@kensio/yulin 1.20.16 → 1.20.17

package/dist/service/cloudfront/cfn/distro/sim-cfn-cf-distro-creator.js

@@ -1,7 +1,7 @@
 import { assertDefined, assertNotNull, } from "../../../../util/type-guard/defined.js";
 import { SimCfnCfDistroConfigValidator } from "./sim-cfn-cf-distro-config-validator.js";
 import { simCfnCfDistroWithRunnableEdgeAssociations } from "./sim-cfn-cf-distro-edge-associations.js";
-import { simCfnCfDistroWithHeldResponseHeadersPolicies } from "./sim-cfn-cf-distro-response-headers-policy.js";
+import { simCfnCfDistroWithHeldBehaviorPolicies } from "./sim-cfn-cf-distro-behavior-policies.js";
 import { simCfnCfDistroWithoutAbsentWebAcl } from "./sim-cfn-cf-distro-web-acl.js";
 import { simCfnResourceCallerOptions } from "../../../cloudformation/resource/caller/sim-cfn-resource-caller-options.js";
 /**
@@ -9,11 +9,12 @@ import { simCfnResourceCallerOptions } from "../../../cloudformation/resource/ca
  *
  * A `WebACLId` naming a web ACL this simulation does not hold is left out and
  * recorded, and so are a Lambda@Edge association it cannot run and a
- * `ResponseHeadersPolicyId` naming a policy it does not hold. CloudFront has no
- * Resource of its own for any of the three, so all of them live on the
- * Distribution itself, and refusing one would take the Distribution down over
- * something that was never the point of the template. The site a local dev
- * server and a suite of tests make requests to has to survive that.
+ * `ResponseHeadersPolicyId` or `CachePolicyId` naming a policy it does not
+ * hold. CloudFront has no Resource of its own for any of them, so all of them
+ * live on the Distribution itself, and refusing one would take the
+ * Distribution down over something that was never the point of the template.
+ * The site a local dev server and a suite of tests make requests to has to
+ * survive that.
  */
 export class SimCfnCfDistroCreator {
     cloudFront;
@@ -49,5 +50,5 @@ export class SimCfnCfDistroCreator {
  * act on, each recorded on the Resource.
  */
 function deployableConfig(resource, distributionConfig, simAws, cloudFront) {
-    return simCfnCfDistroWithoutAbsentWebAcl(resource, simCfnCfDistroWithHeldResponseHeadersPolicies(resource, simCfnCfDistroWithRunnableEdgeAssociations(resource, distributionConfig, simAws), cloudFront), simAws);
+    return simCfnCfDistroWithoutAbsentWebAcl(resource, simCfnCfDistroWithHeldBehaviorPolicies(resource, simCfnCfDistroWithRunnableEdgeAssociations(resource, distributionConfig, simAws), cloudFront), simAws);
 }

package/dist/service/cloudfront/cfn/distro/sim-cfn-cf-distro-policy-drops.d.ts

@@ -0,0 +1,23 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCloudFrontCacheBehaviorConfig } from "../../command/create-distribution/create-distribution.command.js";
+import type { SimCloudFront } from "../../sim-cloudfront.js";
+/**
+ * Takes a policy ID naming a policy this simulation does not hold off the
+ * Behavior that named it, and records each one on the Resource.
+ */
+export declare class SimCfnCfDistroPolicyDrops {
+    private readonly resource;
+    private readonly cloudFront;
+    count: number;
+    constructor(resource: SimCfnResource, cloudFront: SimCloudFront);
+    /**
+     * One Behavior, keeping the policies that are here and dropping those that
+     * are not.
+     */
+    heldPolicies(behavior: SimCloudFrontCacheBehaviorConfig, behaviorPath: string): SimCloudFrontCacheBehaviorConfig;
+    /**
+     * One policy property of one Behavior, dropped where the ID names nothing
+     * this simulation holds.
+     */
+    private heldPolicy;
+}

package/dist/service/cloudfront/cfn/distro/sim-cfn-cf-distro-policy-drops.js

@@ -0,0 +1,50 @@
+/**
+ * Takes a policy ID naming a policy this simulation does not hold off the
+ * Behavior that named it, and records each one on the Resource.
+ */
+export class SimCfnCfDistroPolicyDrops {
+    resource;
+    cloudFront;
+    count = 0;
+    constructor(resource, cloudFront) {
+        this.resource = resource;
+        this.cloudFront = cloudFront;
+    }
+    /**
+     * One Behavior, keeping the policies that are here and dropping those that
+     * are not.
+     */
+    heldPolicies(behavior, behaviorPath) {
+        const withHeaders = this.heldPolicy(behavior, behaviorPath, "ResponseHeadersPolicyId", (policyId) => this.cloudFront.getResponseHeadersPolicyById(policyId) !== undefined, headersPolicyDropReason);
+        return this.heldPolicy(withHeaders, behaviorPath, "CachePolicyId", (policyId) => this.cloudFront.getCachePolicyById(policyId) !== undefined, cachePolicyDropReason);
+    }
+    /**
+     * One policy property of one Behavior, dropped where the ID names nothing
+     * this simulation holds.
+     */
+    heldPolicy(behavior, behaviorPath, property, held, reason) {
+        // oxlint-disable-next-line security/detect-object-injection
+        const policyId = behavior[property];
+        if (policyId === undefined || held(policyId)) {
+            return behavior;
+        }
+        this.count += 1;
+        this.resource.ignoreProperty(`${behaviorPath}.${property}`, reason(policyId));
+        return { ...behavior, [property]: undefined };
+    }
+}
+/**
+ * What a Behavior loses along with a response headers policy.
+ */
+function headersPolicyDropReason(policyId) {
+    return (`response headers policy ${policyId} is not held by this simulation, so ` +
+        `the Behavior is deployed without one and serves every response without ` +
+        `the headers that policy would have set`);
+}
+/**
+ * What a Behavior loses along with a cache policy.
+ */
+function cachePolicyDropReason(policyId) {
+    return (`cache policy ${policyId} is not held by this simulation, so the ` +
+        `Behavior is deployed without one and reports no CachePolicyId`);
+}

package/dist/service/cloudfront/cfn/sim-cfn-cloudfront-resource-factory.d.ts

@@ -9,6 +9,7 @@ export declare class SimCloudFrontCloudFormationResourceFactory implements SimCf
     private readonly functionCreator;
     private readonly distroDeleter;
     private readonly responseHeadersPolicyCreator;
+    private readonly cachePolicyCreator;
     private readonly originAccessControlCreator;
     private readonly keyValueStoreCreator;
     constructor(cloudFront: SimCloudFront);

package/dist/service/cloudfront/cfn/sim-cfn-cloudfront-resource-factory.js

@@ -3,6 +3,7 @@ import { SimCfnCfDistroCreator } from "./distro/sim-cfn-cf-distro-creator.js";
 import { SimCfnCffCreator } from "./cff/sim-cfn-cff-creator.js";
 import { SimCfnCfDistroDeleter } from "./distro/sim-cfn-cf-distro-deleter.js";
 import { SimCfnCfResponseHeadersPolicyCreator } from "./response-headers-policy/sim-cfn-cf-rh-policy-creator.js";
+import { SimCfnCfCachePolicyCreator } from "./cache-policy/sim-cfn-cf-cache-policy-creator.js";
 import { SimCfnCfOriginAccessControlCreator } from "./origin-access-control/sim-cfn-cf-oac-creator.js";
 import { SimCfnCfKeyValueStoreCreator } from "./key-value-store/sim-cfn-cf-kvs-creator.js";
 /**
@@ -13,6 +14,7 @@ export class SimCloudFrontCloudFormationResourceFactory {
     functionCreator;
     distroDeleter;
     responseHeadersPolicyCreator;
+    cachePolicyCreator;
     originAccessControlCreator;
     keyValueStoreCreator;
     constructor(cloudFront) {
@@ -21,6 +23,7 @@ export class SimCloudFrontCloudFormationResourceFactory {
         this.distroDeleter = new SimCfnCfDistroDeleter({ cloudFront });
         this.responseHeadersPolicyCreator =
             new SimCfnCfResponseHeadersPolicyCreator({ cloudFront });
+        this.cachePolicyCreator = new SimCfnCfCachePolicyCreator({ cloudFront });
         this.originAccessControlCreator = new SimCfnCfOriginAccessControlCreator({
             cloudFront,
         });
@@ -43,6 +46,9 @@ export class SimCloudFrontCloudFormationResourceFactory {
             case "ResponseHeadersPolicy": {
                 return this.responseHeadersPolicyCreator.create(resource, properties);
             }
+            case "CachePolicy": {
+                return this.cachePolicyCreator.create(resource, properties);
+            }
             case "OriginAccessControl": {
                 return this.originAccessControlCreator.create(resource, properties);
             }
@@ -73,6 +79,10 @@ export class SimCloudFrontCloudFormationResourceFactory {
                 this.responseHeadersPolicyCreator.delete(resource);
                 return;
             }
+            case "CachePolicy": {
+                this.cachePolicyCreator.delete(resource);
+                return;
+            }
             case "OriginAccessControl": {
                 this.originAccessControlCreator.delete(resource);
                 return;

package/dist/service/cloudfront/command/create-distribution/create-distribution.command.d.ts

@@ -144,6 +144,7 @@ export interface SimCloudFrontDefaultCacheBehaviorConfig {
     readonly FunctionAssociations?: SimCloudFrontFunctionAssociations | undefined;
     readonly LambdaFunctionAssociations?: SimCloudFrontLambdaFunctionAssociations | undefined;
     readonly ResponseHeadersPolicyId?: string | undefined;
+    readonly CachePolicyId?: string | undefined;
 }
 /**
  * Minimal structural sim CloudFront cache behavior config.

package/dist/service/cloudfront/command/create-distribution/create-distribution.handler.d.ts

@@ -7,6 +7,7 @@ import type { SimCloudFrontS3OriginResolver } from "../../origin/s3/sim-cloudfro
 import type { SimCfCustomOriginDispatcher } from "../../origin/custom/sim-cf-custom-origin-dispatcher.js";
 import type { SimCloudFrontOriginAccessControlRegistry } from "../../origin-access-control/sim-cf-origin-access-control-registry.js";
 import type { SimCloudFrontResponseHeadersPolicyRegistry } from "../../response-headers-policy/sim-cf-response-headers-policy-registry.js";
+import type { SimCloudFrontCachePolicyRegistry } from "../../cache-policy/sim-cf-cache-policy-registry.js";
 import type { SimCfWebAclResolver } from "../../web-acl/sim-cf-web-acl.js";
 import type { BackgroundScheduler } from "../../../../util/background/background.js";
 import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
@@ -21,6 +22,7 @@ interface CreateDistributionCommandHandlerProperties {
     readonly customOriginDispatcher?: SimCfCustomOriginDispatcher | undefined;
     readonly originAccessControls: SimCloudFrontOriginAccessControlRegistry;
     readonly responseHeadersPolicies: SimCloudFrontResponseHeadersPolicyRegistry;
+    readonly cachePolicies: SimCloudFrontCachePolicyRegistry;
     readonly webAclResolver?: SimCfWebAclResolver | undefined;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly acmRegistry?: SimAcmRegistry | undefined;

package/dist/service/cloudfront/command/create-function/create-function.handler.js

@@ -1,6 +1,6 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { SimCloudFrontFunction, } from "../../cff/sim-cloudfront-function.js";
-import { CffUint8ArrayFunctionCodeExtractor } from "../../cff/function-code-input/cff-function-code-input.js";
+import { cffFunctionCodeSource, CffUint8ArrayFunctionCodeExtractor, } from "../../cff/function-code-input/cff-function-code-input.js";
 import { cffCloudFrontModule } from "../../cff/kvs/cff-cloudfront-module.js";
 import { BackgroundTasks, } from "../../../../util/background/background.js";
 import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
@@ -50,6 +50,12 @@ export class CreateFunctionCommandHandler {
             accountId: this.accountId,
             handlerFunction,
             keyValueStore,
+            // The config a Function was created with is what every read of it
+            // reports, so it is kept rather than only acted on here.
+            comment: command.input.FunctionConfig?.Comment,
+            runtime: command.input.FunctionConfig?.Runtime,
+            functionCode: cffFunctionCodeSource(command.input.FunctionCode),
+            createdTime: this.background.now(),
         });
         this.cloudFrontFunctions.set(simCff.name, simCff);
         // New CFF becomes available async in background.

package/dist/service/cloudfront/command/function/sim-cf-describe-function.d.ts

@@ -0,0 +1,22 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfFunctionAccess } from "./sim-cf-function-access.js";
+import type { SimDescribeFunctionCommand, SimDescribeFunctionCommandOutput } from "./sim-cf-function-command.types.js";
+/**
+ * Simulated CloudFront DescribeFunction command.
+ *
+ * This is the Function's configuration without its code. GetFunction is the
+ * one that answers with the code.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/DescribeFunctionCommand/
+ */
+export declare class SimCfDescribeFunction {
+    private readonly access;
+    private static readonly action;
+    constructor(access: SimCfFunctionAccess);
+    /**
+     * Describe one sim CloudFront Function.
+     */
+    handle(command: SimDescribeFunctionCommand, options?: {
+        readonly caller?: SimAwsCaller;
+    }): Promise<SimDescribeFunctionCommandOutput>;
+}

package/dist/service/cloudfront/command/function/sim-cf-describe-function.js

@@ -0,0 +1,32 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCffRequestedStage } from "../../cff/sim-cff-stage.js";
+import { simCfFunctionSummary } from "./sim-cf-function-summary.js";
+/**
+ * Simulated CloudFront DescribeFunction command.
+ *
+ * This is the Function's configuration without its code. GetFunction is the
+ * one that answers with the code.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/DescribeFunctionCommand/
+ */
+export class SimCfDescribeFunction {
+    access;
+    static action = "cloudfront:DescribeFunction";
+    constructor(access) {
+        this.access = access;
+    }
+    /**
+     * Describe one sim CloudFront Function.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Name, "DescribeFunctionCommand.input.Name");
+        const stage = simCffRequestedStage(command.input.Stage);
+        await this.access.background.sequence();
+        const cloudFrontFunction = this.access.authorizedByName(SimCfDescribeFunction.action, command.input.Name, stage, options?.caller);
+        return {
+            $metadata: {},
+            FunctionSummary: simCfFunctionSummary(cloudFrontFunction, stage),
+            ETag: cloudFrontFunction.config.etag,
+        };
+    }
+}

package/dist/service/cloudfront/command/function/sim-cf-function-access.d.ts

@@ -0,0 +1,48 @@
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimCloudFrontFunctionStage } from "../../cff/sim-cff-stage.js";
+import type { SimCloudFrontFunction } from "../../cff/sim-cloudfront-function.js";
+import type { SimCloudFrontFunctionMap } from "../create-function/create-function.handler.js";
+interface SimCfFunctionAccessProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly cloudFrontFunctions: SimCloudFrontFunctionMap;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * What every command reading a Function back needs: the Functions, IAM, and
+ * the clock.
+ *
+ * ListFunctions, DescribeFunction and GetFunction authorize the same way and
+ * resolve a Function the same way, so the wiring is here once rather than in
+ * each of them. Each command class is then only its own AWS behaviour.
+ */
+export declare class SimCfFunctionAccess {
+    readonly cloudFrontFunctions: SimCloudFrontFunctionMap;
+    readonly background: BackgroundScheduler;
+    private readonly accountId;
+    private readonly iam;
+    constructor(properties: SimCfFunctionAccessProperties);
+    /**
+     * Ensure the caller may take an action on a Function ARN.
+     */
+    authorize(action: string, resource: string, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may take an action on any Function in the Account.
+     *
+     * ListFunctions names no Function, so a policy granting it has to use the
+     * wildcard, and this is what it is authorized against.
+     */
+    authorizeAnyFunction(action: string, caller?: SimAwsCaller): void;
+    /**
+     * Resolve a Function in a stage, having authorized the action against it.
+     *
+     * The ARN is built from the name the caller gave, so authorization happens
+     * before the Function map is read and an unauthorized caller is refused
+     * whether or not the name resolves.
+     */
+    authorizedByName(action: string, functionName: string, stage: SimCloudFrontFunctionStage, caller?: SimAwsCaller): SimCloudFrontFunction;
+}
+export {};

package/dist/service/cloudfront/command/function/sim-cf-function-access.js

@@ -0,0 +1,48 @@
+import { simCfAuthorize } from "../../sim-cf-authorize.js";
+import { simCfFunctionInStage } from "./sim-cf-function-lookup.js";
+/**
+ * What every command reading a Function back needs: the Functions, IAM, and
+ * the clock.
+ *
+ * ListFunctions, DescribeFunction and GetFunction authorize the same way and
+ * resolve a Function the same way, so the wiring is here once rather than in
+ * each of them. Each command class is then only its own AWS behaviour.
+ */
+export class SimCfFunctionAccess {
+    cloudFrontFunctions;
+    background;
+    accountId;
+    iam;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.cloudFrontFunctions = properties.cloudFrontFunctions;
+        this.iam = properties.iam;
+        this.background = properties.background;
+    }
+    /**
+     * Ensure the caller may take an action on a Function ARN.
+     */
+    authorize(action, resource, caller) {
+        simCfAuthorize({ iam: this.iam, action, resource, caller });
+    }
+    /**
+     * Ensure the caller may take an action on any Function in the Account.
+     *
+     * ListFunctions names no Function, so a policy granting it has to use the
+     * wildcard, and this is what it is authorized against.
+     */
+    authorizeAnyFunction(action, caller) {
+        this.authorize(action, `arn:aws:cloudfront::${this.accountId}:function/*`, caller);
+    }
+    /**
+     * Resolve a Function in a stage, having authorized the action against it.
+     *
+     * The ARN is built from the name the caller gave, so authorization happens
+     * before the Function map is read and an unauthorized caller is refused
+     * whether or not the name resolves.
+     */
+    authorizedByName(action, functionName, stage, caller) {
+        this.authorize(action, `arn:aws:cloudfront::${this.accountId}:function/${functionName}`, caller);
+        return simCfFunctionInStage(this.cloudFrontFunctions, functionName, stage);
+    }
+}

package/dist/service/cloudfront/command/function/sim-cf-function-command.types.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Structural types for the commands that read a CloudFront Function back.
+ *
+ * ListFunctions, DescribeFunction and GetFunction all address a Function by
+ * name and a stage, and answer with the same summary shape, so their types are
+ * together here rather than one file each.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/
+ */
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimCloudFrontFunctionRuntime } from "../../cff/sim-cff-configuration.js";
+import type { SimCloudFrontFunctionStage } from "../../cff/sim-cff-stage.js";
+/**
+ * Minimal structural sim CloudFront Function config.
+ */
+export interface SimCfFunctionConfig {
+    Comment: string;
+    Runtime: SimCloudFrontFunctionRuntime;
+    KeyValueStoreAssociations?: {
+        Quantity: number;
+        Items: {
+            KeyValueStoreARN: SimArn;
+        }[];
+    };
+}
+/**
+ * Minimal structural sim CloudFront Function metadata.
+ */
+export interface SimCfFunctionMetadata {
+    FunctionARN: SimArn;
+    Stage: SimCloudFrontFunctionStage;
+    CreatedTime: Date;
+    LastModifiedTime: Date;
+}
+/**
+ * Minimal structural sim CloudFront Function summary.
+ */
+export interface SimCfFunctionSummary {
+    Name: string;
+    Status: string;
+    FunctionConfig: SimCfFunctionConfig;
+    FunctionMetadata: SimCfFunctionMetadata;
+}
+/**
+ * Minimal structural sim CloudFront ListFunctions command.
+ */
+export interface SimListFunctionsCommand {
+    readonly input: {
+        readonly Stage?: string | undefined;
+    };
+}
+/**
+ * Minimal structural sim CloudFront ListFunctions output.
+ */
+export interface SimListFunctionsCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+    FunctionList: {
+        Quantity: number;
+        Items: SimCfFunctionSummary[];
+    };
+}
+/**
+ * Minimal structural sim CloudFront DescribeFunction command.
+ */
+export interface SimDescribeFunctionCommand {
+    readonly input: {
+        readonly Name?: string | undefined;
+        readonly Stage?: string | undefined;
+    };
+}
+/**
+ * Minimal structural sim CloudFront DescribeFunction output.
+ */
+export interface SimDescribeFunctionCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+    FunctionSummary: SimCfFunctionSummary;
+    ETag: string;
+}
+/**
+ * Minimal structural sim CloudFront GetFunction command.
+ */
+export interface SimGetFunctionCommand {
+    readonly input: {
+        readonly Name?: string | undefined;
+        readonly Stage?: string | undefined;
+    };
+}
+/**
+ * Minimal structural sim CloudFront GetFunction output.
+ */
+export interface SimGetFunctionCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+    FunctionCode: Uint8Array;
+    ETag: string;
+    ContentType: string;
+}

package/dist/service/cloudfront/command/function/sim-cf-function-command.types.js

@@ -0,0 +1,10 @@
+/**
+ * Structural types for the commands that read a CloudFront Function back.
+ *
+ * ListFunctions, DescribeFunction and GetFunction all address a Function by
+ * name and a stage, and answer with the same summary shape, so their types are
+ * together here rather than one file each.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/
+ */
+export {};

package/dist/service/cloudfront/command/function/sim-cf-function-lookup.d.ts

@@ -0,0 +1,12 @@
+import { type SimCloudFrontFunctionStage } from "../../cff/sim-cff-stage.js";
+import type { SimCloudFrontFunction } from "../../cff/sim-cloudfront-function.js";
+import type { SimCloudFrontFunctionMap } from "../create-function/create-function.handler.js";
+/**
+ * Resolve a Function a stage can be read from.
+ *
+ * A name the Account holds no Function under is refused, and so is one whose
+ * Function has not reached the stage asked for. Both answer with
+ * NoSuchFunctionExists. That is what CloudFront answers when a stage holds
+ * nothing under the name asked for.
+ */
+export declare function simCfFunctionInStage(cloudFrontFunctions: SimCloudFrontFunctionMap, functionName: string, stage: SimCloudFrontFunctionStage): SimCloudFrontFunction;

package/dist/service/cloudfront/command/function/sim-cf-function-lookup.js

@@ -0,0 +1,21 @@
+import { simCffInStage, } from "../../cff/sim-cff-stage.js";
+import { SimCloudFrontNoSuchFunctionExists } from "../../error/sim-cloudfront.error.js";
+/**
+ * Resolve a Function a stage can be read from.
+ *
+ * A name the Account holds no Function under is refused, and so is one whose
+ * Function has not reached the stage asked for. Both answer with
+ * NoSuchFunctionExists. That is what CloudFront answers when a stage holds
+ * nothing under the name asked for.
+ */
+export function simCfFunctionInStage(cloudFrontFunctions, functionName, stage) {
+    const cloudFrontFunction = cloudFrontFunctions.get(functionName);
+    if (cloudFrontFunction === undefined) {
+        throw new SimCloudFrontNoSuchFunctionExists(`No sim CloudFront Function named ${functionName}`);
+    }
+    if (!simCffInStage(cloudFrontFunction, stage)) {
+        throw new SimCloudFrontNoSuchFunctionExists(`Sim CloudFront Function ${functionName} has not been published, so it ` +
+            `is in DEVELOPMENT and not in ${stage}`);
+    }
+    return cloudFrontFunction;
+}

package/dist/service/cloudfront/command/function/sim-cf-function-summary.d.ts

@@ -0,0 +1,11 @@
+import type { SimCloudFrontFunctionStage } from "../../cff/sim-cff-stage.js";
+import type { SimCloudFrontFunction } from "../../cff/sim-cloudfront-function.js";
+import type { SimCfFunctionSummary } from "./sim-cf-function-command.types.js";
+/**
+ * Describe a Function the way ListFunctions and DescribeFunction both do.
+ *
+ * The stage comes from the request rather than the Function, because a
+ * published Function is in both stages and answers under whichever one was
+ * asked for.
+ */
+export declare function simCfFunctionSummary(cloudFrontFunction: SimCloudFrontFunction, stage: SimCloudFrontFunctionStage): SimCfFunctionSummary;

package/dist/service/cloudfront/command/function/sim-cf-function-summary.js

@@ -0,0 +1,30 @@
+/**
+ * Describe a Function the way ListFunctions and DescribeFunction both do.
+ *
+ * The stage comes from the request rather than the Function, because a
+ * published Function is in both stages and answers under whichever one was
+ * asked for.
+ */
+export function simCfFunctionSummary(cloudFrontFunction, stage) {
+    const keyValueStore = cloudFrontFunction.keyValueStore;
+    return {
+        Name: cloudFrontFunction.name,
+        Status: cloudFrontFunction.status,
+        FunctionConfig: {
+            Comment: cloudFrontFunction.config.comment,
+            Runtime: cloudFrontFunction.config.runtime,
+            ...(keyValueStore !== undefined && {
+                KeyValueStoreAssociations: {
+                    Quantity: 1,
+                    Items: [{ KeyValueStoreARN: keyValueStore.arn }],
+                },
+            }),
+        },
+        FunctionMetadata: {
+            FunctionARN: cloudFrontFunction.arn,
+            Stage: stage,
+            CreatedTime: cloudFrontFunction.config.createdTime,
+            LastModifiedTime: cloudFrontFunction.config.lastModifiedTime,
+        },
+    };
+}

package/dist/service/cloudfront/command/function/sim-cf-get-function.d.ts

@@ -0,0 +1,23 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfFunctionAccess } from "./sim-cf-function-access.js";
+import type { SimGetFunctionCommand, SimGetFunctionCommandOutput } from "./sim-cf-function-command.types.js";
+/**
+ * Simulated CloudFront GetFunction command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/GetFunctionCommand/
+ */
+export declare class SimCfGetFunction {
+    private readonly access;
+    private static readonly action;
+    constructor(access: SimCfFunctionAccess);
+    /**
+     * Get one sim CloudFront Function's code.
+     *
+     * A Function created from source answers with the source it was given. One
+     * created from a handler function reference has no uploaded source, and
+     * answers with that handler's own source text. That is the code it runs.
+     */
+    handle(command: SimGetFunctionCommand, options?: {
+        readonly caller?: SimAwsCaller;
+    }): Promise<SimGetFunctionCommandOutput>;
+}

package/dist/service/cloudfront/command/function/sim-cf-get-function.js

@@ -0,0 +1,33 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCffRequestedStage } from "../../cff/sim-cff-stage.js";
+/**
+ * Simulated CloudFront GetFunction command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/GetFunctionCommand/
+ */
+export class SimCfGetFunction {
+    access;
+    static action = "cloudfront:GetFunction";
+    constructor(access) {
+        this.access = access;
+    }
+    /**
+     * Get one sim CloudFront Function's code.
+     *
+     * A Function created from source answers with the source it was given. One
+     * created from a handler function reference has no uploaded source, and
+     * answers with that handler's own source text. That is the code it runs.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Name, "GetFunctionCommand.input.Name");
+        const stage = simCffRequestedStage(command.input.Stage);
+        await this.access.background.sequence();
+        const cloudFrontFunction = this.access.authorizedByName(SimCfGetFunction.action, command.input.Name, stage, options?.caller);
+        return {
+            $metadata: {},
+            FunctionCode: cloudFrontFunction.config.functionCode,
+            ETag: cloudFrontFunction.config.etag,
+            ContentType: "application/octet-stream",
+        };
+    }
+}

package/dist/service/cloudfront/command/function/sim-cf-list-functions.d.ts

@@ -0,0 +1,22 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfFunctionAccess } from "./sim-cf-function-access.js";
+import type { SimListFunctionsCommand, SimListFunctionsCommandOutput } from "./sim-cf-function-command.types.js";
+/**
+ * Simulated CloudFront ListFunctions command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/ListFunctionsCommand/
+ */
+export declare class SimCfListFunctions {
+    private readonly access;
+    private static readonly action;
+    constructor(access: SimCfFunctionAccess);
+    /**
+     * List this Account's sim CloudFront Functions in one stage.
+     *
+     * The whole list comes back. `Marker` and `MaxItems` are the paging every
+     * other simulated listing leaves out, so there is no `NextMarker` either.
+     */
+    handle(command: SimListFunctionsCommand, options?: {
+        readonly caller?: SimAwsCaller;
+    }): Promise<SimListFunctionsCommandOutput>;
+}