@kensio/yulin 1.20.17 → 1.21.0

package/dist/service/cloudfront/cache/sim-cf-cacheable-request.d.ts

@@ -0,0 +1,35 @@
+import type { SimCloudFrontBehavior } from "../behaviour/sim-cloud-front-behavior.js";
+import type { SimCloudFrontCachePolicy } from "../cache-policy/sim-cf-cache-policy.js";
+import type { SimCloudFront } from "../sim-cloudfront.js";
+interface SimCfCacheableRequestProperties {
+    readonly cloudFront: SimCloudFront;
+    readonly behaviour: SimCloudFrontBehavior;
+    readonly request: Request;
+    readonly edgeId: string;
+}
+/**
+ * A request the Behavior caches, and what decides for how long.
+ */
+export interface SimCfCacheableRequest {
+    /** The key the request is cached under. */
+    readonly key: string;
+    /**
+     * The policy the key came from, whose TTLs settle how long the Origin's
+     * answer is held.
+     */
+    readonly policy: SimCloudFrontCachePolicy;
+}
+/**
+ * The key this request is cached under and the policy that decided it, or none
+ * where the Behavior caches nothing.
+ *
+ * Three things stop a Behavior caching. Its cache policy may be one this
+ * simulation does not hold, including the Behavior that names no policy at
+ * all, and there is nothing to key on and no TTL that is not a guess. Its
+ * policy may cache nothing, which is what a `MaxTTL` of zero says and is how
+ * `CachingDisabled` reaches the Origin every time. Or the request's method may
+ * be outside the Behavior's `CachedMethods`, which is CloudFront's own rule
+ * that a POST is never served from a cache.
+ */
+export declare function simCfCacheableRequest(properties: SimCfCacheableRequestProperties): SimCfCacheableRequest | undefined;
+export {};

package/dist/service/cloudfront/cache/sim-cf-cacheable-request.js

@@ -0,0 +1,32 @@
+import { simCfCacheEntryKey } from "./sim-cf-cache-entry-key.js";
+/**
+ * The key this request is cached under and the policy that decided it, or none
+ * where the Behavior caches nothing.
+ *
+ * Three things stop a Behavior caching. Its cache policy may be one this
+ * simulation does not hold, including the Behavior that names no policy at
+ * all, and there is nothing to key on and no TTL that is not a guess. Its
+ * policy may cache nothing, which is what a `MaxTTL` of zero says and is how
+ * `CachingDisabled` reaches the Origin every time. Or the request's method may
+ * be outside the Behavior's `CachedMethods`, which is CloudFront's own rule
+ * that a POST is never served from a cache.
+ */
+export function simCfCacheableRequest(properties) {
+    const { cloudFront, behaviour, request, edgeId } = properties;
+    if (!cloudFront.cachingEnabled) {
+        return undefined;
+    }
+    const policy = behaviour.cachePolicyId === undefined
+        ? undefined
+        : cloudFront.getCachePolicyById(behaviour.cachePolicyId);
+    if (policy === undefined || policy.maxTtlSec <= 0) {
+        return undefined;
+    }
+    if (!behaviour.cachedMethods.has(request.method.toUpperCase())) {
+        return undefined;
+    }
+    return {
+        key: simCfCacheEntryKey({ request, cacheKey: policy.cacheKey, edgeId }),
+        policy,
+    };
+}

package/dist/service/cloudfront/cache/sim-cf-distribution-cache.d.ts

@@ -0,0 +1,57 @@
+import { type SimClock } from "../../../util/clock/sim-clock.js";
+/**
+ * What one simulated Distribution has cached.
+ *
+ * Real CloudFront caches at each of its points of presence rather than once
+ * per Distribution, which the edge in the key stands for. One cache holds an
+ * entry per edge, and a request arriving at another edge misses.
+ *
+ * An entry leaves the cache two ways. It expires on the simulation's clock
+ * rather than the host's. A test reaches the instant an object goes stale by
+ * advancing simulated time, with no waiting. Or an invalidation clears it ahead
+ * of that instant.
+ *
+ * Storing takes its seconds from the caller. An Origin's answer is held for
+ * what its cache policy allows, and an error's own `ErrorCachingMinTTL` fits
+ * the same call.
+ */
+export declare class SimCfDistributionCache {
+    private readonly entries;
+    private readonly clock;
+    /**
+     * A cache built standalone, outside a Distribution, falls back to the real
+     * clock.
+     */
+    constructor(clock?: SimClock);
+    /**
+     * The response cached under a key, or none where the cache does not hold it.
+     *
+     * An entry that has reached its expiry is dropped here. The request then goes
+     * to the Origin, and what the Origin answers replaces the expired entry.
+     *
+     * What comes back carries `Age`, counted on the simulation's clock from the
+     * instant the Origin's answer was stored. An `Age` the Origin sent is
+     * replaced by the Distribution's own, as CloudFront replaces one.
+     */
+    read(key: string): Response | undefined;
+    /**
+     * Cache a response under a key for a number of seconds, and hand back one to
+     * carry on with.
+     *
+     * Storing reads the response's body, which can only happen once, so the
+     * response the caller continues with is built from the bytes that were
+     * stored rather than being the one passed in. A TTL of no seconds stores
+     * nothing, and the response passed in is handed straight back unread.
+     */
+    store(key: string, response: Response, ttlSec: number): Promise<Response>;
+    /**
+     * Forget every entry an invalidation's paths name, at every edge.
+     *
+     * The path an entry was cached under is read back out of its key, so
+     * matching a batch costs a pass over the keys rather than a second map from
+     * path to entry. Nothing here is keyed on the edge, because an invalidation
+     * reaches every point of presence rather than the one a viewer happened to
+     * arrive at.
+     */
+    clearPaths(paths: readonly string[]): void;
+}

package/dist/service/cloudfront/cache/sim-cf-distribution-cache.js

@@ -0,0 +1,115 @@
+import { SimRealClock } from "../../../util/clock/sim-clock.js";
+import { simCfInvalidationBatchCovers } from "../invalidation/sim-cf-invalidation-path.js";
+import { simCfAgeHeaderName, simCfCacheAgeSec } from "./sim-cf-cache-status.js";
+import { simCfCacheEntryKeyPath } from "./sim-cf-cache-entry-key-path.js";
+/**
+ * The statuses HTTP gives no body, which a Response refuses to be built with
+ * one for.
+ */
+const bodylessStatuses = new Set([101, 103, 204, 205, 304]);
+/**
+ * What one simulated Distribution has cached.
+ *
+ * Real CloudFront caches at each of its points of presence rather than once
+ * per Distribution, which the edge in the key stands for. One cache holds an
+ * entry per edge, and a request arriving at another edge misses.
+ *
+ * An entry leaves the cache two ways. It expires on the simulation's clock
+ * rather than the host's. A test reaches the instant an object goes stale by
+ * advancing simulated time, with no waiting. Or an invalidation clears it ahead
+ * of that instant.
+ *
+ * Storing takes its seconds from the caller. An Origin's answer is held for
+ * what its cache policy allows, and an error's own `ErrorCachingMinTTL` fits
+ * the same call.
+ */
+export class SimCfDistributionCache {
+    entries = new Map();
+    clock;
+    /**
+     * A cache built standalone, outside a Distribution, falls back to the real
+     * clock.
+     */
+    constructor(clock = new SimRealClock()) {
+        this.clock = clock;
+    }
+    /**
+     * The response cached under a key, or none where the cache does not hold it.
+     *
+     * An entry that has reached its expiry is dropped here. The request then goes
+     * to the Origin, and what the Origin answers replaces the expired entry.
+     *
+     * What comes back carries `Age`, counted on the simulation's clock from the
+     * instant the Origin's answer was stored. An `Age` the Origin sent is
+     * replaced by the Distribution's own, as CloudFront replaces one.
+     */
+    read(key) {
+        const entry = this.entries.get(key);
+        if (entry === undefined) {
+            return undefined;
+        }
+        const now = this.clock.now();
+        if (now.getTime() >= entry.expiresAt.getTime()) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        const response = cachedResponse(entry);
+        response.headers.set(simCfAgeHeaderName, String(simCfCacheAgeSec(entry.storedAt, now)));
+        return response;
+    }
+    /**
+     * Cache a response under a key for a number of seconds, and hand back one to
+     * carry on with.
+     *
+     * Storing reads the response's body, which can only happen once, so the
+     * response the caller continues with is built from the bytes that were
+     * stored rather than being the one passed in. A TTL of no seconds stores
+     * nothing, and the response passed in is handed straight back unread.
+     */
+    async store(key, response, ttlSec) {
+        if (!Number.isFinite(ttlSec) || ttlSec <= 0) {
+            return response;
+        }
+        const storedAt = this.clock.now();
+        const entry = {
+            status: response.status,
+            statusText: response.statusText,
+            headers: [...response.headers],
+            body: new Uint8Array(await response.arrayBuffer()),
+            storedAt,
+            expiresAt: new Date(storedAt.getTime() + ttlSec * 1000),
+        };
+        this.entries.set(key, entry);
+        return cachedResponse(entry);
+    }
+    /**
+     * Forget every entry an invalidation's paths name, at every edge.
+     *
+     * The path an entry was cached under is read back out of its key, so
+     * matching a batch costs a pass over the keys rather than a second map from
+     * path to entry. Nothing here is keyed on the edge, because an invalidation
+     * reaches every point of presence rather than the one a viewer happened to
+     * arrive at.
+     */
+    clearPaths(paths) {
+        for (const key of this.entries.keys()) {
+            const path = simCfCacheEntryKeyPath(key);
+            if (path !== undefined && simCfInvalidationBatchCovers(paths, path)) {
+                this.entries.delete(key);
+            }
+        }
+    }
+}
+/**
+ * Build a response from a cached one, which every read needs its own of.
+ *
+ * No `Age` goes on here. A response on its way into the cache has been held
+ * for no time at all, and only one leaving it has an age to report.
+ */
+function cachedResponse(entry) {
+    return new Response(bodylessStatuses.has(entry.status) ? null : entry.body, {
+        status: entry.status,
+        statusText: entry.statusText,
+        headers: new Headers(entry.headers.map(([name, value]) => [name, value])),
+    });
+}

package/dist/service/cloudfront/cache/sim-cf-edge.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The header naming the CloudFront edge a request arrives at.
+ *
+ * CloudFront caches at each of its several hundred points of presence, so a
+ * viewer is never guaranteed the entry another viewer's request stored. A
+ * request naming an edge of its own is answered from that edge's cache, which
+ * is how a test proves its app survives arriving somewhere cold.
+ *
+ * The name follows the `x-sim-aws-*` convention of `simAwsControlHeaderNames`,
+ * and like those headers it states something to the simulator rather than to
+ * the application. Sim CloudFront reads it, drops it from the request, and
+ * nothing downstream of the edge sees it.
+ */
+export declare const simCfEdgeHeaderName = "x-sim-aws-cloudfront-edge";
+/**
+ * The edge a request arrives at when it names none.
+ *
+ * Every request in a test lands here unless the test says otherwise, and a
+ * second request for a key the first one stored is a hit. A header carrying no
+ * value names no edge, and lands here too.
+ */
+export declare const simCfDefaultEdgeId = "default";
+/**
+ * A request and the edge it arrived at.
+ */
+export interface SimCfRequestEdge {
+    readonly edgeId: string;
+    /**
+     * The request with the edge header removed, which is the one the rest of the
+     * pipeline works on.
+     */
+    readonly request: Request;
+}
+/**
+ * Read the edge a request arrived at, and take the header back off it.
+ */
+export declare function simCfRequestEdge(request: Request): SimCfRequestEdge;

package/dist/service/cloudfront/cache/sim-cf-edge.js

@@ -0,0 +1,34 @@
+/**
+ * The header naming the CloudFront edge a request arrives at.
+ *
+ * CloudFront caches at each of its several hundred points of presence, so a
+ * viewer is never guaranteed the entry another viewer's request stored. A
+ * request naming an edge of its own is answered from that edge's cache, which
+ * is how a test proves its app survives arriving somewhere cold.
+ *
+ * The name follows the `x-sim-aws-*` convention of `simAwsControlHeaderNames`,
+ * and like those headers it states something to the simulator rather than to
+ * the application. Sim CloudFront reads it, drops it from the request, and
+ * nothing downstream of the edge sees it.
+ */
+export const simCfEdgeHeaderName = "x-sim-aws-cloudfront-edge";
+/**
+ * The edge a request arrives at when it names none.
+ *
+ * Every request in a test lands here unless the test says otherwise, and a
+ * second request for a key the first one stored is a hit. A header carrying no
+ * value names no edge, and lands here too.
+ */
+export const simCfDefaultEdgeId = "default";
+/**
+ * Read the edge a request arrived at, and take the header back off it.
+ */
+export function simCfRequestEdge(request) {
+    const named = request.headers.get(simCfEdgeHeaderName)?.trim();
+    if (named === undefined || named.length === 0) {
+        return { edgeId: simCfDefaultEdgeId, request };
+    }
+    const headers = new Headers(request.headers);
+    headers.delete(simCfEdgeHeaderName);
+    return { edgeId: named, request: new Request(request, { headers }) };
+}

package/dist/service/cloudfront/cache/sim-cf-error-cache-ttl.d.ts

@@ -0,0 +1,36 @@
+import { type SimCloudFrontCustomErrorResponse } from "../custom-error/sim-cloudfront-custom-error-response.js";
+interface SimCfErrorCacheTtlProperties {
+    /**
+     * The status the Origin answered with, before an origin-response function
+     * or a custom error page could replace it.
+     */
+    readonly originStatus: number;
+    /** The response carrying on towards the viewer. */
+    readonly response: Response;
+    /**
+     * The Distribution's custom error responses, whose `ErrorCachingMinTTL`
+     * decides.
+     */
+    readonly customErrorResponses: readonly SimCloudFrontCustomErrorResponse[];
+}
+/**
+ * How many seconds a Distribution holds an error for, or none where this
+ * answer is no error at all.
+ *
+ * An error has a TTL of its own, and the Origin's cache headers and the
+ * Behavior's cache policy have no say in it. It comes from the custom error
+ * response matching the status, and from CloudFront's ten seconds where the
+ * Distribution configures no rule for that status. An `ErrorCachingMinTTL` of
+ * zero holds the error for no time at all, which is how a Distribution turns
+ * error caching off.
+ *
+ * The Origin's status is what a rule is matched against. A 404 the
+ * Distribution answers with a 200 error page is still held as the error it
+ * was, for the seconds the 404's own rule allows. An error that only an
+ * origin-response function made has no Origin error behind it, and its own
+ * status stands in.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HTTPStatusCodes.html
+ */
+export declare function simCfErrorCacheTtlSec(properties: SimCfErrorCacheTtlProperties): number | undefined;
+export {};

package/dist/service/cloudfront/cache/sim-cf-error-cache-ttl.js

@@ -0,0 +1,28 @@
+import { simCloudFrontDefaultErrorCachingMinTtlSec, } from "../custom-error/sim-cloudfront-custom-error-response.js";
+/**
+ * How many seconds a Distribution holds an error for, or none where this
+ * answer is no error at all.
+ *
+ * An error has a TTL of its own, and the Origin's cache headers and the
+ * Behavior's cache policy have no say in it. It comes from the custom error
+ * response matching the status, and from CloudFront's ten seconds where the
+ * Distribution configures no rule for that status. An `ErrorCachingMinTTL` of
+ * zero holds the error for no time at all, which is how a Distribution turns
+ * error caching off.
+ *
+ * The Origin's status is what a rule is matched against. A 404 the
+ * Distribution answers with a 200 error page is still held as the error it
+ * was, for the seconds the 404's own rule allows. An error that only an
+ * origin-response function made has no Origin error behind it, and its own
+ * status stands in.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HTTPStatusCodes.html
+ */
+export function simCfErrorCacheTtlSec(properties) {
+    const { originStatus, response, customErrorResponses } = properties;
+    const errorStatus = originStatus >= 400 ? originStatus : response.status;
+    if (errorStatus < 400) {
+        return undefined;
+    }
+    return (customErrorResponses.find((customErrorResponse) => customErrorResponse.errorCode === errorStatus)?.errorCachingMinTtlSec ?? simCloudFrontDefaultErrorCachingMinTtlSec);
+}

package/dist/service/cloudfront/cache/sim-cf-http-date.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The instant an HTTP date names, in milliseconds, or none where the value is
+ * not one of the three formats HTTP allows.
+ *
+ * The check matters because `Date.parse` reads far more than HTTP does. It
+ * takes `12/31/2099` as a date in 2099 and `0` as the start of the year 2000,
+ * and an HTTP cache is required to treat both as an object that has already
+ * expired.
+ *
+ * asctime states no zone and HTTP reads it as GMT, while `Date.parse` would
+ * read it in the host's own. It is rewritten with the zone spelled out.
+ *
+ * https://www.rfc-editor.org/rfc/rfc9110#name-date-time-formats
+ */
+export declare function simCfHttpDateInstant(value: string): number | undefined;

package/dist/service/cloudfront/cache/sim-cf-http-date.js

@@ -0,0 +1,40 @@
+/**
+ * IMF-fixdate, which every sender is required to use. `Sun, 06 Nov 1994
+ * 08:49:37 GMT`.
+ */
+const imfFixdate = /^[A-Za-z]{3}, \d{2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+/**
+ * The obsolete RFC 850 format, which a recipient still has to read.
+ * `Sunday, 06-Nov-94 08:49:37 GMT`.
+ */
+const rfc850Date = /^[A-Za-z]{6,9}, \d{2}-[A-Za-z]{3}-\d{2} \d{2}:\d{2}:\d{2} GMT$/;
+/**
+ * The obsolete asctime format, which carries no zone. `Sun Nov  6 08:49:37
+ * 1994`.
+ */
+const asctimeDate = /^[A-Za-z]{3} ([A-Za-z]{3}) {1,2}(\d{1,2}) (\d{2}:\d{2}:\d{2}) (\d{4})$/;
+/**
+ * The instant an HTTP date names, in milliseconds, or none where the value is
+ * not one of the three formats HTTP allows.
+ *
+ * The check matters because `Date.parse` reads far more than HTTP does. It
+ * takes `12/31/2099` as a date in 2099 and `0` as the start of the year 2000,
+ * and an HTTP cache is required to treat both as an object that has already
+ * expired.
+ *
+ * asctime states no zone and HTTP reads it as GMT, while `Date.parse` would
+ * read it in the host's own. It is rewritten with the zone spelled out.
+ *
+ * https://www.rfc-editor.org/rfc/rfc9110#name-date-time-formats
+ */
+export function simCfHttpDateInstant(value) {
+    const asctime = asctimeDate.exec(value);
+    const parsable = asctime === null
+        ? value
+        : `${asctime[2]} ${asctime[1]} ${asctime[4]} ${asctime[3]} GMT`;
+    if (asctime === null && !imfFixdate.test(value) && !rfc850Date.test(value)) {
+        return undefined;
+    }
+    const instant = Date.parse(parsable);
+    return Number.isNaN(instant) ? undefined : instant;
+}

package/dist/service/cloudfront/cache-policy/sim-cf-cache-key.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The cookie behaviours a cache policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-cookiesconfig.html
+ */
+export declare const simCfCacheKeyCookieBehaviors: readonly ["none", "whitelist", "allExcept", "all"];
+export type SimCfCacheKeyCookieBehavior = (typeof simCfCacheKeyCookieBehaviors)[number];
+/**
+ * The header behaviours a cache policy may name.
+ *
+ * These are two of the four an origin request policy offers. A cache key can
+ * name headers or leave them all out; there is no `allViewer` to key a cache
+ * on, since keying on every header a viewer sent would cache almost nothing
+ * twice.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-headersconfig.html
+ */
+export declare const simCfCacheKeyHeaderBehaviors: readonly ["none", "whitelist"];
+export type SimCfCacheKeyHeaderBehavior = (typeof simCfCacheKeyHeaderBehaviors)[number];
+/**
+ * The query string behaviours a cache policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-querystringsconfig.html
+ */
+export declare const simCfCacheKeyQueryStringBehaviors: readonly ["none", "whitelist", "allExcept", "all"];
+export type SimCfCacheKeyQueryStringBehavior = (typeof simCfCacheKeyQueryStringBehaviors)[number];
+interface SimCloudFrontCacheKeyProperties {
+    readonly cookieBehavior?: SimCfCacheKeyCookieBehavior;
+    readonly cookies?: readonly string[];
+    readonly headerBehavior?: SimCfCacheKeyHeaderBehavior;
+    readonly headers?: readonly string[];
+    readonly queryStringBehavior?: SimCfCacheKeyQueryStringBehavior;
+    readonly queryStrings?: readonly string[];
+    readonly enableAcceptEncodingGzip?: boolean;
+    readonly enableAcceptEncodingBrotli?: boolean;
+}
+/**
+ * What a cache policy keys its cache on.
+ *
+ * This is CloudFront's `ParametersInCacheKeyAndForwardedToOrigin`. Each of the
+ * three sections carries a behaviour and the names it applies to: a
+ * `whitelist` keys on the names listed, an `allExcept` keys on everything but
+ * them, and `all` and `none` ignore the list. The names listed are also the
+ * ones CloudFront forwards to the Origin.
+ *
+ * The two `EnableAcceptEncoding` flags decide whether the normalized
+ * `Accept-Encoding` header joins the key, which is what lets one object be
+ * cached once compressed and once not.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
+ */
+export declare class SimCloudFrontCacheKey {
+    readonly cookieBehavior: SimCfCacheKeyCookieBehavior;
+    readonly cookies: readonly string[];
+    readonly headerBehavior: SimCfCacheKeyHeaderBehavior;
+    readonly headers: readonly string[];
+    readonly queryStringBehavior: SimCfCacheKeyQueryStringBehavior;
+    readonly queryStrings: readonly string[];
+    readonly enableAcceptEncodingGzip: boolean;
+    readonly enableAcceptEncodingBrotli: boolean;
+    constructor(properties?: SimCloudFrontCacheKeyProperties);
+}
+export {};

package/dist/service/cloudfront/cache-policy/sim-cf-cache-key.js

@@ -0,0 +1,70 @@
+/**
+ * The cookie behaviours a cache policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-cookiesconfig.html
+ */
+export const simCfCacheKeyCookieBehaviors = [
+    "none",
+    "whitelist",
+    "allExcept",
+    "all",
+];
+/**
+ * The header behaviours a cache policy may name.
+ *
+ * These are two of the four an origin request policy offers. A cache key can
+ * name headers or leave them all out; there is no `allViewer` to key a cache
+ * on, since keying on every header a viewer sent would cache almost nothing
+ * twice.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-headersconfig.html
+ */
+export const simCfCacheKeyHeaderBehaviors = ["none", "whitelist"];
+/**
+ * The query string behaviours a cache policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-querystringsconfig.html
+ */
+export const simCfCacheKeyQueryStringBehaviors = [
+    "none",
+    "whitelist",
+    "allExcept",
+    "all",
+];
+/**
+ * What a cache policy keys its cache on.
+ *
+ * This is CloudFront's `ParametersInCacheKeyAndForwardedToOrigin`. Each of the
+ * three sections carries a behaviour and the names it applies to: a
+ * `whitelist` keys on the names listed, an `allExcept` keys on everything but
+ * them, and `all` and `none` ignore the list. The names listed are also the
+ * ones CloudFront forwards to the Origin.
+ *
+ * The two `EnableAcceptEncoding` flags decide whether the normalized
+ * `Accept-Encoding` header joins the key, which is what lets one object be
+ * cached once compressed and once not.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
+ */
+export class SimCloudFrontCacheKey {
+    cookieBehavior;
+    cookies;
+    headerBehavior;
+    headers;
+    queryStringBehavior;
+    queryStrings;
+    enableAcceptEncodingGzip;
+    enableAcceptEncodingBrotli;
+    constructor(properties = {}) {
+        this.cookieBehavior = properties.cookieBehavior ?? "none";
+        this.cookies = properties.cookies ?? [];
+        this.headerBehavior = properties.headerBehavior ?? "none";
+        this.headers = properties.headers ?? [];
+        this.queryStringBehavior = properties.queryStringBehavior ?? "none";
+        this.queryStrings = properties.queryStrings ?? [];
+        this.enableAcceptEncodingGzip =
+            properties.enableAcceptEncodingGzip ?? false;
+        this.enableAcceptEncodingBrotli =
+            properties.enableAcceptEncodingBrotli ?? false;
+    }
+}

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy.d.ts

@@ -1,17 +1,23 @@
 import type { Brand } from "../../../util/brand.type.js";
+import { SimCloudFrontCacheKey } from "./sim-cf-cache-key.js";
 export type SimCloudFrontCachePolicyId = Brand<string, "SimCloudFrontCachePolicyId">;
 interface SimCloudFrontCachePolicyProperties {
     readonly id?: SimCloudFrontCachePolicyId;
     readonly name: string;
     readonly comment?: string | undefined;
+    readonly minTtlSec?: number;
+    readonly defaultTtlSec?: number;
+    readonly maxTtlSec?: number;
+    readonly cacheKey?: SimCloudFrontCacheKey;
 }
 /**
  * Simulated CloudFront cache policy.
  *
  * A cache policy decides what a cache Behavior keys its cache on and how long
- * an object stays there. This simulation holds the policy under its ID and
- * hands it back. The cache key, the TTLs and the compression settings belong
- * to a simulated cache, which CloudFront here has yet to grow.
+ * an object stays there. This simulation holds the policy under its ID, along
+ * with its three TTLs and its cache key, and keys the Distribution's cache on
+ * it. A `MaxTTL` of zero is read as a Behavior that caches nothing, and the
+ * other two settle how long an entry lives against what the Origin asked for.
  *
  * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
  */
@@ -19,6 +25,10 @@ export declare class SimCloudFrontCachePolicy {
     readonly id: SimCloudFrontCachePolicyId;
     readonly name: string;
     readonly comment: string | undefined;
+    readonly minTtlSec: number;
+    readonly defaultTtlSec: number;
+    readonly maxTtlSec: number;
+    readonly cacheKey: SimCloudFrontCacheKey;
     constructor(properties: SimCloudFrontCachePolicyProperties);
 }
 export type SimCloudFrontCachePolicyMap = Map<SimCloudFrontCachePolicyId, SimCloudFrontCachePolicy>;

package/dist/service/cloudfront/cache-policy/sim-cf-cache-policy.js

@@ -1,11 +1,15 @@
 import { randomUUID } from "node:crypto";
+import { SimCloudFrontCacheKey } from "./sim-cf-cache-key.js";
+const daySeconds = 86_400;
+const yearSeconds = 31_536_000;
 /**
  * Simulated CloudFront cache policy.
  *
  * A cache policy decides what a cache Behavior keys its cache on and how long
- * an object stays there. This simulation holds the policy under its ID and
- * hands it back. The cache key, the TTLs and the compression settings belong
- * to a simulated cache, which CloudFront here has yet to grow.
+ * an object stays there. This simulation holds the policy under its ID, along
+ * with its three TTLs and its cache key, and keys the Distribution's cache on
+ * it. A `MaxTTL` of zero is read as a Behavior that caches nothing, and the
+ * other two settle how long an entry lives against what the Origin asked for.
  *
  * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html
  */
@@ -13,9 +17,33 @@ export class SimCloudFrontCachePolicy {
     id;
     name;
     comment;
+    minTtlSec;
+    defaultTtlSec;
+    maxTtlSec;
+    cacheKey;
     constructor(properties) {
         this.id = properties.id ?? randomUUID();
         this.name = properties.name;
         this.comment = properties.comment;
+        this.minTtlSec = properties.minTtlSec ?? 0;
+        this.defaultTtlSec =
+            properties.defaultTtlSec ?? Math.max(daySeconds, this.minTtlSec);
+        this.maxTtlSec =
+            properties.maxTtlSec ?? maxTtlDefault(this.minTtlSec, this.defaultTtlSec);
+        this.cacheKey = properties.cacheKey ?? new SimCloudFrontCacheKey();
     }
 }
+/**
+ * The `MaxTTL` CloudFront settles on where a policy left it out.
+ *
+ * It is a year, except where a longer `MinTTL` or `DefaultTTL` would sit above
+ * it, in which case CloudFront takes the `DefaultTTL` rather than capping the
+ * policy below its own floor.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html
+ */
+function maxTtlDefault(minTtlSec, defaultTtlSec) {
+    return minTtlSec > yearSeconds || defaultTtlSec > yearSeconds
+        ? defaultTtlSec
+        : yearSeconds;
+}