@kensio/yulin 1.20.15 → 1.20.17

package/dist/service/cloudfront/command/function/sim-cf-function-access.d.ts

@@ -0,0 +1,48 @@
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimCloudFrontFunctionStage } from "../../cff/sim-cff-stage.js";
+import type { SimCloudFrontFunction } from "../../cff/sim-cloudfront-function.js";
+import type { SimCloudFrontFunctionMap } from "../create-function/create-function.handler.js";
+interface SimCfFunctionAccessProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly cloudFrontFunctions: SimCloudFrontFunctionMap;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * What every command reading a Function back needs: the Functions, IAM, and
+ * the clock.
+ *
+ * ListFunctions, DescribeFunction and GetFunction authorize the same way and
+ * resolve a Function the same way, so the wiring is here once rather than in
+ * each of them. Each command class is then only its own AWS behaviour.
+ */
+export declare class SimCfFunctionAccess {
+    readonly cloudFrontFunctions: SimCloudFrontFunctionMap;
+    readonly background: BackgroundScheduler;
+    private readonly accountId;
+    private readonly iam;
+    constructor(properties: SimCfFunctionAccessProperties);
+    /**
+     * Ensure the caller may take an action on a Function ARN.
+     */
+    authorize(action: string, resource: string, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may take an action on any Function in the Account.
+     *
+     * ListFunctions names no Function, so a policy granting it has to use the
+     * wildcard, and this is what it is authorized against.
+     */
+    authorizeAnyFunction(action: string, caller?: SimAwsCaller): void;
+    /**
+     * Resolve a Function in a stage, having authorized the action against it.
+     *
+     * The ARN is built from the name the caller gave, so authorization happens
+     * before the Function map is read and an unauthorized caller is refused
+     * whether or not the name resolves.
+     */
+    authorizedByName(action: string, functionName: string, stage: SimCloudFrontFunctionStage, caller?: SimAwsCaller): SimCloudFrontFunction;
+}
+export {};

package/dist/service/cloudfront/command/function/sim-cf-function-access.js

@@ -0,0 +1,48 @@
+import { simCfAuthorize } from "../../sim-cf-authorize.js";
+import { simCfFunctionInStage } from "./sim-cf-function-lookup.js";
+/**
+ * What every command reading a Function back needs: the Functions, IAM, and
+ * the clock.
+ *
+ * ListFunctions, DescribeFunction and GetFunction authorize the same way and
+ * resolve a Function the same way, so the wiring is here once rather than in
+ * each of them. Each command class is then only its own AWS behaviour.
+ */
+export class SimCfFunctionAccess {
+    cloudFrontFunctions;
+    background;
+    accountId;
+    iam;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.cloudFrontFunctions = properties.cloudFrontFunctions;
+        this.iam = properties.iam;
+        this.background = properties.background;
+    }
+    /**
+     * Ensure the caller may take an action on a Function ARN.
+     */
+    authorize(action, resource, caller) {
+        simCfAuthorize({ iam: this.iam, action, resource, caller });
+    }
+    /**
+     * Ensure the caller may take an action on any Function in the Account.
+     *
+     * ListFunctions names no Function, so a policy granting it has to use the
+     * wildcard, and this is what it is authorized against.
+     */
+    authorizeAnyFunction(action, caller) {
+        this.authorize(action, `arn:aws:cloudfront::${this.accountId}:function/*`, caller);
+    }
+    /**
+     * Resolve a Function in a stage, having authorized the action against it.
+     *
+     * The ARN is built from the name the caller gave, so authorization happens
+     * before the Function map is read and an unauthorized caller is refused
+     * whether or not the name resolves.
+     */
+    authorizedByName(action, functionName, stage, caller) {
+        this.authorize(action, `arn:aws:cloudfront::${this.accountId}:function/${functionName}`, caller);
+        return simCfFunctionInStage(this.cloudFrontFunctions, functionName, stage);
+    }
+}

package/dist/service/cloudfront/command/function/sim-cf-function-command.types.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Structural types for the commands that read a CloudFront Function back.
+ *
+ * ListFunctions, DescribeFunction and GetFunction all address a Function by
+ * name and a stage, and answer with the same summary shape, so their types are
+ * together here rather than one file each.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/
+ */
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimCloudFrontFunctionRuntime } from "../../cff/sim-cff-configuration.js";
+import type { SimCloudFrontFunctionStage } from "../../cff/sim-cff-stage.js";
+/**
+ * Minimal structural sim CloudFront Function config.
+ */
+export interface SimCfFunctionConfig {
+    Comment: string;
+    Runtime: SimCloudFrontFunctionRuntime;
+    KeyValueStoreAssociations?: {
+        Quantity: number;
+        Items: {
+            KeyValueStoreARN: SimArn;
+        }[];
+    };
+}
+/**
+ * Minimal structural sim CloudFront Function metadata.
+ */
+export interface SimCfFunctionMetadata {
+    FunctionARN: SimArn;
+    Stage: SimCloudFrontFunctionStage;
+    CreatedTime: Date;
+    LastModifiedTime: Date;
+}
+/**
+ * Minimal structural sim CloudFront Function summary.
+ */
+export interface SimCfFunctionSummary {
+    Name: string;
+    Status: string;
+    FunctionConfig: SimCfFunctionConfig;
+    FunctionMetadata: SimCfFunctionMetadata;
+}
+/**
+ * Minimal structural sim CloudFront ListFunctions command.
+ */
+export interface SimListFunctionsCommand {
+    readonly input: {
+        readonly Stage?: string | undefined;
+    };
+}
+/**
+ * Minimal structural sim CloudFront ListFunctions output.
+ */
+export interface SimListFunctionsCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+    FunctionList: {
+        Quantity: number;
+        Items: SimCfFunctionSummary[];
+    };
+}
+/**
+ * Minimal structural sim CloudFront DescribeFunction command.
+ */
+export interface SimDescribeFunctionCommand {
+    readonly input: {
+        readonly Name?: string | undefined;
+        readonly Stage?: string | undefined;
+    };
+}
+/**
+ * Minimal structural sim CloudFront DescribeFunction output.
+ */
+export interface SimDescribeFunctionCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+    FunctionSummary: SimCfFunctionSummary;
+    ETag: string;
+}
+/**
+ * Minimal structural sim CloudFront GetFunction command.
+ */
+export interface SimGetFunctionCommand {
+    readonly input: {
+        readonly Name?: string | undefined;
+        readonly Stage?: string | undefined;
+    };
+}
+/**
+ * Minimal structural sim CloudFront GetFunction output.
+ */
+export interface SimGetFunctionCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+    FunctionCode: Uint8Array;
+    ETag: string;
+    ContentType: string;
+}

package/dist/service/cloudfront/command/function/sim-cf-function-command.types.js

@@ -0,0 +1,10 @@
+/**
+ * Structural types for the commands that read a CloudFront Function back.
+ *
+ * ListFunctions, DescribeFunction and GetFunction all address a Function by
+ * name and a stage, and answer with the same summary shape, so their types are
+ * together here rather than one file each.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/
+ */
+export {};

package/dist/service/cloudfront/command/function/sim-cf-function-lookup.d.ts

@@ -0,0 +1,12 @@
+import { type SimCloudFrontFunctionStage } from "../../cff/sim-cff-stage.js";
+import type { SimCloudFrontFunction } from "../../cff/sim-cloudfront-function.js";
+import type { SimCloudFrontFunctionMap } from "../create-function/create-function.handler.js";
+/**
+ * Resolve a Function a stage can be read from.
+ *
+ * A name the Account holds no Function under is refused, and so is one whose
+ * Function has not reached the stage asked for. Both answer with
+ * NoSuchFunctionExists. That is what CloudFront answers when a stage holds
+ * nothing under the name asked for.
+ */
+export declare function simCfFunctionInStage(cloudFrontFunctions: SimCloudFrontFunctionMap, functionName: string, stage: SimCloudFrontFunctionStage): SimCloudFrontFunction;

package/dist/service/cloudfront/command/function/sim-cf-function-lookup.js

@@ -0,0 +1,21 @@
+import { simCffInStage, } from "../../cff/sim-cff-stage.js";
+import { SimCloudFrontNoSuchFunctionExists } from "../../error/sim-cloudfront.error.js";
+/**
+ * Resolve a Function a stage can be read from.
+ *
+ * A name the Account holds no Function under is refused, and so is one whose
+ * Function has not reached the stage asked for. Both answer with
+ * NoSuchFunctionExists. That is what CloudFront answers when a stage holds
+ * nothing under the name asked for.
+ */
+export function simCfFunctionInStage(cloudFrontFunctions, functionName, stage) {
+    const cloudFrontFunction = cloudFrontFunctions.get(functionName);
+    if (cloudFrontFunction === undefined) {
+        throw new SimCloudFrontNoSuchFunctionExists(`No sim CloudFront Function named ${functionName}`);
+    }
+    if (!simCffInStage(cloudFrontFunction, stage)) {
+        throw new SimCloudFrontNoSuchFunctionExists(`Sim CloudFront Function ${functionName} has not been published, so it ` +
+            `is in DEVELOPMENT and not in ${stage}`);
+    }
+    return cloudFrontFunction;
+}

package/dist/service/cloudfront/command/function/sim-cf-function-summary.d.ts

@@ -0,0 +1,11 @@
+import type { SimCloudFrontFunctionStage } from "../../cff/sim-cff-stage.js";
+import type { SimCloudFrontFunction } from "../../cff/sim-cloudfront-function.js";
+import type { SimCfFunctionSummary } from "./sim-cf-function-command.types.js";
+/**
+ * Describe a Function the way ListFunctions and DescribeFunction both do.
+ *
+ * The stage comes from the request rather than the Function, because a
+ * published Function is in both stages and answers under whichever one was
+ * asked for.
+ */
+export declare function simCfFunctionSummary(cloudFrontFunction: SimCloudFrontFunction, stage: SimCloudFrontFunctionStage): SimCfFunctionSummary;

package/dist/service/cloudfront/command/function/sim-cf-function-summary.js

@@ -0,0 +1,30 @@
+/**
+ * Describe a Function the way ListFunctions and DescribeFunction both do.
+ *
+ * The stage comes from the request rather than the Function, because a
+ * published Function is in both stages and answers under whichever one was
+ * asked for.
+ */
+export function simCfFunctionSummary(cloudFrontFunction, stage) {
+    const keyValueStore = cloudFrontFunction.keyValueStore;
+    return {
+        Name: cloudFrontFunction.name,
+        Status: cloudFrontFunction.status,
+        FunctionConfig: {
+            Comment: cloudFrontFunction.config.comment,
+            Runtime: cloudFrontFunction.config.runtime,
+            ...(keyValueStore !== undefined && {
+                KeyValueStoreAssociations: {
+                    Quantity: 1,
+                    Items: [{ KeyValueStoreARN: keyValueStore.arn }],
+                },
+            }),
+        },
+        FunctionMetadata: {
+            FunctionARN: cloudFrontFunction.arn,
+            Stage: stage,
+            CreatedTime: cloudFrontFunction.config.createdTime,
+            LastModifiedTime: cloudFrontFunction.config.lastModifiedTime,
+        },
+    };
+}

package/dist/service/cloudfront/command/function/sim-cf-get-function.d.ts

@@ -0,0 +1,23 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfFunctionAccess } from "./sim-cf-function-access.js";
+import type { SimGetFunctionCommand, SimGetFunctionCommandOutput } from "./sim-cf-function-command.types.js";
+/**
+ * Simulated CloudFront GetFunction command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/GetFunctionCommand/
+ */
+export declare class SimCfGetFunction {
+    private readonly access;
+    private static readonly action;
+    constructor(access: SimCfFunctionAccess);
+    /**
+     * Get one sim CloudFront Function's code.
+     *
+     * A Function created from source answers with the source it was given. One
+     * created from a handler function reference has no uploaded source, and
+     * answers with that handler's own source text. That is the code it runs.
+     */
+    handle(command: SimGetFunctionCommand, options?: {
+        readonly caller?: SimAwsCaller;
+    }): Promise<SimGetFunctionCommandOutput>;
+}

package/dist/service/cloudfront/command/function/sim-cf-get-function.js

@@ -0,0 +1,33 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCffRequestedStage } from "../../cff/sim-cff-stage.js";
+/**
+ * Simulated CloudFront GetFunction command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/GetFunctionCommand/
+ */
+export class SimCfGetFunction {
+    access;
+    static action = "cloudfront:GetFunction";
+    constructor(access) {
+        this.access = access;
+    }
+    /**
+     * Get one sim CloudFront Function's code.
+     *
+     * A Function created from source answers with the source it was given. One
+     * created from a handler function reference has no uploaded source, and
+     * answers with that handler's own source text. That is the code it runs.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Name, "GetFunctionCommand.input.Name");
+        const stage = simCffRequestedStage(command.input.Stage);
+        await this.access.background.sequence();
+        const cloudFrontFunction = this.access.authorizedByName(SimCfGetFunction.action, command.input.Name, stage, options?.caller);
+        return {
+            $metadata: {},
+            FunctionCode: cloudFrontFunction.config.functionCode,
+            ETag: cloudFrontFunction.config.etag,
+            ContentType: "application/octet-stream",
+        };
+    }
+}

package/dist/service/cloudfront/command/function/sim-cf-list-functions.d.ts

@@ -0,0 +1,22 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfFunctionAccess } from "./sim-cf-function-access.js";
+import type { SimListFunctionsCommand, SimListFunctionsCommandOutput } from "./sim-cf-function-command.types.js";
+/**
+ * Simulated CloudFront ListFunctions command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/ListFunctionsCommand/
+ */
+export declare class SimCfListFunctions {
+    private readonly access;
+    private static readonly action;
+    constructor(access: SimCfFunctionAccess);
+    /**
+     * List this Account's sim CloudFront Functions in one stage.
+     *
+     * The whole list comes back. `Marker` and `MaxItems` are the paging every
+     * other simulated listing leaves out, so there is no `NextMarker` either.
+     */
+    handle(command: SimListFunctionsCommand, options?: {
+        readonly caller?: SimAwsCaller;
+    }): Promise<SimListFunctionsCommandOutput>;
+}

package/dist/service/cloudfront/command/function/sim-cf-list-functions.js

@@ -0,0 +1,38 @@
+import { simCffInStage, simCffRequestedStage, } from "../../cff/sim-cff-stage.js";
+import { simCfFunctionSummary } from "./sim-cf-function-summary.js";
+/**
+ * Simulated CloudFront ListFunctions command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/ListFunctionsCommand/
+ */
+export class SimCfListFunctions {
+    access;
+    static action = "cloudfront:ListFunctions";
+    constructor(access) {
+        this.access = access;
+    }
+    /**
+     * List this Account's sim CloudFront Functions in one stage.
+     *
+     * The whole list comes back. `Marker` and `MaxItems` are the paging every
+     * other simulated listing leaves out, so there is no `NextMarker` either.
+     */
+    async handle(command, options) {
+        const stage = simCffRequestedStage(command.input.Stage);
+        await this.access.background.sequence();
+        // Listing is authorized across the Account rather than per Function, which
+        // is what a policy for this action grants.
+        this.access.authorizeAnyFunction(SimCfListFunctions.action, options?.caller);
+        const cloudFrontFunctions = this.access.cloudFrontFunctions
+            .values()
+            .filter((cloudFrontFunction) => simCffInStage(cloudFrontFunction, stage))
+            .toArray();
+        return {
+            $metadata: {},
+            FunctionList: {
+                Quantity: cloudFrontFunctions.length,
+                Items: cloudFrontFunctions.map((cloudFrontFunction) => simCfFunctionSummary(cloudFrontFunction, stage)),
+            },
+        };
+    }
+}

package/dist/service/cloudfront/command/update-distribution/update-distribution.handler.d.ts

@@ -10,6 +10,7 @@ import type { SimCfCustomOriginDispatcher } from "../../origin/custom/sim-cf-cus
 import type { SimCloudFrontS3OriginResolver } from "../../origin/s3/sim-cloudfront-s3-origin.js";
 import type { SimCloudFrontOriginAccessControlRegistry } from "../../origin-access-control/sim-cf-origin-access-control-registry.js";
 import type { SimCloudFrontResponseHeadersPolicyRegistry } from "../../response-headers-policy/sim-cf-response-headers-policy-registry.js";
+import type { SimCloudFrontCachePolicyRegistry } from "../../cache-policy/sim-cf-cache-policy-registry.js";
 import type { SimCfWebAclResolver } from "../../web-acl/sim-cf-web-acl.js";
 import type { SimCloudFrontRegistry } from "../../registry/sim-cloud-front-registry.js";
 import type { SimUpdateDistributionCommand, SimUpdateDistributionCommandOutput } from "./update-distribution.command.js";
@@ -21,6 +22,7 @@ interface UpdateDistributionCommandHandlerProperties {
     readonly customOriginDispatcher?: SimCfCustomOriginDispatcher | undefined;
     readonly originAccessControls: SimCloudFrontOriginAccessControlRegistry;
     readonly responseHeadersPolicies: SimCloudFrontResponseHeadersPolicyRegistry;
+    readonly cachePolicies: SimCloudFrontCachePolicyRegistry;
     readonly webAclResolver?: SimCfWebAclResolver | undefined;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly acmRegistry?: SimAcmRegistry | undefined;

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-cache-policy.d.ts

@@ -0,0 +1,18 @@
+import type { SimCloudFrontCachePolicyRegistry } from "../../cache-policy/sim-cf-cache-policy-registry.js";
+/**
+ * Refuses a Cache Behavior naming a cache policy this simulation does not
+ * hold.
+ *
+ * Real CloudFront checks this when the Distribution is created or updated, so
+ * a template naming a mistyped policy ID fails the deploy there too, rather
+ * than deploying successfully and only failing the first request that reaches
+ * the Behavior.
+ */
+export declare class SimCfBehaviorCachePolicy {
+    private readonly policies;
+    constructor(policies: SimCloudFrontCachePolicyRegistry);
+    /**
+     * Refuse one Behavior naming a policy which is not there.
+     */
+    assertExists(targetOriginId: string | undefined, cachePolicyId: string | undefined): void;
+}

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-cache-policy.js

@@ -0,0 +1,30 @@
+import { SimCloudFrontNoSuchCachePolicy } from "../../error/sim-cloudfront.error.js";
+/**
+ * Refuses a Cache Behavior naming a cache policy this simulation does not
+ * hold.
+ *
+ * Real CloudFront checks this when the Distribution is created or updated, so
+ * a template naming a mistyped policy ID fails the deploy there too, rather
+ * than deploying successfully and only failing the first request that reaches
+ * the Behavior.
+ */
+export class SimCfBehaviorCachePolicy {
+    policies;
+    constructor(policies) {
+        this.policies = policies;
+    }
+    /**
+     * Refuse one Behavior naming a policy which is not there.
+     */
+    assertExists(targetOriginId, cachePolicyId) {
+        if (cachePolicyId === undefined ||
+            this.policies.byId(cachePolicyId) !== undefined) {
+            return;
+        }
+        throw new SimCloudFrontNoSuchCachePolicy(`Sim CloudFront Behavior for Origin ${targetOriginId} names cache ` +
+            `policy ${cachePolicyId}, which does not exist. A Behavior names one ` +
+            `of CloudFront's seven managed policies, or a policy an ` +
+            `AWS::CloudFront::CachePolicy Resource created in this simulation. A ` +
+            `policy ID from a real account is neither.`);
+    }
+}

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-policies.d.ts

@@ -0,0 +1,28 @@
+import type { SimCloudFrontCacheBehaviorConfig, SimCloudFrontDefaultCacheBehaviorConfig, SimCloudFrontDistributionConfig } from "../../command/create-distribution/create-distribution.command.js";
+import type { SimCfBehaviorCachePolicy } from "./sim-cf-behavior-cache-policy.js";
+import type { SimCfBehaviorResponseHeadersPolicy } from "./sim-cf-behavior-response-headers-policy.js";
+/**
+ * The policies a Cache Behavior names, and whether this simulation holds them.
+ *
+ * A Behavior points at a response headers policy and a cache policy by ID, and
+ * both live outside the Distribution. Each one is checked the same way and at
+ * the same moment, so they are asked together.
+ */
+export declare class SimCfBehaviorPolicies {
+    private readonly responseHeadersPolicy;
+    private readonly cachePolicy;
+    constructor(responseHeadersPolicy: SimCfBehaviorResponseHeadersPolicy, cachePolicy: SimCfBehaviorCachePolicy);
+    /**
+     * Refuse every Behavior of a DistributionConfig that names a policy which is
+     * not there, without touching the Distribution.
+     *
+     * An update replaces a Distribution's whole configuration, so this runs
+     * before any of it is torn down. A refusal here leaves the Distribution
+     * serving exactly what it served before, rather than half replaced.
+     */
+    assertAllExist(distributionConfig: SimCloudFrontDistributionConfig): void;
+    /**
+     * Refuse one Behavior naming a policy of either kind which is not there.
+     */
+    assertExists(behavior: SimCloudFrontDefaultCacheBehaviorConfig | SimCloudFrontCacheBehaviorConfig): void;
+}

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-policies.js

@@ -0,0 +1,41 @@
+/**
+ * The policies a Cache Behavior names, and whether this simulation holds them.
+ *
+ * A Behavior points at a response headers policy and a cache policy by ID, and
+ * both live outside the Distribution. Each one is checked the same way and at
+ * the same moment, so they are asked together.
+ */
+export class SimCfBehaviorPolicies {
+    responseHeadersPolicy;
+    cachePolicy;
+    constructor(responseHeadersPolicy, cachePolicy) {
+        this.responseHeadersPolicy = responseHeadersPolicy;
+        this.cachePolicy = cachePolicy;
+    }
+    /**
+     * Refuse every Behavior of a DistributionConfig that names a policy which is
+     * not there, without touching the Distribution.
+     *
+     * An update replaces a Distribution's whole configuration, so this runs
+     * before any of it is torn down. A refusal here leaves the Distribution
+     * serving exactly what it served before, rather than half replaced.
+     */
+    assertAllExist(distributionConfig) {
+        const behaviors = [
+            distributionConfig.DefaultCacheBehavior,
+            ...(distributionConfig.CacheBehaviors?.Items ?? []),
+        ];
+        for (const behavior of behaviors) {
+            if (behavior !== undefined) {
+                this.assertExists(behavior);
+            }
+        }
+    }
+    /**
+     * Refuse one Behavior naming a policy of either kind which is not there.
+     */
+    assertExists(behavior) {
+        this.responseHeadersPolicy.assertExists(behavior.TargetOriginId, behavior.ResponseHeadersPolicyId);
+        this.cachePolicy.assertExists(behavior.TargetOriginId, behavior.CachePolicyId);
+    }
+}

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-properties.d.ts

@@ -1,8 +1,8 @@
 import type { SimCloudFrontCacheBehaviorConfig, SimCloudFrontDefaultCacheBehaviorConfig } from "../../command/create-distribution/create-distribution.command.js";
 import type { SimCloudFrontBehavior } from "../../behaviour/sim-cloud-front-behavior.js";
-import type { SimCfBehaviorResponseHeadersPolicy } from "./sim-cf-behavior-response-headers-policy.js";
+import type { SimCfBehaviorPolicies } from "./sim-cf-behavior-policies.js";
 /**
  * Build the Behavior properties common to both the default Cache Behavior and
  * a named one. Callers add their own fields, such as the path pattern, on top.
  */
-export declare function simCfBehaviorProperties(cacheBehavior: SimCloudFrontDefaultCacheBehaviorConfig | SimCloudFrontCacheBehaviorConfig, responseHeadersPolicy: SimCfBehaviorResponseHeadersPolicy): SimCloudFrontBehavior;
+export declare function simCfBehaviorProperties(cacheBehavior: SimCloudFrontDefaultCacheBehaviorConfig | SimCloudFrontCacheBehaviorConfig, policies: SimCfBehaviorPolicies): SimCloudFrontBehavior;

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-properties.js

@@ -6,10 +6,10 @@ import { assertConsistentQuantity } from "../../command/sim-cf-list-quantity.js"
  * Build the Behavior properties common to both the default Cache Behavior and
  * a named one. Callers add their own fields, such as the path pattern, on top.
  */
-export function simCfBehaviorProperties(cacheBehavior, responseHeadersPolicy) {
-    const { TargetOriginId, ResponseHeadersPolicyId } = cacheBehavior;
+export function simCfBehaviorProperties(cacheBehavior, policies) {
+    const { TargetOriginId, ResponseHeadersPolicyId, CachePolicyId } = cacheBehavior;
     assertDefined(TargetOriginId, "CloudFront CacheBehavior TargetOriginId");
-    responseHeadersPolicy.assertExists(TargetOriginId, ResponseHeadersPolicyId);
+    policies.assertExists(cacheBehavior);
     return {
         targetOriginName: TargetOriginId,
         allowedMethods: methodsSet("AllowedMethods", cacheBehavior.AllowedMethods, [
@@ -23,6 +23,9 @@ export function simCfBehaviorProperties(cacheBehavior, responseHeadersPolicy) {
         ...(ResponseHeadersPolicyId !== undefined && {
             responseHeadersPolicyId: ResponseHeadersPolicyId,
         }),
+        ...(CachePolicyId !== undefined && {
+            cachePolicyId: CachePolicyId,
+        }),
         functionAssociations: configureCffAssociations(cacheBehavior),
         lambdaFunctionAssociations: configureEdgeAssociations(cacheBehavior),
     };

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-response-headers-policy.d.ts

@@ -1,4 +1,3 @@
-import type { SimCloudFrontDistributionConfig } from "../../command/create-distribution/create-distribution.command.js";
 import type { SimCloudFrontResponseHeadersPolicyRegistry } from "../../response-headers-policy/sim-cf-response-headers-policy-registry.js";
 /**
  * Refuses a Cache Behavior naming a response headers policy this simulation
@@ -12,15 +11,6 @@ import type { SimCloudFrontResponseHeadersPolicyRegistry } from "../../response-
 export declare class SimCfBehaviorResponseHeadersPolicy {
     private readonly policies;
     constructor(policies: SimCloudFrontResponseHeadersPolicyRegistry);
-    /**
-     * Refuse every Behavior of a DistributionConfig that names a policy which is
-     * not there, without touching the Distribution.
-     *
-     * An update replaces a Distribution's whole configuration, so this runs
-     * before any of it is torn down: a refusal here leaves the Distribution
-     * serving exactly what it served before, rather than half replaced.
-     */
-    assertAllExist(distributionConfig: SimCloudFrontDistributionConfig): void;
     /**
      * Refuse one Behavior naming a policy which is not there.
      */

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-response-headers-policy.js

@@ -13,25 +13,6 @@ export class SimCfBehaviorResponseHeadersPolicy {
     constructor(policies) {
         this.policies = policies;
     }
-    /**
-     * Refuse every Behavior of a DistributionConfig that names a policy which is
-     * not there, without touching the Distribution.
-     *
-     * An update replaces a Distribution's whole configuration, so this runs
-     * before any of it is torn down: a refusal here leaves the Distribution
-     * serving exactly what it served before, rather than half replaced.
-     */
-    assertAllExist(distributionConfig) {
-        const behaviors = [
-            distributionConfig.DefaultCacheBehavior,
-            ...(distributionConfig.CacheBehaviors?.Items ?? []),
-        ];
-        for (const behavior of behaviors) {
-            if (behavior !== undefined) {
-                this.assertExists(behavior.TargetOriginId, behavior.ResponseHeadersPolicyId);
-            }
-        }
-    }
     /**
      * Refuse one Behavior naming a policy which is not there.
      */

package/dist/service/cloudfront/distribution/configurator/sim-cf-distribution-configurator.factory.d.ts

@@ -1,3 +1,4 @@
+import type { SimCloudFrontCachePolicyRegistry } from "../../cache-policy/sim-cf-cache-policy-registry.js";
 import type { SimCfCustomOriginDispatcher } from "../../origin/custom/sim-cf-custom-origin-dispatcher.js";
 import type { SimCloudFrontS3OriginResolver } from "../../origin/s3/sim-cloudfront-s3-origin.js";
 import type { SimCloudFrontOriginAccessControlRegistry } from "../../origin-access-control/sim-cf-origin-access-control-registry.js";
@@ -9,6 +10,7 @@ interface SimCloudFrontConfiguratorProperties {
     readonly customOriginDispatcher?: SimCfCustomOriginDispatcher | undefined;
     readonly originAccessControls: SimCloudFrontOriginAccessControlRegistry;
     readonly responseHeadersPolicies: SimCloudFrontResponseHeadersPolicyRegistry;
+    readonly cachePolicies: SimCloudFrontCachePolicyRegistry;
     readonly webAclResolver?: SimCfWebAclResolver | undefined;
 }
 /**