@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/cloudfront/cache/sim-cf-distribution-cache.js

@@ -0,0 +1,115 @@
+import { SimRealClock } from "../../../util/clock/sim-clock.js";
+import { simCfInvalidationBatchCovers } from "../invalidation/sim-cf-invalidation-path.js";
+import { simCfAgeHeaderName, simCfCacheAgeSec } from "./sim-cf-cache-status.js";
+import { simCfCacheEntryKeyPath } from "./sim-cf-cache-entry-key-path.js";
+/**
+ * The statuses HTTP gives no body, which a Response refuses to be built with
+ * one for.
+ */
+const bodylessStatuses = new Set([101, 103, 204, 205, 304]);
+/**
+ * What one simulated Distribution has cached.
+ *
+ * Real CloudFront caches at each of its points of presence rather than once
+ * per Distribution, which the edge in the key stands for. One cache holds an
+ * entry per edge, and a request arriving at another edge misses.
+ *
+ * An entry leaves the cache two ways. It expires on the simulation's clock
+ * rather than the host's. A test reaches the instant an object goes stale by
+ * advancing simulated time, with no waiting. Or an invalidation clears it ahead
+ * of that instant.
+ *
+ * Storing takes its seconds from the caller. An Origin's answer is held for
+ * what its cache policy allows, and an error's own `ErrorCachingMinTTL` fits
+ * the same call.
+ */
+export class SimCfDistributionCache {
+    entries = new Map();
+    clock;
+    /**
+     * A cache built standalone, outside a Distribution, falls back to the real
+     * clock.
+     */
+    constructor(clock = new SimRealClock()) {
+        this.clock = clock;
+    }
+    /**
+     * The response cached under a key, or none where the cache does not hold it.
+     *
+     * An entry that has reached its expiry is dropped here. The request then goes
+     * to the Origin, and what the Origin answers replaces the expired entry.
+     *
+     * What comes back carries `Age`, counted on the simulation's clock from the
+     * instant the Origin's answer was stored. An `Age` the Origin sent is
+     * replaced by the Distribution's own, as CloudFront replaces one.
+     */
+    read(key) {
+        const entry = this.entries.get(key);
+        if (entry === undefined) {
+            return undefined;
+        }
+        const now = this.clock.now();
+        if (now.getTime() >= entry.expiresAt.getTime()) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        const response = cachedResponse(entry);
+        response.headers.set(simCfAgeHeaderName, String(simCfCacheAgeSec(entry.storedAt, now)));
+        return response;
+    }
+    /**
+     * Cache a response under a key for a number of seconds, and hand back one to
+     * carry on with.
+     *
+     * Storing reads the response's body, which can only happen once, so the
+     * response the caller continues with is built from the bytes that were
+     * stored rather than being the one passed in. A TTL of no seconds stores
+     * nothing, and the response passed in is handed straight back unread.
+     */
+    async store(key, response, ttlSec) {
+        if (!Number.isFinite(ttlSec) || ttlSec <= 0) {
+            return response;
+        }
+        const storedAt = this.clock.now();
+        const entry = {
+            status: response.status,
+            statusText: response.statusText,
+            headers: [...response.headers],
+            body: new Uint8Array(await response.arrayBuffer()),
+            storedAt,
+            expiresAt: new Date(storedAt.getTime() + ttlSec * 1000),
+        };
+        this.entries.set(key, entry);
+        return cachedResponse(entry);
+    }
+    /**
+     * Forget every entry an invalidation's paths name, at every edge.
+     *
+     * The path an entry was cached under is read back out of its key, so
+     * matching a batch costs a pass over the keys rather than a second map from
+     * path to entry. Nothing here is keyed on the edge, because an invalidation
+     * reaches every point of presence rather than the one a viewer happened to
+     * arrive at.
+     */
+    clearPaths(paths) {
+        for (const key of this.entries.keys()) {
+            const path = simCfCacheEntryKeyPath(key);
+            if (path !== undefined && simCfInvalidationBatchCovers(paths, path)) {
+                this.entries.delete(key);
+            }
+        }
+    }
+}
+/**
+ * Build a response from a cached one, which every read needs its own of.
+ *
+ * No `Age` goes on here. A response on its way into the cache has been held
+ * for no time at all, and only one leaving it has an age to report.
+ */
+function cachedResponse(entry) {
+    return new Response(bodylessStatuses.has(entry.status) ? null : entry.body, {
+        status: entry.status,
+        statusText: entry.statusText,
+        headers: new Headers(entry.headers.map(([name, value]) => [name, value])),
+    });
+}

package/dist/service/cloudfront/cache/sim-cf-edge.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The header naming the CloudFront edge a request arrives at.
+ *
+ * CloudFront caches at each of its several hundred points of presence, so a
+ * viewer is never guaranteed the entry another viewer's request stored. A
+ * request naming an edge of its own is answered from that edge's cache, which
+ * is how a test proves its app survives arriving somewhere cold.
+ *
+ * The name follows the `x-sim-aws-*` convention of `simAwsControlHeaderNames`,
+ * and like those headers it states something to the simulator rather than to
+ * the application. Sim CloudFront reads it, drops it from the request, and
+ * nothing downstream of the edge sees it.
+ */
+export declare const simCfEdgeHeaderName = "x-sim-aws-cloudfront-edge";
+/**
+ * The edge a request arrives at when it names none.
+ *
+ * Every request in a test lands here unless the test says otherwise, and a
+ * second request for a key the first one stored is a hit. A header carrying no
+ * value names no edge, and lands here too.
+ */
+export declare const simCfDefaultEdgeId = "default";
+/**
+ * A request and the edge it arrived at.
+ */
+export interface SimCfRequestEdge {
+    readonly edgeId: string;
+    /**
+     * The request with the edge header removed, which is the one the rest of the
+     * pipeline works on.
+     */
+    readonly request: Request;
+}
+/**
+ * Read the edge a request arrived at, and take the header back off it.
+ */
+export declare function simCfRequestEdge(request: Request): SimCfRequestEdge;

package/dist/service/cloudfront/cache/sim-cf-edge.js

@@ -0,0 +1,34 @@
+/**
+ * The header naming the CloudFront edge a request arrives at.
+ *
+ * CloudFront caches at each of its several hundred points of presence, so a
+ * viewer is never guaranteed the entry another viewer's request stored. A
+ * request naming an edge of its own is answered from that edge's cache, which
+ * is how a test proves its app survives arriving somewhere cold.
+ *
+ * The name follows the `x-sim-aws-*` convention of `simAwsControlHeaderNames`,
+ * and like those headers it states something to the simulator rather than to
+ * the application. Sim CloudFront reads it, drops it from the request, and
+ * nothing downstream of the edge sees it.
+ */
+export const simCfEdgeHeaderName = "x-sim-aws-cloudfront-edge";
+/**
+ * The edge a request arrives at when it names none.
+ *
+ * Every request in a test lands here unless the test says otherwise, and a
+ * second request for a key the first one stored is a hit. A header carrying no
+ * value names no edge, and lands here too.
+ */
+export const simCfDefaultEdgeId = "default";
+/**
+ * Read the edge a request arrived at, and take the header back off it.
+ */
+export function simCfRequestEdge(request) {
+    const named = request.headers.get(simCfEdgeHeaderName)?.trim();
+    if (named === undefined || named.length === 0) {
+        return { edgeId: simCfDefaultEdgeId, request };
+    }
+    const headers = new Headers(request.headers);
+    headers.delete(simCfEdgeHeaderName);
+    return { edgeId: named, request: new Request(request, { headers }) };
+}

package/dist/service/cloudfront/cache/sim-cf-error-cache-ttl.d.ts

@@ -0,0 +1,36 @@
+import { type SimCloudFrontCustomErrorResponse } from "../custom-error/sim-cloudfront-custom-error-response.js";
+interface SimCfErrorCacheTtlProperties {
+    /**
+     * The status the Origin answered with, before an origin-response function
+     * or a custom error page could replace it.
+     */
+    readonly originStatus: number;
+    /** The response carrying on towards the viewer. */
+    readonly response: Response;
+    /**
+     * The Distribution's custom error responses, whose `ErrorCachingMinTTL`
+     * decides.
+     */
+    readonly customErrorResponses: readonly SimCloudFrontCustomErrorResponse[];
+}
+/**
+ * How many seconds a Distribution holds an error for, or none where this
+ * answer is no error at all.
+ *
+ * An error has a TTL of its own, and the Origin's cache headers and the
+ * Behavior's cache policy have no say in it. It comes from the custom error
+ * response matching the status, and from CloudFront's ten seconds where the
+ * Distribution configures no rule for that status. An `ErrorCachingMinTTL` of
+ * zero holds the error for no time at all, which is how a Distribution turns
+ * error caching off.
+ *
+ * The Origin's status is what a rule is matched against. A 404 the
+ * Distribution answers with a 200 error page is still held as the error it
+ * was, for the seconds the 404's own rule allows. An error that only an
+ * origin-response function made has no Origin error behind it, and its own
+ * status stands in.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HTTPStatusCodes.html
+ */
+export declare function simCfErrorCacheTtlSec(properties: SimCfErrorCacheTtlProperties): number | undefined;
+export {};

package/dist/service/cloudfront/cache/sim-cf-error-cache-ttl.js

@@ -0,0 +1,28 @@
+import { simCloudFrontDefaultErrorCachingMinTtlSec, } from "../custom-error/sim-cloudfront-custom-error-response.js";
+/**
+ * How many seconds a Distribution holds an error for, or none where this
+ * answer is no error at all.
+ *
+ * An error has a TTL of its own, and the Origin's cache headers and the
+ * Behavior's cache policy have no say in it. It comes from the custom error
+ * response matching the status, and from CloudFront's ten seconds where the
+ * Distribution configures no rule for that status. An `ErrorCachingMinTTL` of
+ * zero holds the error for no time at all, which is how a Distribution turns
+ * error caching off.
+ *
+ * The Origin's status is what a rule is matched against. A 404 the
+ * Distribution answers with a 200 error page is still held as the error it
+ * was, for the seconds the 404's own rule allows. An error that only an
+ * origin-response function made has no Origin error behind it, and its own
+ * status stands in.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HTTPStatusCodes.html
+ */
+export function simCfErrorCacheTtlSec(properties) {
+    const { originStatus, response, customErrorResponses } = properties;
+    const errorStatus = originStatus >= 400 ? originStatus : response.status;
+    if (errorStatus < 400) {
+        return undefined;
+    }
+    return (customErrorResponses.find((customErrorResponse) => customErrorResponse.errorCode === errorStatus)?.errorCachingMinTtlSec ?? simCloudFrontDefaultErrorCachingMinTtlSec);
+}

package/dist/service/cloudfront/cache/sim-cf-http-date.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The instant an HTTP date names, in milliseconds, or none where the value is
+ * not one of the three formats HTTP allows.
+ *
+ * The check matters because `Date.parse` reads far more than HTTP does. It
+ * takes `12/31/2099` as a date in 2099 and `0` as the start of the year 2000,
+ * and an HTTP cache is required to treat both as an object that has already
+ * expired.
+ *
+ * asctime states no zone and HTTP reads it as GMT, while `Date.parse` would
+ * read it in the host's own. It is rewritten with the zone spelled out.
+ *
+ * https://www.rfc-editor.org/rfc/rfc9110#name-date-time-formats
+ */
+export declare function simCfHttpDateInstant(value: string): number | undefined;

package/dist/service/cloudfront/cache/sim-cf-http-date.js

@@ -0,0 +1,40 @@
+/**
+ * IMF-fixdate, which every sender is required to use. `Sun, 06 Nov 1994
+ * 08:49:37 GMT`.
+ */
+const imfFixdate = /^[A-Za-z]{3}, \d{2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+/**
+ * The obsolete RFC 850 format, which a recipient still has to read.
+ * `Sunday, 06-Nov-94 08:49:37 GMT`.
+ */
+const rfc850Date = /^[A-Za-z]{6,9}, \d{2}-[A-Za-z]{3}-\d{2} \d{2}:\d{2}:\d{2} GMT$/;
+/**
+ * The obsolete asctime format, which carries no zone. `Sun Nov  6 08:49:37
+ * 1994`.
+ */
+const asctimeDate = /^[A-Za-z]{3} ([A-Za-z]{3}) {1,2}(\d{1,2}) (\d{2}:\d{2}:\d{2}) (\d{4})$/;
+/**
+ * The instant an HTTP date names, in milliseconds, or none where the value is
+ * not one of the three formats HTTP allows.
+ *
+ * The check matters because `Date.parse` reads far more than HTTP does. It
+ * takes `12/31/2099` as a date in 2099 and `0` as the start of the year 2000,
+ * and an HTTP cache is required to treat both as an object that has already
+ * expired.
+ *
+ * asctime states no zone and HTTP reads it as GMT, while `Date.parse` would
+ * read it in the host's own. It is rewritten with the zone spelled out.
+ *
+ * https://www.rfc-editor.org/rfc/rfc9110#name-date-time-formats
+ */
+export function simCfHttpDateInstant(value) {
+    const asctime = asctimeDate.exec(value);
+    const parsable = asctime === null
+        ? value
+        : `${asctime[2]} ${asctime[1]} ${asctime[4]} ${asctime[3]} GMT`;
+    if (asctime === null && !imfFixdate.test(value) && !rfc850Date.test(value)) {
+        return undefined;
+    }
+    const instant = Date.parse(parsable);
+    return Number.isNaN(instant) ? undefined : instant;
+}

package/dist/service/cloudfront/cache-policy/sim-cf-cache-key.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The cookie behaviours a cache policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-cookiesconfig.html
+ */
+export declare const simCfCacheKeyCookieBehaviors: readonly ["none", "whitelist", "allExcept", "all"];
+export type SimCfCacheKeyCookieBehavior = (typeof simCfCacheKeyCookieBehaviors)[number];
+/**
+ * The header behaviours a cache policy may name.
+ *
+ * These are two of the four an origin request policy offers. A cache key can
+ * name headers or leave them all out; there is no `allViewer` to key a cache
+ * on, since keying on every header a viewer sent would cache almost nothing
+ * twice.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-headersconfig.html
+ */
+export declare const simCfCacheKeyHeaderBehaviors: readonly ["none", "whitelist"];
+export type SimCfCacheKeyHeaderBehavior = (typeof simCfCacheKeyHeaderBehaviors)[number];
+/**
+ * The query string behaviours a cache policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-querystringsconfig.html
+ */
+export declare const simCfCacheKeyQueryStringBehaviors: readonly ["none", "whitelist", "allExcept", "all"];
+export type SimCfCacheKeyQueryStringBehavior = (typeof simCfCacheKeyQueryStringBehaviors)[number];
+interface SimCloudFrontCacheKeyProperties {
+    readonly cookieBehavior?: SimCfCacheKeyCookieBehavior;
+    readonly cookies?: readonly string[];
+    readonly headerBehavior?: SimCfCacheKeyHeaderBehavior;
+    readonly headers?: readonly string[];
+    readonly queryStringBehavior?: SimCfCacheKeyQueryStringBehavior;
+    readonly queryStrings?: readonly string[];
+    readonly enableAcceptEncodingGzip?: boolean;
+    readonly enableAcceptEncodingBrotli?: boolean;
+}
+/**
+ * What a cache policy keys its cache on.
+ *
+ * This is CloudFront's `ParametersInCacheKeyAndForwardedToOrigin`. Each of the
+ * three sections carries a behaviour and the names it applies to: a
+ * `whitelist` keys on the names listed, an `allExcept` keys on everything but
+ * them, and `all` and `none` ignore the list. The names listed are also the
+ * ones CloudFront forwards to the Origin.
+ *
+ * The two `EnableAcceptEncoding` flags decide whether the normalized
+ * `Accept-Encoding` header joins the key, which is what lets one object be
+ * cached once compressed and once not.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
+ */
+export declare class SimCloudFrontCacheKey {
+    readonly cookieBehavior: SimCfCacheKeyCookieBehavior;
+    readonly cookies: readonly string[];
+    readonly headerBehavior: SimCfCacheKeyHeaderBehavior;
+    readonly headers: readonly string[];
+    readonly queryStringBehavior: SimCfCacheKeyQueryStringBehavior;
+    readonly queryStrings: readonly string[];
+    readonly enableAcceptEncodingGzip: boolean;
+    readonly enableAcceptEncodingBrotli: boolean;
+    constructor(properties?: SimCloudFrontCacheKeyProperties);
+}
+export {};

package/dist/service/cloudfront/cache-policy/sim-cf-cache-key.js

@@ -0,0 +1,70 @@
+/**
+ * The cookie behaviours a cache policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-cookiesconfig.html
+ */
+export const simCfCacheKeyCookieBehaviors = [
+    "none",
+    "whitelist",
+    "allExcept",
+    "all",
+];
+/**
+ * The header behaviours a cache policy may name.
+ *
+ * These are two of the four an origin request policy offers. A cache key can
+ * name headers or leave them all out; there is no `allViewer` to key a cache
+ * on, since keying on every header a viewer sent would cache almost nothing
+ * twice.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-headersconfig.html
+ */
+export const simCfCacheKeyHeaderBehaviors = ["none", "whitelist"];
+/**
+ * The query string behaviours a cache policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-querystringsconfig.html
+ */
+export const simCfCacheKeyQueryStringBehaviors = [
+    "none",
+    "whitelist",
+    "allExcept",
+    "all",
+];
+/**
+ * What a cache policy keys its cache on.
+ *
+ * This is CloudFront's `ParametersInCacheKeyAndForwardedToOrigin`. Each of the
+ * three sections carries a behaviour and the names it applies to: a
+ * `whitelist` keys on the names listed, an `allExcept` keys on everything but
+ * them, and `all` and `none` ignore the list. The names listed are also the
+ * ones CloudFront forwards to the Origin.
+ *
+ * The two `EnableAcceptEncoding` flags decide whether the normalized
+ * `Accept-Encoding` header joins the key, which is what lets one object be
+ * cached once compressed and once not.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
+ */
+export class SimCloudFrontCacheKey {
+    cookieBehavior;
+    cookies;
+    headerBehavior;
+    headers;
+    queryStringBehavior;
+    queryStrings;
+    enableAcceptEncodingGzip;
+    enableAcceptEncodingBrotli;
+    constructor(properties = {}) {
+        this.cookieBehavior = properties.cookieBehavior ?? "none";
+        this.cookies = properties.cookies ?? [];
+        this.headerBehavior = properties.headerBehavior ?? "none";
+        this.headers = properties.headers ?? [];
+        this.queryStringBehavior = properties.queryStringBehavior ?? "none";
+        this.queryStrings = properties.queryStrings ?? [];
+        this.enableAcceptEncodingGzip =
+            properties.enableAcceptEncodingGzip ?? false;
+        this.enableAcceptEncodingBrotli =
+            properties.enableAcceptEncodingBrotli ?? false;
+    }
+}

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy-registry.d.ts

@@ -0,0 +1,37 @@
+import type { SimCloudFrontCachePolicy, SimCloudFrontCachePolicyId } from "./sim-cf-cache-policy.js";
+/**
+ * The cache policies one simulated CloudFront holds.
+ *
+ * Policies are found by ID, which is what a cache Behavior's `cachePolicyId`
+ * names, and by name, which is what decides whether a new one may be stored.
+ *
+ * AWS's seven managed policies are held apart from the ones a template
+ * creates. CloudFront keeps them in its own namespace, so a template may
+ * create a policy called `CachingDisabled` of its own, and deleting the stack
+ * that created it leaves the managed one where it was.
+ */
+export declare class SimCloudFrontCachePolicyRegistry {
+    private readonly policies;
+    private readonly managedPolicies;
+    /**
+     * Store a policy a template created, refusing a name another such policy
+     * already holds as CloudFront does.
+     */
+    add(policy: SimCloudFrontCachePolicy): void;
+    /**
+     * Forget a policy.
+     */
+    remove(policyId: SimCloudFrontCachePolicyId): void;
+    /**
+     * Get a policy by ID, whether a template created it or AWS manages it.
+     */
+    byId(policyId: SimCloudFrontCachePolicyId | string): SimCloudFrontCachePolicy | undefined;
+    /**
+     * Get a policy a template created, by name.
+     *
+     * A managed policy is left out. Its name belongs to CloudFront's own
+     * namespace, and this is what decides whether a template may store a policy
+     * under a name.
+     */
+    byName(policyName: string): SimCloudFrontCachePolicy | undefined;
+}

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy-registry.js

@@ -0,0 +1,50 @@
+import { SimCloudFrontCachePolicyAlreadyExists } from "../error/sim-cloudfront.error.js";
+import { simCfManagedCachePolicies } from "./sim-cf-managed-cache-policies.js";
+/**
+ * The cache policies one simulated CloudFront holds.
+ *
+ * Policies are found by ID, which is what a cache Behavior's `cachePolicyId`
+ * names, and by name, which is what decides whether a new one may be stored.
+ *
+ * AWS's seven managed policies are held apart from the ones a template
+ * creates. CloudFront keeps them in its own namespace, so a template may
+ * create a policy called `CachingDisabled` of its own, and deleting the stack
+ * that created it leaves the managed one where it was.
+ */
+export class SimCloudFrontCachePolicyRegistry {
+    policies = new Map();
+    managedPolicies = simCfManagedCachePolicies();
+    /**
+     * Store a policy a template created, refusing a name another such policy
+     * already holds as CloudFront does.
+     */
+    add(policy) {
+        if (this.byName(policy.name) !== undefined) {
+            throw new SimCloudFrontCachePolicyAlreadyExists(`Sim CloudFront cache policy ${policy.name} already exists`);
+        }
+        this.policies.set(policy.id, policy);
+    }
+    /**
+     * Forget a policy.
+     */
+    remove(policyId) {
+        this.policies.delete(policyId);
+    }
+    /**
+     * Get a policy by ID, whether a template created it or AWS manages it.
+     */
+    byId(policyId) {
+        const id = policyId;
+        return this.policies.get(id) ?? this.managedPolicies.get(id);
+    }
+    /**
+     * Get a policy a template created, by name.
+     *
+     * A managed policy is left out. Its name belongs to CloudFront's own
+     * namespace, and this is what decides whether a template may store a policy
+     * under a name.
+     */
+    byName(policyName) {
+        return this.policies.values().find((policy) => policy.name === policyName);
+    }
+}

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy.d.ts

@@ -0,0 +1,35 @@
+import type { Brand } from "../../../util/brand.type.js";
+import { SimCloudFrontCacheKey } from "./sim-cf-cache-key.js";
+export type SimCloudFrontCachePolicyId = Brand<string, "SimCloudFrontCachePolicyId">;
+interface SimCloudFrontCachePolicyProperties {
+    readonly id?: SimCloudFrontCachePolicyId;
+    readonly name: string;
+    readonly comment?: string | undefined;
+    readonly minTtlSec?: number;
+    readonly defaultTtlSec?: number;
+    readonly maxTtlSec?: number;
+    readonly cacheKey?: SimCloudFrontCacheKey;
+}
+/**
+ * Simulated CloudFront cache policy.
+ *
+ * A cache policy decides what a cache Behavior keys its cache on and how long
+ * an object stays there. This simulation holds the policy under its ID, along
+ * with its three TTLs and its cache key, and keys the Distribution's cache on
+ * it. A `MaxTTL` of zero is read as a Behavior that caches nothing, and the
+ * other two settle how long an entry lives against what the Origin asked for.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
+ */
+export declare class SimCloudFrontCachePolicy {
+    readonly id: SimCloudFrontCachePolicyId;
+    readonly name: string;
+    readonly comment: string | undefined;
+    readonly minTtlSec: number;
+    readonly defaultTtlSec: number;
+    readonly maxTtlSec: number;
+    readonly cacheKey: SimCloudFrontCacheKey;
+    constructor(properties: SimCloudFrontCachePolicyProperties);
+}
+export type SimCloudFrontCachePolicyMap = Map<SimCloudFrontCachePolicyId, SimCloudFrontCachePolicy>;
+export {};

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy.js

@@ -0,0 +1,49 @@
+import { randomUUID } from "node:crypto";
+import { SimCloudFrontCacheKey } from "./sim-cf-cache-key.js";
+const daySeconds = 86_400;
+const yearSeconds = 31_536_000;
+/**
+ * Simulated CloudFront cache policy.
+ *
+ * A cache policy decides what a cache Behavior keys its cache on and how long
+ * an object stays there. This simulation holds the policy under its ID, along
+ * with its three TTLs and its cache key, and keys the Distribution's cache on
+ * it. A `MaxTTL` of zero is read as a Behavior that caches nothing, and the
+ * other two settle how long an entry lives against what the Origin asked for.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
+ */
+export class SimCloudFrontCachePolicy {
+    id;
+    name;
+    comment;
+    minTtlSec;
+    defaultTtlSec;
+    maxTtlSec;
+    cacheKey;
+    constructor(properties) {
+        this.id = properties.id ?? randomUUID();
+        this.name = properties.name;
+        this.comment = properties.comment;
+        this.minTtlSec = properties.minTtlSec ?? 0;
+        this.defaultTtlSec =
+            properties.defaultTtlSec ?? Math.max(daySeconds, this.minTtlSec);
+        this.maxTtlSec =
+            properties.maxTtlSec ?? maxTtlDefault(this.minTtlSec, this.defaultTtlSec);
+        this.cacheKey = properties.cacheKey ?? new SimCloudFrontCacheKey();
+    }
+}
+/**
+ * The `MaxTTL` CloudFront settles on where a policy left it out.
+ *
+ * It is a year, except where a longer `MinTTL` or `DefaultTTL` would sit above
+ * it, in which case CloudFront takes the `DefaultTTL` rather than capping the
+ * policy below its own floor.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html
+ */
+function maxTtlDefault(minTtlSec, defaultTtlSec) {
+    return minTtlSec > yearSeconds || defaultTtlSec > yearSeconds
+        ? defaultTtlSec
+        : yearSeconds;
+}

package/dist/service/cloudfront/cache-policy/sim-cf-managed-cache-policies.d.ts

@@ -0,0 +1,33 @@
+import { type SimCloudFrontCachePolicyMap } from "./sim-cf-cache-policy.js";
+/**
+ * The IDs AWS publishes for its managed cache policies.
+ *
+ * A template names one of these directly. CDK's `CachePolicy` statics carry
+ * the same seven, and synthesize the ID into a Behavior's `CachePolicyId` with
+ * no Resource behind it.
+ */
+export declare const simCfManagedCachePolicyIds: {
+    readonly amplify: "2e54312d-136d-493c-8eb9-b001f22f67d2";
+    readonly cachingOptimized: "658327ea-f89d-4fab-a63d-7e88639e58f6";
+    readonly cachingOptimizedForUncompressedObjects: "b2884449-e4de-46a7-ac36-70bc7f1ddd6d";
+    readonly cachingDisabled: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
+    readonly elementalMediaPackage: "08627262-05a9-4f76-9ded-b50ca2e3a84f";
+    readonly useOriginCacheControlHeaders: "83da9c7e-98b4-4e11-a168-04f0df8e2c65";
+    readonly useOriginCacheControlHeadersQueryStrings: "4cc15a8a-d715-48a4-82b8-cc0b614638fe";
+};
+/**
+ * The seven managed cache policies, built fresh for one simulated CloudFront.
+ *
+ * CloudFront owns these and every account has them, so a Behavior can name one
+ * without a template creating anything. Each carries the ID, the name, the
+ * TTLs and the cache key AWS publishes for it, so a Behavior on
+ * `CachingOptimized` here holds what one in an account holds.
+ *
+ * The normalized `Accept-Encoding` header AWS lists in some of these keys is
+ * not a header name in the whitelist. It is what the two `EnableAcceptEncoding`
+ * flags put in the key, which is why a policy carrying no header at all still
+ * caches a compressed object apart from an uncompressed one.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
+ */
+export declare function simCfManagedCachePolicies(): SimCloudFrontCachePolicyMap;