Edge associations a DistributionConfig asks for.
+ *
+ * Real CloudFront refuses all of these when the Distribution is written rather
+ * than when a request arrives, and that is the point of doing it here. An
+ * association CloudFront would have refused otherwise turns into a test that
+ * passes with the edge function never running.
+ *
+ * With no edge functions collaborator there is no simulated Lambda to look
+ * anything up in, as in a standalone `SimCloudFront`, so the ARN itself is
+ * still checked and the function behind it is not.
+ */
+export class SimCfEdgeAssociationValidator {
+    iam;
+    edgeFunctions;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.edgeFunctions = properties.edgeFunctions;
+    }
+    /**
+     * Validate every Behavior of a DistributionConfig.
+     */
+    async validate(distributionConfig, caller) {
+        const associated = [];
+        for (const behavior of behaviors(distributionConfig)) {
+            associated.push(...this.checkBehavior(behavior, caller));
+        }
+        const edgeFunctions = this.edgeFunctions;
+        if (edgeFunctions === undefined) {
+            return;
+        }
+        // Every check above reads the config alone. Reaching the function behind
+        // each ARN is the only part that waits on anything, and one Behavior's
+        // functions have nothing to say about another's.
+        await Promise.all(associated.map(async (functionArn) => {
+            await edgeFunctions.assertAssociable(functionArn);
+        }));
+    }
+    /**
+     * Check what one Behavior's config says, answering with the function ARNs it
+     * associates.
+     */
+    checkBehavior(behavior, caller) {
+        const associations = behavior.LambdaFunctionAssociations?.Items ?? [];
+        if (associations.length === 0) {
+            return [];
+        }
+        assertNoViewerFunctionMix(behavior);
+        const functionArns = [];
+        const eventTypes = new Set();
+        for (const association of associations) {
+            const { EventType, IncludeBody, LambdaFunctionARN } = association;
+            assertSimulatedEventType(EventType);
+            assertOneFunctionPerEvent(eventTypes, EventType);
+            assertAssociatedFunctionArn(LambdaFunctionARN, EventType);
+            assertIncludableBody(EventType, IncludeBody);
+            // Read for the refusals reading it produces. The parts themselves
+            // matter only where the function behind the ARN is looked up.
+            edgeFunctionArnParts(LambdaFunctionARN);
+            authorizeEdgeAssociation(this.iam, LambdaFunctionARN, caller);
+            functionArns.push(LambdaFunctionARN);
+        }
+        return functionArns;
+    }
+}
+/**
+ * Every Behavior a DistributionConfig describes, default one first.
+ */
+function behaviors(distributionConfig) {
+    return [
+        ...(distributionConfig.DefaultCacheBehavior === undefined
+            ? []
+            : [distributionConfig.DefaultCacheBehavior]),
+        ...(distributionConfig.CacheBehaviors?.Items ?? []),
+    ];
+}
+//# sourceMappingURL=sim-cf-edge-association-validator.js.map

package/dist/service/cloudfront/edge/sim-cf-edge-association-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association-validator.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association-validator.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,6BAA6B;IACvB,GAAG,CAA0B;IAC7B,aAAa,CAAiC;IAE/D,YAAY,UAAmD;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,kBAAmD,EACnD,MAAqB;QAErB,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QAEzC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,iDAAiD;QACjD,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACnC,MAAM,aAAa,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,aAAa,CACnB,QAEoC,EACpC,MAAqB;QAErB,MAAM,YAAY,GAAG,QAAQ,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC;QAEtE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,WAAW,CAAC;YAElE,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACpC,yBAAyB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACjD,2BAA2B,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;YAC1D,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAE7C,kEAAkE;YAClE,8DAA8D;YAC9D,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;YACxC,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC9D,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;CACF;AAED;;GAEG;AACH,SAAS,SAAS,CAChB,kBAAmD;IAKnD,OAAO;QACL,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QAC9C,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/edge/sim-cf-edge-association.d.ts

@@ -0,0 +1,26 @@
+import type { SimArn } from "../../aws/arn.js";
+/**
+ * One Lambda@Edge function a cache Behavior runs, and how it is invoked.
+ *
+ * The ARN is a qualified one naming a published version, which is the only
+ * thing CloudFront accepts. `includeBody` decides whether the event carries
+ * the request body, and it is false unless the association asked for it.
+ */
+export interface SimCfEdgeAssociation {
+    readonly functionArn: SimArn;
+    readonly includeBody: boolean;
+}
+/**
+ * The Lambda@Edge functions one cache Behavior runs, by event type.
+ *
+ * All four of CloudFront's events are here, in the order a request meets them:
+ * the two viewer events at the edge, and the two origin events either side of
+ * the Origin fetch.
+ */
+export interface SimCfEdgeAssociations {
+    readonly viewerRequest?: SimCfEdgeAssociation;
+    readonly originRequest?: SimCfEdgeAssociation;
+    readonly originResponse?: SimCfEdgeAssociation;
+    readonly viewerResponse?: SimCfEdgeAssociation;
+}
+//# sourceMappingURL=sim-cf-edge-association.d.ts.map

package/dist/service/cloudfront/edge/sim-cf-edge-association.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;CAChD"}

package/dist/service/cloudfront/edge/sim-cf-edge-association.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-cf-edge-association.js.map

package/dist/service/cloudfront/edge/sim-cf-edge-association.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-association.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-association.ts"],"names":[],"mappings":""}

package/dist/service/cloudfront/edge/sim-cf-edge-associations-configure.d.ts

@@ -0,0 +1,14 @@
+import type { SimCloudFrontCacheBehaviorConfig, SimCloudFrontDefaultCacheBehaviorConfig } from "../command/create-distribution/create-distribution.command.js";
+import type { SimCfEdgeAssociations } from "./sim-cf-edge-association.js";
+/**
+ * Configure the Lambda@Edge associations of one cache Behavior.
+ *
+ * Returns undefined where the Behavior associates none. A Behavior without an
+ * edge function carries no empty object describing that.
+ *
+ * All four event types are mapped. An event type CloudFront has no such event
+ * for has already been refused by `SimCfEdgeAssociationValidator`, which runs
+ * before any Distribution state is touched.
+ */
+export declare function configureEdgeAssociations(cacheBehavior: SimCloudFrontDefaultCacheBehaviorConfig | SimCloudFrontCacheBehaviorConfig): SimCfEdgeAssociations | undefined;
+//# sourceMappingURL=sim-cf-edge-associations-configure.d.ts.map

package/dist/service/cloudfront/edge/sim-cf-edge-associations-configure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-edge-associations-configure.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/edge/sim-cf-edge-associations-configure.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AACvE,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,aAAa,EACT,uCAAuC,GACvC,gCAAgC,GACnC,qBAAqB,GAAG,SAAS,CA8BnC"}