@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/cloudformation/resource/cfn/cloudfront/sim-cloudfront-cache-policy-cfn.js

@@ -0,0 +1,30 @@
+/**
+ * CloudFormation-facing behavior for an AWS::CloudFront::CachePolicy Resource.
+ */
+export class SimCloudFrontCachePolicyCfn {
+    policy;
+    constructor(properties) {
+        this.policy = properties.policy;
+    }
+    /**
+     * CloudFormation Ref for AWS::CloudFront::CachePolicy returns the policy ID,
+     * which is what a Cache Behavior's CachePolicyId wants.
+     */
+    refValue() {
+        return this.policy.id;
+    }
+    /**
+     * CloudFormation attributes for AWS::CloudFront::CachePolicy.
+     */
+    attributeValue(attributeName) {
+        switch (attributeName) {
+            case "Id": {
+                return this.policy.id;
+            }
+            default: {
+                /* v8 ignore next */
+                return `${this.policy.id}.${attributeName}`;
+            }
+        }
+    }
+}

package/dist/service/cloudformation/resource/cfn/cloudfront/sim-cloudfront-cfn-value-adapter.js

@@ -4,6 +4,8 @@ import { SimCloudFrontFunction } from "../../../../cloudfront/cff/sim-cloudfront
 import { SimCloudFrontFunctionCfn } from "./sim-cloudfront-function-cfn.js";
 import { SimCloudFrontResponseHeadersPolicy } from "../../../../cloudfront/response-headers-policy/sim-cf-response-headers-policy.js";
 import { SimCloudFrontResponseHeadersPolicyCfn } from "./sim-cloudfront-rh-policy-cfn.js";
+import { SimCloudFrontCachePolicy } from "../../../../cloudfront/cache-policy/sim-cf-cache-policy.js";
+import { SimCloudFrontCachePolicyCfn } from "./sim-cloudfront-cache-policy-cfn.js";
 import { SimCloudFrontOriginAccessControl } from "../../../../cloudfront/origin-access-control/sim-cf-origin-access-control.js";
 import { SimCloudFrontOriginAccessControlCfn } from "./sim-cloudfront-oac-cfn.js";
 import { SimCloudFrontKeyValueStore } from "../../../../cloudfront/key-value-store/sim-cf-key-value-store.js";
@@ -28,6 +30,12 @@ export function cloudFrontValueAdapter(properties) {
             policy: properties.simResource,
         });
     }
+    if (properties.type === "AWS::CloudFront::CachePolicy" &&
+        properties.simResource instanceof SimCloudFrontCachePolicy) {
+        return new SimCloudFrontCachePolicyCfn({
+            policy: properties.simResource,
+        });
+    }
     if (properties.type === "AWS::CloudFront::OriginAccessControl" &&
         properties.simResource instanceof SimCloudFrontOriginAccessControl) {
         return new SimCloudFrontOriginAccessControlCfn({

package/dist/service/cloudformation/resource/name/sim-cfn-generated-resource-name.d.ts

@@ -6,18 +6,25 @@ interface SimCfnGeneratedResourceNameProperties {
 /**
  * The name CloudFormation gives a Resource whose template does not name it.
  *
- * Real CloudFormation generates `<stack name>-<logical ID>-<random>`. The
- * random part is left out here so a test can predict the name, which is the one
- * thing a template cannot rely on for real. Everything else follows AWS: two
+ * CloudFormation generates `<stack name>-<logical ID>-<random>`. The tail here
+ * is a hash of the other two parts rather than random characters. The same
+ * template deployed under the same stack name generates the same name again,
+ * and a test can read it back and compare. Everything else follows AWS. Two
  * stacks deploying the same template get different names, because the stack
  * name is part of it.
  *
- * Each service has its own limit on how long a name can be, so a long stack
- * name and logical ID together are trimmed to fit. The start is kept, since
- * that is where the stack name is, and the trimmed name ends in a hash of the
- * untrimmed one. CDK puts its own disambiguating hash at the end of a logical
- * ID, which is exactly what trimming cuts off, so without that two Resources in
- * one stack could end up asking for the same name.
+ * Each service has its own limit on how long a name can be, and CloudFormation
+ * reserves the last thirteen characters of it for the tail and its hyphen. What
+ * is left over goes to the stack name and the logical ID either side of one
+ * more hyphen, half each, the stack name rounding up and either taking what the
+ * other does not use. Where a service allows 64 characters, a long stack name
+ * and a long logical ID keep 25 each. The rule is inferred from names real
+ * CloudFormation produced, since AWS documents none of it.
+ *
+ * The tail is derived from the whole untrimmed name. That is what keeps two
+ * trimmed names apart. CDK puts its own disambiguating hash at the end of a
+ * logical ID, which is exactly what trimming cuts off, so without that two
+ * Resources in one stack could end up asking for the same name.
  */
 export declare class SimCfnGeneratedResourceName {
     private readonly stackName;
@@ -29,12 +36,22 @@ export declare class SimCfnGeneratedResourceName {
      */
     get value(): string;
     /**
-     * The tail a trimmed name ends with, derived from the whole untrimmed name.
+     * The stack name and logical ID, trimmed to the room the tail leaves them.
+     *
+     * A name that already fits is kept whole. One that does not gives each part
+     * half of what is left. The stack name is trimmed rather than lost, since
+     * that is the part an IAM policy scoped by resource prefix matches on.
+     */
+    private trimmed;
+    /**
+     * The tail the name ends with, derived from the whole untrimmed name.
      *
      * It is a hash rather than the random characters real CloudFormation uses, so
-     * the name stays the same between deployments of the same template.
+     * the name stays the same between deployments of the same template. Hex
+     * suits every service, since one that only allows lowercase takes it as it
+     * is.
      */
-    private distinguisher;
+    private tail;
     /**
      * The name before it is trimmed to the length the service allows.
      *

package/dist/service/cloudformation/resource/name/sim-cfn-generated-resource-name.js

@@ -1,24 +1,31 @@
 import { createHash } from "node:crypto";
 /**
- * How many characters of the hash of the untrimmed name a trimmed one ends
- * with, so two long names that start the same do not become one name.
+ * How many characters the tail on the end of a generated name is, which is as
+ * many as the random characters real CloudFormation ends one with.
  */
-const distinguisherLength = 8;
+const tailLength = 12;
 /**
  * The name CloudFormation gives a Resource whose template does not name it.
  *
- * Real CloudFormation generates `<stack name>-<logical ID>-<random>`. The
- * random part is left out here so a test can predict the name, which is the one
- * thing a template cannot rely on for real. Everything else follows AWS: two
+ * CloudFormation generates `<stack name>-<logical ID>-<random>`. The tail here
+ * is a hash of the other two parts rather than random characters. The same
+ * template deployed under the same stack name generates the same name again,
+ * and a test can read it back and compare. Everything else follows AWS. Two
  * stacks deploying the same template get different names, because the stack
  * name is part of it.
  *
- * Each service has its own limit on how long a name can be, so a long stack
- * name and logical ID together are trimmed to fit. The start is kept, since
- * that is where the stack name is, and the trimmed name ends in a hash of the
- * untrimmed one. CDK puts its own disambiguating hash at the end of a logical
- * ID, which is exactly what trimming cuts off, so without that two Resources in
- * one stack could end up asking for the same name.
+ * Each service has its own limit on how long a name can be, and CloudFormation
+ * reserves the last thirteen characters of it for the tail and its hyphen. What
+ * is left over goes to the stack name and the logical ID either side of one
+ * more hyphen, half each, the stack name rounding up and either taking what the
+ * other does not use. Where a service allows 64 characters, a long stack name
+ * and a long logical ID keep 25 each. The rule is inferred from names real
+ * CloudFormation produced, since AWS documents none of it.
+ *
+ * The tail is derived from the whole untrimmed name. That is what keeps two
+ * trimmed names apart. CDK puts its own disambiguating hash at the end of a
+ * logical ID, which is exactly what trimming cuts off, so without that two
+ * Resources in one stack could end up asking for the same name.
  */
 export class SimCfnGeneratedResourceName {
     stackName;
@@ -33,24 +40,48 @@ export class SimCfnGeneratedResourceName {
      * The generated name.
      */
     get value() {
+        const tail = this.tail();
+        if (this.maximumLength <= tailLength + 1) {
+            return tail.slice(0, this.maximumLength);
+        }
+        return `${this.trimmed()}-${tail}`;
+    }
+    /**
+     * The stack name and logical ID, trimmed to the room the tail leaves them.
+     *
+     * A name that already fits is kept whole. One that does not gives each part
+     * half of what is left. The stack name is trimmed rather than lost, since
+     * that is the part an IAM policy scoped by resource prefix matches on.
+     */
+    trimmed() {
         const composed = this.composed();
-        if (composed.length <= this.maximumLength) {
+        const budget = this.maximumLength - tailLength - 1;
+        if (composed.length <= budget) {
             return composed;
         }
-        const kept = composed.slice(0, this.maximumLength - distinguisherLength - 1);
-        return `${kept}-${this.distinguisher(composed)}`;
+        if (this.stackName === undefined || this.stackName === "") {
+            return composed.slice(0, budget);
+        }
+        const shared = budget - 1;
+        const stackNameKept = Math.min(this.stackName.length, shared - Math.min(this.logicalId.length, Math.floor(shared / 2)));
+        return [
+            this.stackName.slice(0, stackNameKept),
+            this.logicalId.slice(0, shared - stackNameKept),
+        ].join("-");
     }
     /**
-     * The tail a trimmed name ends with, derived from the whole untrimmed name.
+     * The tail the name ends with, derived from the whole untrimmed name.
      *
      * It is a hash rather than the random characters real CloudFormation uses, so
-     * the name stays the same between deployments of the same template.
+     * the name stays the same between deployments of the same template. Hex
+     * suits every service, since one that only allows lowercase takes it as it
+     * is.
      */
-    distinguisher(composed) {
+    tail() {
         return createHash("sha1")
-            .update(composed)
+            .update(this.composed())
             .digest("hex")
-            .slice(0, distinguisherLength);
+            .slice(0, tailLength);
     }
     /**
      * The name before it is trimmed to the length the service allows.

package/dist/service/cloudformation/stack/deploy/sim-cfn-resource-order.d.ts

@@ -0,0 +1,19 @@
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+/**
+ * The order the Resources in one dependency batch are started in.
+ *
+ * CloudFormation creates Resources with no dependency between them in whatever
+ * order it likes, so a template whose Resources only work in the order it wrote
+ * them deploys some of the time. `template` is the order the template declared,
+ * which is what a deployment does unless it is asked for something else.
+ * `reversed` starts each batch from its last Resource, which is the other order
+ * a pair with nothing between them could be created in.
+ *
+ * Dependencies are unaffected either way: a Resource still waits for everything
+ * it refers to and everything its `DependsOn` names.
+ */
+export type SimCfnResourceOrder = "template" | "reversed";
+/**
+ * The Resources of one batch, in the order the deployment asked for.
+ */
+export declare function simCfnOrderedResources(resources: readonly SimCfnResource[], order: SimCfnResourceOrder | undefined): readonly SimCfnResource[];

package/dist/service/cloudformation/stack/deploy/sim-cfn-resource-order.js

@@ -0,0 +1,6 @@
+/**
+ * The Resources of one batch, in the order the deployment asked for.
+ */
+export function simCfnOrderedResources(resources, order) {
+    return order === "reversed" ? resources.toReversed() : resources;
+}

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-batch-creator.d.ts

@@ -3,12 +3,14 @@ import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnBinding } from "../../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+import { type SimCfnResourceOrder } from "./sim-cfn-resource-order.js";
 interface SimCfnStackResourceBatchCreatorProperties {
     readonly simAws: SimAws;
     readonly resources: ReadonlyMap<string, SimCfnResource>;
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     readonly caller?: SimAwsCaller | undefined;
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
 }
 /**
  * Creates one dependency-ready batch of Stack Resources.
@@ -17,6 +19,7 @@ interface SimCfnStackResourceBatchCreatorProperties {
  * class owns only the batch execution details:
  *
  * - create all Resources in the batch in parallel
+ * - start them in the order the deployment asked for
  * - pass the shared Stack creation context to each Resource
  *
  * It does not choose which Resources are ready, retry incomplete Resources, or
@@ -30,12 +33,16 @@ export declare class SimCfnStackResourceBatchCreator {
     private readonly cdkOutContext;
     private readonly bindings;
     private readonly caller;
+    private readonly resourceOrder;
     constructor(properties: SimCfnStackResourceBatchCreatorProperties);
     /**
      * Create the supplied Resources concurrently.
      *
      * Each Resource still owns its own create lifecycle and status transitions.
      * This method only waits for the batch to settle.
+     *
+     * Nothing in the batch depends on anything else in it, so the order they
+     * start in is the deployment's to choose.
      */
     create(resources: readonly SimCfnResource[]): Promise<void>;
 }

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-batch-creator.js

@@ -1,3 +1,4 @@
+import { simCfnOrderedResources, } from "./sim-cfn-resource-order.js";
 /**
  * Creates one dependency-ready batch of Stack Resources.
  *
@@ -5,6 +6,7 @@
  * class owns only the batch execution details:
  *
  * - create all Resources in the batch in parallel
+ * - start them in the order the deployment asked for
  * - pass the shared Stack creation context to each Resource
  *
  * It does not choose which Resources are ready, retry incomplete Resources, or
@@ -18,22 +20,27 @@ export class SimCfnStackResourceBatchCreator {
     cdkOutContext;
     bindings;
     caller;
+    resourceOrder;
     constructor(properties) {
-        const { simAws, resources, cdkOutContext, bindings, caller } = properties;
+        const { simAws, resources, cdkOutContext, bindings, caller, resourceOrder, } = properties;
         this.simAws = simAws;
         this.resources = resources;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
         this.caller = caller;
+        this.resourceOrder = resourceOrder;
     }
     /**
      * Create the supplied Resources concurrently.
      *
      * Each Resource still owns its own create lifecycle and status transitions.
      * This method only waits for the batch to settle.
+     *
+     * Nothing in the batch depends on anything else in it, so the order they
+     * start in is the deployment's to choose.
      */
     async create(resources) {
-        await Promise.all(resources.map(async (resource) => {
+        await Promise.all(simCfnOrderedResources(resources, this.resourceOrder).map(async (resource) => {
             await resource.create({
                 simAws: this.simAws,
                 resources: this.resources,

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-creator.d.ts

@@ -3,6 +3,7 @@ import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
 import type { SimCdkOutContext } from "../../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../../bind/sim-cfn-binding.js";
+import type { SimCfnResourceOrder } from "./sim-cfn-resource-order.js";
 interface SimCfnStackResourceCreatorProperties {
     readonly simAws: SimAws;
     readonly resources: ReadonlyMap<string, SimCfnResource>;
@@ -10,6 +11,7 @@ interface SimCfnStackResourceCreatorProperties {
     readonly cdkOutContext?: SimCdkOutContext | undefined;
     readonly bindings?: readonly SimCfnBinding[] | undefined;
     readonly caller?: SimAwsCaller | undefined;
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
 }
 /**
  * Orchestrates dependency-ordered creation of a Stack's simulated Resources.

package/dist/service/cloudformation/stack/deploy/sim-cfn-stack-resource-creator.js

@@ -21,7 +21,7 @@ export class SimCfnStackResourceCreator {
     stackName;
     batchCreator;
     constructor(properties) {
-        const { simAws, resources, stackName, cdkOutContext, bindings, caller } = properties;
+        const { simAws, resources, stackName, cdkOutContext, bindings, caller, resourceOrder, } = properties;
         this.resources = resources;
         this.stackName = stackName;
         this.batchCreator = new SimCfnStackResourceBatchCreator({
@@ -30,6 +30,7 @@ export class SimCfnStackResourceCreator {
             cdkOutContext,
             bindings,
             caller,
+            resourceOrder,
         });
     }
     /**

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.d.ts

@@ -6,6 +6,7 @@ import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
 import type { SimCfnResource } from "../resource/sim-cfn-resource.js";
 import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
+import type { SimCfnResourceOrder } from "./deploy/sim-cfn-resource-order.js";
 import { SimCfnStackUpdater } from "./update/sim-cfn-stack-updater.js";
 import type { SimCloudFormationStackName } from "./sim-cfn-stack.js";
 interface SimCfnStackUpdateProperties {
@@ -25,6 +26,10 @@ interface SimCfnStackResourceOperationsProperties {
      * caller leaves each service to decide the request as the Account root.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The order Resources with no dependency between them are started in.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
 }
 /**
  * What a Stack can ask simulated AWS to do with its Resources.
@@ -44,6 +49,7 @@ export declare class SimCfnStackResourceOperations {
     private readonly accountRegionScope;
     private readonly stackName;
     private readonly bindings;
+    private readonly resourceOrder;
     private cdkOutContext;
     private caller;
     constructor(properties: SimCfnStackResourceOperationsProperties);

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.js

@@ -20,16 +20,18 @@ export class SimCfnStackResourceOperations {
     accountRegionScope;
     stackName;
     bindings;
+    resourceOrder;
     cdkOutContext;
     caller;
     constructor(properties) {
-        const { simAws, accountRegionScope, stackName, cdkOutContext, bindings, caller, } = properties;
+        const { simAws, accountRegionScope, stackName, cdkOutContext, bindings, caller, resourceOrder, } = properties;
         this.simAws = simAws;
         this.accountRegionScope = accountRegionScope;
         this.stackName = stackName;
         this.cdkOutContext = cdkOutContext;
         this.bindings = bindings;
         this.caller = caller;
+        this.resourceOrder = resourceOrder;
     }
     /**
      * Take on what an update brings with it, for this and every later operation.
@@ -106,6 +108,7 @@ export class SimCfnStackResourceOperations {
             cdkOutContext: this.cdkOutContext,
             bindings: this.bindings,
             caller: this.caller,
+            resourceOrder: this.resourceOrder,
         });
     }
     deleter(resources) {

package/dist/service/cloudformation/stack/sim-cfn-stack.js

@@ -38,7 +38,7 @@ export class SimCfnStack {
     stackOutputs;
     cfnTemplate;
     constructor(properties) {
-        const { simAws, accountRegionScope, background, stackName, template, cdkOutContext, bindings, caller, exports, } = properties;
+        const { simAws, accountRegionScope, background, stackName, template, cdkOutContext, bindings, caller, resourceOrder, exports, } = properties;
         this.background = background;
         this.stackName = stackName;
         this.stackOutputs = new SimCfnStackOutputs({ stackName, exports });
@@ -61,6 +61,7 @@ export class SimCfnStack {
             cdkOutContext,
             bindings,
             caller,
+            resourceOrder,
         });
         this.lifecycle = new SimCfnStackDeploymentLifecycle({
             background,

package/dist/service/cloudformation/stack/sim-cfn-stack.type.d.ts

@@ -7,6 +7,7 @@ import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
 import type { SimCdkOutContext } from "../cdk/sim-cdk-out-context.js";
 import type { SimCfnBinding } from "../bind/sim-cfn-binding.js";
 import type { SimCfnExports } from "../export/sim-cfn-exports.js";
+import type { SimCfnResourceOrder } from "./deploy/sim-cfn-resource-order.js";
 export type SimCloudFormationStackName = Brand<string, "SimCloudFormationStackName">;
 export type SimCloudFormationStackStatus = "REVIEW_IN_PROGRESS" | "CREATE_IN_PROGRESS" | "CREATE_COMPLETE" | "CREATE_FAILED" | "UPDATE_IN_PROGRESS" | "UPDATE_COMPLETE" | "UPDATE_FAILED" | "DELETE_IN_PROGRESS" | "DELETE_COMPLETE" | "DELETE_FAILED";
 export interface SimCfnStackUpdateProperties {
@@ -37,6 +38,11 @@ export interface SimCloudFormationStackProperties {
      * simulation.
      */
     readonly caller?: SimAwsCaller | undefined;
+    /**
+     * The order this Stack starts Resources with no dependency between them in.
+     * The template's own order unless the deployment asked for another one.
+     */
+    readonly resourceOrder?: SimCfnResourceOrder | undefined;
     /**
      * The export names published in the Account and Region this Stack deploys
      * into. This Stack publishes its own Outputs here and reads the ones its

package/dist/service/cloudfront/behaviour/sim-cloud-front-behavior.d.ts

@@ -12,6 +12,11 @@ export interface SimCloudFrontBehavior {
      * The response headers policy applied to every response this Behavior serves.
      */
     responseHeadersPolicyId?: string | undefined;
+    /**
+     * The cache policy this Behavior was given, whether a template created it or
+     * AWS manages it. The simulated cache does not read it yet.
+     */
+    cachePolicyId?: string | undefined;
     functionAssociations?: undefined | {
         viewerRequest?: SimArn;
         viewerResponse?: SimArn;

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy-registry.d.ts

@@ -0,0 +1,37 @@
+import type { SimCloudFrontCachePolicy, SimCloudFrontCachePolicyId } from "./sim-cf-cache-policy.js";
+/**
+ * The cache policies one simulated CloudFront holds.
+ *
+ * Policies are found by ID, which is what a cache Behavior's `cachePolicyId`
+ * names, and by name, which is what decides whether a new one may be stored.
+ *
+ * AWS's seven managed policies are held apart from the ones a template
+ * creates. CloudFront keeps them in its own namespace, so a template may
+ * create a policy called `CachingDisabled` of its own, and deleting the stack
+ * that created it leaves the managed one where it was.
+ */
+export declare class SimCloudFrontCachePolicyRegistry {
+    private readonly policies;
+    private readonly managedPolicies;
+    /**
+     * Store a policy a template created, refusing a name another such policy
+     * already holds as CloudFront does.
+     */
+    add(policy: SimCloudFrontCachePolicy): void;
+    /**
+     * Forget a policy.
+     */
+    remove(policyId: SimCloudFrontCachePolicyId): void;
+    /**
+     * Get a policy by ID, whether a template created it or AWS manages it.
+     */
+    byId(policyId: SimCloudFrontCachePolicyId | string): SimCloudFrontCachePolicy | undefined;
+    /**
+     * Get a policy a template created, by name.
+     *
+     * A managed policy is left out. Its name belongs to CloudFront's own
+     * namespace, and this is what decides whether a template may store a policy
+     * under a name.
+     */
+    byName(policyName: string): SimCloudFrontCachePolicy | undefined;
+}

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy-registry.js

@@ -0,0 +1,50 @@
+import { SimCloudFrontCachePolicyAlreadyExists } from "../error/sim-cloudfront.error.js";
+import { simCfManagedCachePolicies } from "./sim-cf-managed-cache-policies.js";
+/**
+ * The cache policies one simulated CloudFront holds.
+ *
+ * Policies are found by ID, which is what a cache Behavior's `cachePolicyId`
+ * names, and by name, which is what decides whether a new one may be stored.
+ *
+ * AWS's seven managed policies are held apart from the ones a template
+ * creates. CloudFront keeps them in its own namespace, so a template may
+ * create a policy called `CachingDisabled` of its own, and deleting the stack
+ * that created it leaves the managed one where it was.
+ */
+export class SimCloudFrontCachePolicyRegistry {
+    policies = new Map();
+    managedPolicies = simCfManagedCachePolicies();
+    /**
+     * Store a policy a template created, refusing a name another such policy
+     * already holds as CloudFront does.
+     */
+    add(policy) {
+        if (this.byName(policy.name) !== undefined) {
+            throw new SimCloudFrontCachePolicyAlreadyExists(`Sim CloudFront cache policy ${policy.name} already exists`);
+        }
+        this.policies.set(policy.id, policy);
+    }
+    /**
+     * Forget a policy.
+     */
+    remove(policyId) {
+        this.policies.delete(policyId);
+    }
+    /**
+     * Get a policy by ID, whether a template created it or AWS manages it.
+     */
+    byId(policyId) {
+        const id = policyId;
+        return this.policies.get(id) ?? this.managedPolicies.get(id);
+    }
+    /**
+     * Get a policy a template created, by name.
+     *
+     * A managed policy is left out. Its name belongs to CloudFront's own
+     * namespace, and this is what decides whether a template may store a policy
+     * under a name.
+     */
+    byName(policyName) {
+        return this.policies.values().find((policy) => policy.name === policyName);
+    }
+}

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy.d.ts

@@ -0,0 +1,25 @@
+import type { Brand } from "../../../util/brand.type.js";
+export type SimCloudFrontCachePolicyId = Brand<string, "SimCloudFrontCachePolicyId">;
+interface SimCloudFrontCachePolicyProperties {
+    readonly id?: SimCloudFrontCachePolicyId;
+    readonly name: string;
+    readonly comment?: string | undefined;
+}
+/**
+ * Simulated CloudFront cache policy.
+ *
+ * A cache policy decides what a cache Behavior keys its cache on and how long
+ * an object stays there. This simulation holds the policy under its ID and
+ * hands it back. The cache key, the TTLs and the compression settings belong
+ * to a simulated cache, which CloudFront here has yet to grow.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
+ */
+export declare class SimCloudFrontCachePolicy {
+    readonly id: SimCloudFrontCachePolicyId;
+    readonly name: string;
+    readonly comment: string | undefined;
+    constructor(properties: SimCloudFrontCachePolicyProperties);
+}
+export type SimCloudFrontCachePolicyMap = Map<SimCloudFrontCachePolicyId, SimCloudFrontCachePolicy>;
+export {};

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy.js

@@ -0,0 +1,21 @@
+import { randomUUID } from "node:crypto";
+/**
+ * Simulated CloudFront cache policy.
+ *
+ * A cache policy decides what a cache Behavior keys its cache on and how long
+ * an object stays there. This simulation holds the policy under its ID and
+ * hands it back. The cache key, the TTLs and the compression settings belong
+ * to a simulated cache, which CloudFront here has yet to grow.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
+ */
+export class SimCloudFrontCachePolicy {
+    id;
+    name;
+    comment;
+    constructor(properties) {
+        this.id = properties.id ?? randomUUID();
+        this.name = properties.name;
+        this.comment = properties.comment;
+    }
+}

package/dist/service/cloudfront/cache-policy/sim-cf-managed-cache-policies.d.ts

@@ -0,0 +1,28 @@
+import { type SimCloudFrontCachePolicyMap } from "./sim-cf-cache-policy.js";
+/**
+ * The IDs AWS publishes for its managed cache policies.
+ *
+ * A template names one of these directly. CDK's `CachePolicy` statics carry
+ * the same seven, and synthesize the ID into a Behavior's `CachePolicyId` with
+ * no Resource behind it.
+ */
+export declare const simCfManagedCachePolicyIds: {
+    readonly amplify: "2e54312d-136d-493c-8eb9-b001f22f67d2";
+    readonly cachingOptimized: "658327ea-f89d-4fab-a63d-7e88639e58f6";
+    readonly cachingOptimizedForUncompressedObjects: "b2884449-e4de-46a7-ac36-70bc7f1ddd6d";
+    readonly cachingDisabled: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
+    readonly elementalMediaPackage: "08627262-05a9-4f76-9ded-b50ca2e3a84f";
+    readonly useOriginCacheControlHeaders: "83da9c7e-98b4-4e11-a168-04f0df8e2c65";
+    readonly useOriginCacheControlHeadersQueryStrings: "4cc15a8a-d715-48a4-82b8-cc0b614638fe";
+};
+/**
+ * The seven managed cache policies, built fresh for one simulated CloudFront.
+ *
+ * CloudFront owns these and every account has them, so a Behavior can name one
+ * without a template creating anything. Each carries the ID and the name AWS
+ * publishes for it. The cache key and the TTLs behind each one are left out,
+ * along with those of a policy a template creates.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
+ */
+export declare function simCfManagedCachePolicies(): SimCloudFrontCachePolicyMap;