COMPANION NOTE FOR SORT HEADER UPDATE (v164)
- The visible iPhone/iPad sort-header fix lives in the s3-cloudfront-indexer v96 package, not in this PHP tool.
- Keep this PHP package with the matching deployment set so your CloudFront cache-policy automation remains aligned with the event-invalidated cache model.

START HERE — CloudFront Media Behavior Automation PHP Tool
==============================================================

GOAL
----
Use this private PHP tool to update CloudFront behavior/cache-policy rules.
This package includes the long-cache/event-invalidation policy:
JsonLong1YearEventInvalidated

SECURITY RULE
-------------
Do NOT upload this tool to a public folder with real AWS credentials inside it.
Run it only in a private/admin PHP location.

FILES AND WHERE THEY GO
-----------------------
1. cloudfront-media-behavior-automation.php
   Goes to: private PHP-capable web/admin folder.
   Purpose: main browser tool.

2. cloudfront-tool-local-config.php
   Goes to: same private folder, or leave placeholders and enter AWS keys in the browser.
   Purpose: optional AWS credentials config.

3. README.html and START HERE docs
   Keep with the tool locally.

DEPLOYMENT STEPS
----------------
1. Unzip this package on your PHP server or local PHP web environment.
2. Put cloudfront-media-behavior-automation-web-php in a private/admin web directory.
3. Open cloudfront-media-behavior-automation.php in a text editor.
4. Change TOOL_PASSWORD_DEFAULT from change-this-password-now to your own password.
   Alternative: set environment variable CF_TOOL_PASSWORD.
5. Decide how AWS credentials will be supplied:
   A. Safer: leave cloudfront-tool-local-config.php blank/placeholders and paste keys into the browser form.
   B. Easier: edit cloudfront-tool-local-config.php with AWS keys, but keep it private.
6. Open the PHP tool in your browser.
7. Enter password and AWS credentials.
8. Load CloudFront distributions.
9. Select the 8k.art distribution.
10. Click Dry Run.
11. Read and save the RunLog.
12. Confirm it mentions JsonLong1YearEventInvalidated for generated directory JSON.
13. Confirm it is not unexpectedly changing Default behavior.
14. Click Apply only after Dry Run looks correct.
15. Save the final RunLog.
16. Wait for CloudFront distribution deployment to complete.
17. Test https://8k.art/beta/ after uploading/overwriting/deleting a small test file.

DO NOT DO THESE THINGS
----------------------
- Do not run Apply before Dry Run.
- Do not put real AWS keys in a public file.
- Do not delete the CloudFront distribution.
- Do not manually change Default behavior while testing.
- Do not panic if CloudFront takes time to deploy.

SUCCESS
-------
The CloudFront distribution uses the expected behavior/cache policies.
Generated directory JSON uses JsonLong1YearEventInvalidated.
The S3 updater Lambda invalidates CloudFront on S3 changes.
https://8k.art/beta/ shows current folder data after upload, overwrite, and delete.