@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/cloudfront/cache-policy/sim-cf-managed-cache-policies.js

@@ -0,0 +1,132 @@
+import { SimCloudFrontCacheKey } from "./sim-cf-cache-key.js";
+import { SimCloudFrontCachePolicy, } from "./sim-cf-cache-policy.js";
+/**
+ * The IDs AWS publishes for its managed cache policies.
+ *
+ * A template names one of these directly. CDK's `CachePolicy` statics carry
+ * the same seven, and synthesize the ID into a Behavior's `CachePolicyId` with
+ * no Resource behind it.
+ */
+export const simCfManagedCachePolicyIds = {
+    amplify: "2e54312d-136d-493c-8eb9-b001f22f67d2",
+    cachingOptimized: "658327ea-f89d-4fab-a63d-7e88639e58f6",
+    cachingOptimizedForUncompressedObjects: "b2884449-e4de-46a7-ac36-70bc7f1ddd6d",
+    cachingDisabled: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+    elementalMediaPackage: "08627262-05a9-4f76-9ded-b50ca2e3a84f",
+    useOriginCacheControlHeaders: "83da9c7e-98b4-4e11-a168-04f0df8e2c65",
+    useOriginCacheControlHeadersQueryStrings: "4cc15a8a-d715-48a4-82b8-cc0b614638fe",
+};
+const daySeconds = 86_400;
+const yearSeconds = 31_536_000;
+/**
+ * The headers the two UseOriginCacheControlHeaders policies key on. They
+ * differ from each other in their query strings alone.
+ */
+const originCacheControlHeaders = [
+    "Host",
+    "Origin",
+    "X-HTTP-Method-Override",
+    "X-HTTP-Method",
+    "X-Method-Override",
+];
+/**
+ * The seven managed cache policies, built fresh for one simulated CloudFront.
+ *
+ * CloudFront owns these and every account has them, so a Behavior can name one
+ * without a template creating anything. Each carries the ID, the name, the
+ * TTLs and the cache key AWS publishes for it, so a Behavior on
+ * `CachingOptimized` here holds what one in an account holds.
+ *
+ * The normalized `Accept-Encoding` header AWS lists in some of these keys is
+ * not a header name in the whitelist. It is what the two `EnableAcceptEncoding`
+ * flags put in the key, which is why a policy carrying no header at all still
+ * caches a compressed object apart from an uncompressed one.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
+ */
+export function simCfManagedCachePolicies() {
+    const policies = [
+        managedCachePolicy(simCfManagedCachePolicyIds.amplify, "Amplify", {
+            minTtlSec: 2,
+            defaultTtlSec: 2,
+            maxTtlSec: 600,
+            cacheKey: new SimCloudFrontCacheKey({
+                cookieBehavior: "all",
+                headerBehavior: "whitelist",
+                headers: ["Authorization", "CloudFront-Viewer-Country", "Host"],
+                queryStringBehavior: "all",
+                enableAcceptEncodingGzip: true,
+                enableAcceptEncodingBrotli: true,
+            }),
+        }),
+        managedCachePolicy(simCfManagedCachePolicyIds.cachingOptimized, "CachingOptimized", {
+            minTtlSec: 1,
+            defaultTtlSec: daySeconds,
+            maxTtlSec: yearSeconds,
+            cacheKey: new SimCloudFrontCacheKey({
+                enableAcceptEncodingGzip: true,
+                enableAcceptEncodingBrotli: true,
+            }),
+        }),
+        managedCachePolicy(simCfManagedCachePolicyIds.cachingOptimizedForUncompressedObjects, "CachingOptimizedForUncompressedObjects", {
+            minTtlSec: 1,
+            defaultTtlSec: daySeconds,
+            maxTtlSec: yearSeconds,
+            cacheKey: new SimCloudFrontCacheKey(),
+        }),
+        managedCachePolicy(simCfManagedCachePolicyIds.cachingDisabled, "CachingDisabled", {
+            minTtlSec: 0,
+            defaultTtlSec: 0,
+            maxTtlSec: 0,
+            cacheKey: new SimCloudFrontCacheKey(),
+        }),
+        managedCachePolicy(simCfManagedCachePolicyIds.elementalMediaPackage, "Elemental-MediaPackage", {
+            minTtlSec: 0,
+            defaultTtlSec: daySeconds,
+            maxTtlSec: yearSeconds,
+            cacheKey: new SimCloudFrontCacheKey({
+                headerBehavior: "whitelist",
+                headers: ["Origin"],
+                queryStringBehavior: "whitelist",
+                queryStrings: ["aws.manifestfilter", "start", "end", "m"],
+                enableAcceptEncodingGzip: true,
+            }),
+        }),
+        managedCachePolicy(simCfManagedCachePolicyIds.useOriginCacheControlHeaders, "UseOriginCacheControlHeaders", {
+            minTtlSec: 0,
+            defaultTtlSec: 0,
+            maxTtlSec: yearSeconds,
+            cacheKey: new SimCloudFrontCacheKey({
+                cookieBehavior: "all",
+                headerBehavior: "whitelist",
+                headers: originCacheControlHeaders,
+                enableAcceptEncodingGzip: true,
+                enableAcceptEncodingBrotli: true,
+            }),
+        }),
+        managedCachePolicy(simCfManagedCachePolicyIds.useOriginCacheControlHeadersQueryStrings, "UseOriginCacheControlHeaders-QueryStrings", {
+            minTtlSec: 0,
+            defaultTtlSec: 0,
+            maxTtlSec: yearSeconds,
+            cacheKey: new SimCloudFrontCacheKey({
+                cookieBehavior: "all",
+                headerBehavior: "whitelist",
+                headers: originCacheControlHeaders,
+                queryStringBehavior: "all",
+                enableAcceptEncodingGzip: true,
+                enableAcceptEncodingBrotli: true,
+            }),
+        }),
+    ];
+    return new Map(policies.map((policy) => [policy.id, policy]));
+}
+/**
+ * One managed policy, under the ID, the name and the settings AWS gives it.
+ */
+function managedCachePolicy(id, name, settings) {
+    return new SimCloudFrontCachePolicy({
+        id: id,
+        name,
+        ...settings,
+    });
+}

package/dist/service/cloudfront/cff/function-code-input/cff-function-code-input.d.ts

@@ -7,6 +7,14 @@ type FunctionCodeInput = SimCreateFunctionCommand["input"]["FunctionCode"];
  * CloudFront CreateFunction Command input FunctionCode.
  */
 export declare function makeCffFunctionCodeInput(handlerFunction: CloudFrontFunction.Handler): FunctionCodeInput;
+/**
+ * The source a Function reports as the code it was created with.
+ *
+ * A Function created from source keeps the bytes it was given. One created
+ * from a handler function reference was never given any source, so what it
+ * keeps is that handler's own source text, which is the code it runs.
+ */
+export declare function cffFunctionCodeSource(functionCodeInput: FunctionCodeInput): Uint8Array;
 /**
  * A little trick to allow passing a handler function into CreateFunctionCommand
  * input as if it were a Uint8Array without TypeScript complaining.

package/dist/service/cloudfront/cff/function-code-input/cff-function-code-input.js

@@ -9,6 +9,19 @@ export function makeCffFunctionCodeInput(handlerFunction) {
     stowaway.stowawayHandlerFunction(handlerFunction);
     return stowaway;
 }
+/**
+ * The source a Function reports as the code it was created with.
+ *
+ * A Function created from source keeps the bytes it was given. One created
+ * from a handler function reference was never given any source, so what it
+ * keeps is that handler's own source text, which is the code it runs.
+ */
+export function cffFunctionCodeSource(functionCodeInput) {
+    if (functionCodeInput instanceof CffUint8ArrayStowaway) {
+        return Buffer.from(functionCodeInput.handlerFunction.toString());
+    }
+    return functionCodeInput ?? new Uint8Array();
+}
 /**
  * A little trick to allow passing a handler function into CreateFunctionCommand
  * input as if it were a Uint8Array without TypeScript complaining.

package/dist/service/cloudfront/cff/sim-cf-function-commands.d.ts

@@ -0,0 +1,52 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAwsCaller } from "../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimCreateFunctionCommand, SimCreateFunctionCommandOutput } from "../command/create-function/create-function.command.js";
+import { type SimCloudFrontFunctionMap } from "../command/create-function/create-function.handler.js";
+import type { SimDeleteFunctionCommand, SimDeleteFunctionCommandOutput } from "../command/delete-function/delete-function.command.js";
+import type { SimDescribeFunctionCommand, SimDescribeFunctionCommandOutput, SimGetFunctionCommand, SimGetFunctionCommandOutput, SimListFunctionsCommand, SimListFunctionsCommandOutput } from "../command/function/sim-cf-function-command.types.js";
+import type { SimCloudFrontKeyValueStoreRegistry } from "../key-value-store/sim-cf-key-value-store-registry.js";
+interface SimCfFunctionCommandsProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly cloudFrontFunctions: SimCloudFrontFunctionMap;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+    readonly keyValueStores: SimCloudFrontKeyValueStoreRegistry;
+}
+interface FunctionRequestOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The CloudFront Function commands on the CloudFront client.
+ *
+ * They are grouped here rather than beside the Distribution commands on
+ * SimCloudFrontCommands because they work on their own state, the Account's
+ * Functions, and because there are enough of them to be their own thing.
+ */
+export declare class SimCfFunctionCommands {
+    private readonly writeState;
+    private readonly access;
+    constructor(properties: SimCfFunctionCommandsProperties);
+    /**
+     * Handle a Create Function Command from the SDK.
+     */
+    createFunction(command: SimCreateFunctionCommand, options?: FunctionRequestOptions): Promise<SimCreateFunctionCommandOutput>;
+    /**
+     * Handle a Delete Function Command from the SDK.
+     */
+    deleteFunction(command: SimDeleteFunctionCommand, options?: FunctionRequestOptions): Promise<SimDeleteFunctionCommandOutput>;
+    /**
+     * Handle a List Functions Command from the SDK.
+     */
+    listFunctions(command: SimListFunctionsCommand, options?: FunctionRequestOptions): Promise<SimListFunctionsCommandOutput>;
+    /**
+     * Handle a Describe Function Command from the SDK.
+     */
+    describeFunction(command: SimDescribeFunctionCommand, options?: FunctionRequestOptions): Promise<SimDescribeFunctionCommandOutput>;
+    /**
+     * Handle a Get Function Command from the SDK.
+     */
+    getFunction(command: SimGetFunctionCommand, options?: FunctionRequestOptions): Promise<SimGetFunctionCommandOutput>;
+}
+export {};

package/dist/service/cloudfront/cff/sim-cf-function-commands.js

@@ -0,0 +1,51 @@
+import { CreateFunctionCommandHandler, } from "../command/create-function/create-function.handler.js";
+import { DeleteFunctionCommandHandler } from "../command/delete-function/delete-function.handler.js";
+import { SimCfDescribeFunction } from "../command/function/sim-cf-describe-function.js";
+import { SimCfFunctionAccess } from "../command/function/sim-cf-function-access.js";
+import { SimCfGetFunction } from "../command/function/sim-cf-get-function.js";
+import { SimCfListFunctions } from "../command/function/sim-cf-list-functions.js";
+/**
+ * The CloudFront Function commands on the CloudFront client.
+ *
+ * They are grouped here rather than beside the Distribution commands on
+ * SimCloudFrontCommands because they work on their own state, the Account's
+ * Functions, and because there are enough of them to be their own thing.
+ */
+export class SimCfFunctionCommands {
+    writeState;
+    access;
+    constructor(properties) {
+        this.writeState = properties;
+        this.access = new SimCfFunctionAccess(properties);
+    }
+    /**
+     * Handle a Create Function Command from the SDK.
+     */
+    async createFunction(command, options) {
+        return await new CreateFunctionCommandHandler(this.writeState).handle(command, options);
+    }
+    /**
+     * Handle a Delete Function Command from the SDK.
+     */
+    async deleteFunction(command, options) {
+        return await new DeleteFunctionCommandHandler(this.writeState).handle(command, options);
+    }
+    /**
+     * Handle a List Functions Command from the SDK.
+     */
+    async listFunctions(command, options) {
+        return await new SimCfListFunctions(this.access).handle(command, options);
+    }
+    /**
+     * Handle a Describe Function Command from the SDK.
+     */
+    async describeFunction(command, options) {
+        return await new SimCfDescribeFunction(this.access).handle(command, options);
+    }
+    /**
+     * Handle a Get Function Command from the SDK.
+     */
+    async getFunction(command, options) {
+        return await new SimCfGetFunction(this.access).handle(command, options);
+    }
+}

package/dist/service/cloudfront/cff/sim-cff-configuration.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The JavaScript runtime a CloudFront Function is written against.
+ */
+export type SimCloudFrontFunctionRuntime = "cloudfront-js-1.0" | "cloudfront-js-2.0";
+export interface SimCffConfigurationProperties {
+    /** The `FunctionConfig` comment, which CloudFront requires and reports. */
+    readonly comment?: string | undefined;
+    /** The `FunctionConfig` runtime this Function is written against. */
+    readonly runtime?: SimCloudFrontFunctionRuntime | undefined;
+    /** The source this Function was created with, which GetFunction reports. */
+    readonly functionCode?: Uint8Array | undefined;
+    /** When this Function was created, off the simulation's clock. */
+    readonly createdTime?: Date | undefined;
+}
+/**
+ * What a CloudFront Function was created with, which every read of it reports.
+ *
+ * This is the `FunctionConfig` and `FunctionMetadata` pair the API answers
+ * with, held together because they are written once at creation and read
+ * together afterwards. The Function itself is what runs; this is what it says
+ * about itself.
+ */
+export declare class SimCffConfiguration {
+    readonly comment: string;
+    readonly runtime: SimCloudFrontFunctionRuntime;
+    readonly functionCode: Uint8Array;
+    /**
+     * When this Function was created, and when it was last changed.
+     *
+     * They are the same instant here. What moves the modified time apart from
+     * the created time in CloudFront is UpdateFunction and PublishFunction, and
+     * neither is simulated yet.
+     */
+    readonly createdTime: Date;
+    readonly lastModifiedTime: Date;
+    /**
+     * The version of this Function a write has to carry to be accepted.
+     */
+    readonly etag: string;
+    constructor(properties?: SimCffConfigurationProperties);
+}

package/dist/service/cloudfront/cff/sim-cff-configuration.js

@@ -0,0 +1,34 @@
+import { makeSimCloudFrontETag } from "../sim-cf-etag.js";
+/**
+ * What a CloudFront Function was created with, which every read of it reports.
+ *
+ * This is the `FunctionConfig` and `FunctionMetadata` pair the API answers
+ * with, held together because they are written once at creation and read
+ * together afterwards. The Function itself is what runs; this is what it says
+ * about itself.
+ */
+export class SimCffConfiguration {
+    comment;
+    runtime;
+    functionCode;
+    /**
+     * When this Function was created, and when it was last changed.
+     *
+     * They are the same instant here. What moves the modified time apart from
+     * the created time in CloudFront is UpdateFunction and PublishFunction, and
+     * neither is simulated yet.
+     */
+    createdTime;
+    lastModifiedTime;
+    /**
+     * The version of this Function a write has to carry to be accepted.
+     */
+    etag = makeSimCloudFrontETag();
+    constructor(properties = {}) {
+        this.comment = properties.comment ?? "";
+        this.runtime = properties.runtime ?? "cloudfront-js-2.0";
+        this.functionCode = properties.functionCode ?? new Uint8Array();
+        this.createdTime = properties.createdTime ?? new Date();
+        this.lastModifiedTime = this.createdTime;
+    }
+}

package/dist/service/cloudfront/cff/sim-cff-search-distribution.fixture.js

@@ -2,6 +2,7 @@ import { assertNonNullable } from "@kensio/smartass";
 import { SimAwsLocalUrl } from "../../../serve/http/url/sim-aws-local-url.js";
 import { simHttpApiLambdaProxyFactory } from "../../apigatewayv2/api/sim-http-api-lambda-proxy.factory.js";
 import { simCfDistroConfigFactory } from "../distribution/sim-cf-distro-config.factory.js";
+import { simCfManagedOriginRequestPolicyIds } from "../origin-request-policy/sim-cf-managed-origin-request-policies.js";
 import { makeCffFunctionCodeInput } from "./function-code-input/cff-function-code-input.js";
 /**
  * Put a viewer-request Function in front of an Origin echoing the query it is
@@ -36,6 +37,9 @@ export async function searchDistributionUrl(simAws, path, handler) {
                 DefaultCacheBehavior: {
                     TargetOriginId: "SiteOrigin",
                     ViewerProtocolPolicy: "allow-all",
+                    // The Origin echoes the query it is sent, which reaches it only
+                    // where the Behavior forwards it.
+                    OriginRequestPolicyId: simCfManagedOriginRequestPolicyIds.allViewer,
                     FunctionAssociations: {
                         Items: [
                             {

package/dist/service/cloudfront/cff/sim-cff-stage.d.ts

@@ -0,0 +1,23 @@
+import type { SimCloudFrontFunction } from "./sim-cloudfront-function.js";
+/**
+ * The two stages a CloudFront Function can be read from.
+ *
+ * A Function is created into DEVELOPMENT and reaches LIVE once it is
+ * published. LIVE is the copy a Distribution runs.
+ */
+export type SimCloudFrontFunctionStage = "DEVELOPMENT" | "LIVE";
+/**
+ * Read the stage a request asked for.
+ *
+ * CloudFront defaults an omitted `Stage` to DEVELOPMENT, the copy a Function
+ * is created into, and refuses a value that names neither stage.
+ */
+export declare function simCffRequestedStage(stage: string | undefined): SimCloudFrontFunctionStage;
+/**
+ * Whether a Function can be read from a stage.
+ *
+ * Every Function is in DEVELOPMENT from the moment it is created. It reaches
+ * LIVE once it is published, so a Function still waiting to publish answers to
+ * DEVELOPMENT alone.
+ */
+export declare function simCffInStage(cloudFrontFunction: SimCloudFrontFunction, stage: SimCloudFrontFunctionStage): boolean;

package/dist/service/cloudfront/cff/sim-cff-stage.js

@@ -0,0 +1,30 @@
+import { SimCloudFrontInvalidArgument } from "../error/sim-cloudfront.error.js";
+const simCffStages = new Set([
+    "DEVELOPMENT",
+    "LIVE",
+]);
+/**
+ * Read the stage a request asked for.
+ *
+ * CloudFront defaults an omitted `Stage` to DEVELOPMENT, the copy a Function
+ * is created into, and refuses a value that names neither stage.
+ */
+export function simCffRequestedStage(stage) {
+    if (stage === undefined) {
+        return "DEVELOPMENT";
+    }
+    if (!simCffStages.has(stage)) {
+        throw new SimCloudFrontInvalidArgument(`CloudFront Function stage ${stage} is neither DEVELOPMENT nor LIVE`);
+    }
+    return stage;
+}
+/**
+ * Whether a Function can be read from a stage.
+ *
+ * Every Function is in DEVELOPMENT from the moment it is created. It reaches
+ * LIVE once it is published, so a Function still waiting to publish answers to
+ * DEVELOPMENT alone.
+ */
+export function simCffInStage(cloudFrontFunction, stage) {
+    return stage === "DEVELOPMENT" || cloudFrontFunction.status !== "UNPUBLISHED";
+}

package/dist/service/cloudfront/cff/sim-cloudfront-function.d.ts

@@ -4,9 +4,10 @@ import type { Brand } from "../../../util/brand.type.js";
 import type { SimArn } from "../../aws/arn.js";
 import { type SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimCloudFrontKeyValueStore } from "../key-value-store/sim-cf-key-value-store.js";
+import { SimCffConfiguration, type SimCffConfigurationProperties } from "./sim-cff-configuration.js";
 export type SimCloudFrontFunctionName = Brand<string, "SimCloudFrontFunctionName">;
 export type CloudFrontFunctionStatus = "UNPUBLISHED" | "UNASSOCIATED" | "ASSOCIATED";
-interface SimCloudFrontFunctionProperties {
+interface SimCloudFrontFunctionProperties extends SimCffConfigurationProperties {
     name: SimCloudFrontFunctionName | string;
     status?: CloudFrontFunctionStatus;
     readonly accountId?: SimAwsAccountId;
@@ -22,6 +23,10 @@ export declare class SimCloudFrontFunction {
     #private;
     readonly name: SimCloudFrontFunctionName;
     readonly accountId: SimAwsAccountId;
+    /**
+     * What this Function was created with, which every read of it reports.
+     */
+    readonly config: SimCffConfiguration;
     private readonly handlerFunction;
     private readonly eventAdapter;
     private readonly associatedKeyValueStore;

package/dist/service/cloudfront/cff/sim-cloudfront-function.js

@@ -1,5 +1,6 @@
 import { SimCffEventAdapter } from "./adapter/sim-cff-event-adapter.js";
 import { makeSimAwsAccountId, } from "../../aws/sim-aws-account.js";
+import { SimCffConfiguration, } from "./sim-cff-configuration.js";
 import { cffCloudFrontModule } from "./kvs/cff-cloudfront-module.js";
 import { simCffCloudFrontGlobal } from "./kvs/sim-cff-cloudfront-global.js";
 export const defaultCffHandler = (event) => {
@@ -14,6 +15,10 @@ export const defaultCffHandler = (event) => {
 export class SimCloudFrontFunction {
     name;
     accountId;
+    /**
+     * What this Function was created with, which every read of it reports.
+     */
+    config;
     #status;
     handlerFunction;
     eventAdapter;
@@ -23,6 +28,7 @@ export class SimCloudFrontFunction {
         this.name = name;
         this.#status = status;
         this.accountId = accountId;
+        this.config = new SimCffConfiguration(properties);
         this.handlerFunction = handlerFunction;
         this.eventAdapter = eventAdapter;
         this.associatedKeyValueStore = properties.keyValueStore;

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-config.d.ts

@@ -0,0 +1,28 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import { SimCloudFrontCachePolicy } from "../../cache-policy/sim-cf-cache-policy.js";
+/**
+ * Reads an AWS::CloudFront::CachePolicy Resource into a simulated policy.
+ *
+ * The policy carries its `Name`, its `Comment`, its three TTLs and the cache
+ * key of its `ParametersInCacheKeyAndForwardedToOrigin`. A TTL a template left
+ * out falls back to CloudFront's own default rather than to nothing, so a
+ * policy holds what one in an account holds either way. A Resource missing its
+ * `Name` is refused, as CloudFormation refuses one.
+ */
+export declare class SimCfnCfCachePolicyConfig {
+    private readonly resource;
+    private readonly properties;
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    private readonly refuse;
+    constructor(properties: {
+        readonly resource: SimCfnResource;
+        readonly properties: SimCfnTemplateValueRecord;
+    });
+    /**
+     * Build the simulated policy this Resource describes.
+     */
+    build(): SimCloudFrontCachePolicy;
+}

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-config.js

@@ -0,0 +1,71 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+import { SimCloudFrontCachePolicy } from "../../cache-policy/sim-cf-cache-policy.js";
+import { simCfnCfCachePolicyCacheKey } from "./sim-cfn-cf-cache-policy-key.js";
+/**
+ * Reads an AWS::CloudFront::CachePolicy Resource into a simulated policy.
+ *
+ * The policy carries its `Name`, its `Comment`, its three TTLs and the cache
+ * key of its `ParametersInCacheKeyAndForwardedToOrigin`. A TTL a template left
+ * out falls back to CloudFront's own default rather than to nothing, so a
+ * policy holds what one in an account holds either way. A Resource missing its
+ * `Name` is refused, as CloudFormation refuses one.
+ */
+export class SimCfnCfCachePolicyConfig {
+    resource;
+    properties;
+    /**
+     * Refuse this Resource, saying which part of it could not be read.
+     */
+    refuse = (detail) => {
+        throw new Error(`Invalid AWS::CloudFront::CachePolicy ${this.resource.logicalId}: ${detail}`);
+    };
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.properties = properties.properties;
+    }
+    /**
+     * Build the simulated policy this Resource describes.
+     */
+    build() {
+        const { refuse } = this;
+        const config = this.properties["CachePolicyConfig"];
+        if (!isRecord(config)) {
+            return refuse("CachePolicyConfig must be an object");
+        }
+        const name = config["Name"];
+        if (typeof name !== "string") {
+            return refuse("CachePolicyConfig needs a string Name");
+        }
+        const comment = config["Comment"];
+        const minTtlSec = ttlSeconds(config, "MinTTL", refuse);
+        const defaultTtlSec = ttlSeconds(config, "DefaultTTL", refuse);
+        const maxTtlSec = ttlSeconds(config, "MaxTTL", refuse);
+        return new SimCloudFrontCachePolicy({
+            name,
+            ...(typeof comment === "string" && { comment }),
+            ...(minTtlSec !== undefined && { minTtlSec }),
+            ...(defaultTtlSec !== undefined && { defaultTtlSec }),
+            ...(maxTtlSec !== undefined && { maxTtlSec }),
+            cacheKey: simCfnCfCachePolicyCacheKey(config, refuse),
+        });
+    }
+}
+/**
+ * One TTL, or nothing where the template left it out for CloudFront's default
+ * to stand in.
+ *
+ * A template here is often a JavaScript object rather than parsed JSON, so a
+ * fraction, a negative or a NaN can reach this where a deployed template could
+ * not carry one, and none of them is a length of time an object could sit in a
+ * cache for.
+ */
+function ttlSeconds(config, field, refuse) {
+    // oxlint-disable-next-line security/detect-object-injection
+    const value = config[field];
+    if (value === undefined) {
+        return undefined;
+    }
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0
+        ? value
+        : refuse(`CachePolicyConfig ${field} must be a whole number of seconds`);
+}

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-creator.d.ts

@@ -0,0 +1,24 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCloudFront } from "../../sim-cloudfront.js";
+import type { SimCloudFrontCachePolicy } from "../../cache-policy/sim-cf-cache-policy.js";
+interface SimCfnCfCachePolicyCreatorProperties {
+    readonly cloudFront: SimCloudFront;
+}
+/**
+ * Creates simulated cache policies from AWS::CloudFront::CachePolicy
+ * Resources.
+ */
+export declare class SimCfnCfCachePolicyCreator {
+    private readonly cloudFront;
+    constructor(properties: SimCfnCfCachePolicyCreatorProperties);
+    /**
+     * Create and store the policy one Resource describes.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): SimCloudFrontCachePolicy;
+    /**
+     * Remove a policy created from a Resource.
+     */
+    delete(resource: SimCfnResource): void;
+}
+export {};

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-creator.js

@@ -0,0 +1,32 @@
+import { SimCfnCfCachePolicyConfig } from "./sim-cfn-cf-cache-policy-config.js";
+/**
+ * Creates simulated cache policies from AWS::CloudFront::CachePolicy
+ * Resources.
+ */
+export class SimCfnCfCachePolicyCreator {
+    cloudFront;
+    constructor(properties) {
+        this.cloudFront = properties.cloudFront;
+    }
+    /**
+     * Create and store the policy one Resource describes.
+     */
+    create(resource, properties) {
+        const policy = new SimCfnCfCachePolicyConfig({
+            resource,
+            properties,
+        }).build();
+        this.cloudFront.addCachePolicy(policy);
+        return policy;
+    }
+    /**
+     * Remove a policy created from a Resource.
+     */
+    delete(resource) {
+        const policy = resource.simResource;
+        if (policy === undefined) {
+            return;
+        }
+        this.cloudFront.removeCachePolicy(policy.id);
+    }
+}

package/dist/service/cloudfront/cfn/cache-policy/sim-cfn-cf-cache-policy-key.d.ts

@@ -0,0 +1,10 @@
+import { SimCloudFrontCacheKey } from "../../cache-policy/sim-cf-cache-key.js";
+import { type SimCfnCfPolicyRefuse } from "../policy/sim-cfn-cf-policy-section.js";
+/**
+ * Read the `ParametersInCacheKeyAndForwardedToOrigin` of a
+ * `CachePolicyConfig` into the cache key a policy carries.
+ *
+ * A template leaving the whole thing out gets CloudFront's own `none` in all
+ * three sections, with neither compression flag set.
+ */
+export declare function simCfnCfCachePolicyCacheKey(config: Record<string, unknown>, refuse: SimCfnCfPolicyRefuse): SimCloudFrontCacheKey;