@kensio/yulin 1.20.16 → 1.21.0

package/dist/service/cloudfront/origin-request-policy/sim-cf-forwarded-to-origin.d.ts

@@ -0,0 +1,57 @@
+import { SimCloudFrontCacheKey } from "../cache-policy/sim-cf-cache-key.js";
+import { SimCfOriginRequestForwarding } from "./sim-cf-origin-request-forwarding.js";
+interface SimCfForwardedToOriginProperties {
+    readonly cacheKey?: SimCloudFrontCacheKey | undefined;
+    readonly forwarding?: SimCfOriginRequestForwarding | undefined;
+}
+/**
+ * What a cache Behavior carries to its Origin.
+ *
+ * CloudFront sends the union of two things. The first is what the cache policy
+ * keyed the cache on, since an Origin has to be able to answer for the key it
+ * is asked about. The second is what the origin request policy forwards on
+ * top. A Behavior naming neither policy carries neither, and its Origin reads
+ * only what CloudFront sends of its own accord.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html
+ */
+export declare class SimCfForwardedToOrigin {
+    private readonly cacheKey;
+    private readonly forwarding;
+    constructor(properties?: SimCfForwardedToOriginProperties);
+    /**
+     * Whether one of the viewer's headers travels to the Origin, by a name read
+     * case insensitively as HTTP reads a header name.
+     */
+    forwardsHeader(name: string): boolean;
+    /**
+     * Whether the cache policy keyed on compression, which is either of its two
+     * `EnableAcceptEncoding` flags.
+     *
+     * A policy that did decides the `Accept-Encoding` the Origin is asked for on
+     * its own. AWS says as much: a policy naming the header alongside these
+     * flags has no effect on the Origin request.
+     */
+    get keysOnCompression(): boolean;
+    /**
+     * The `Accept-Encoding` CloudFront sends where the cache policy keyed on
+     * compression, or none where it did not.
+     *
+     * CloudFront normalizes this header rather than passing the viewer's own on.
+     * An encoding the viewer asked for and the policy left out is left out of
+     * what the Origin is asked for. A policy naming the header outright carries
+     * the viewer's value, and never reaches this.
+     */
+    normalizedAcceptEncoding(headers: Headers): string | undefined;
+    /**
+     * Whether one of the viewer's cookies travels to the Origin. CloudFront
+     * reads a cookie name case sensitively.
+     */
+    forwardsCookie(name: string): boolean;
+    /**
+     * Whether one of the viewer's query strings travels to the Origin.
+     * CloudFront reads a query string name case sensitively.
+     */
+    forwardsQueryString(name: string): boolean;
+}
+export {};

package/dist/service/cloudfront/origin-request-policy/sim-cf-forwarded-to-origin.js

@@ -0,0 +1,129 @@
+import { simCfNormalizedAcceptEncoding } from "../cache/sim-cf-accept-encoding.js";
+import { SimCloudFrontCacheKey } from "../cache-policy/sim-cf-cache-key.js";
+import { SimCfOriginRequestForwarding, } from "./sim-cf-origin-request-forwarding.js";
+/**
+ * What a cache Behavior carries to its Origin.
+ *
+ * CloudFront sends the union of two things. The first is what the cache policy
+ * keyed the cache on, since an Origin has to be able to answer for the key it
+ * is asked about. The second is what the origin request policy forwards on
+ * top. A Behavior naming neither policy carries neither, and its Origin reads
+ * only what CloudFront sends of its own accord.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html
+ */
+export class SimCfForwardedToOrigin {
+    cacheKey;
+    forwarding;
+    constructor(properties = {}) {
+        this.cacheKey = properties.cacheKey ?? new SimCloudFrontCacheKey();
+        this.forwarding =
+            properties.forwarding ?? new SimCfOriginRequestForwarding();
+    }
+    /**
+     * Whether one of the viewer's headers travels to the Origin, by a name read
+     * case insensitively as HTTP reads a header name.
+     */
+    forwardsHeader(name) {
+        return ((this.cacheKey.headerBehavior === "whitelist" &&
+            namesHeader(this.cacheKey.headers, name)) ||
+            policyForwardsHeader(this.forwarding.headerBehavior, this.forwarding.headers, name));
+    }
+    /**
+     * Whether the cache policy keyed on compression, which is either of its two
+     * `EnableAcceptEncoding` flags.
+     *
+     * A policy that did decides the `Accept-Encoding` the Origin is asked for on
+     * its own. AWS says as much: a policy naming the header alongside these
+     * flags has no effect on the Origin request.
+     */
+    get keysOnCompression() {
+        return (this.cacheKey.enableAcceptEncodingGzip ||
+            this.cacheKey.enableAcceptEncodingBrotli);
+    }
+    /**
+     * The `Accept-Encoding` CloudFront sends where the cache policy keyed on
+     * compression, or none where it did not.
+     *
+     * CloudFront normalizes this header rather than passing the viewer's own on.
+     * An encoding the viewer asked for and the policy left out is left out of
+     * what the Origin is asked for. A policy naming the header outright carries
+     * the viewer's value, and never reaches this.
+     */
+    normalizedAcceptEncoding(headers) {
+        const encodings = simCfNormalizedAcceptEncoding(headers, this.cacheKey);
+        // AWS writes the normalized header with gzip first.
+        const ordered = ["gzip", "br"].filter((encoding) => encodings.includes(encoding));
+        return ordered.length === 0 ? undefined : ordered.join(", ");
+    }
+    /**
+     * Whether one of the viewer's cookies travels to the Origin. CloudFront
+     * reads a cookie name case sensitively.
+     */
+    forwardsCookie(name) {
+        return (behaviorNames(this.cacheKey.cookieBehavior, this.cacheKey.cookies, name) ||
+            behaviorNames(this.forwarding.cookieBehavior, this.forwarding.cookies, name));
+    }
+    /**
+     * Whether one of the viewer's query strings travels to the Origin.
+     * CloudFront reads a query string name case sensitively.
+     */
+    forwardsQueryString(name) {
+        return (behaviorNames(this.cacheKey.queryStringBehavior, this.cacheKey.queryStrings, name) ||
+            behaviorNames(this.forwarding.queryStringBehavior, this.forwarding.queryStrings, name));
+    }
+}
+/**
+ * Whether a header behaviour carries one header name.
+ *
+ * `allViewerAndWhitelistCloudFront` carries every viewer header, and its list
+ * names CloudFront's own headers rather than the viewer's. Nothing here
+ * generates those, so the list adds nothing to what `allViewer` already
+ * carries.
+ */
+function policyForwardsHeader(behavior, headers, name) {
+    switch (behavior) {
+        case "allViewer":
+        case "allViewerAndWhitelistCloudFront": {
+            return true;
+        }
+        case "whitelist": {
+            return namesHeader(headers, name);
+        }
+        case "allExcept": {
+            return !namesHeader(headers, name);
+        }
+        case "none": {
+            return false;
+        }
+    }
+}
+/**
+ * Whether a cookie or query string behaviour carries one name.
+ *
+ * The cookie behaviours and the query string behaviours are the same four
+ * values in both kinds of policy, so one function reads all of them.
+ */
+function behaviorNames(behavior, listed, name) {
+    switch (behavior) {
+        case "all": {
+            return true;
+        }
+        case "whitelist": {
+            return listed.includes(name);
+        }
+        case "allExcept": {
+            return !listed.includes(name);
+        }
+        case "none": {
+            return false;
+        }
+    }
+}
+/**
+ * Whether a list of header names holds one, whatever case either was written
+ * in.
+ */
+function namesHeader(headers, name) {
+    return headers.some((header) => header.toLowerCase() === name.toLowerCase());
+}

package/dist/service/cloudfront/origin-request-policy/sim-cf-managed-origin-request-policies.d.ts

@@ -0,0 +1,30 @@
+import { type SimCloudFrontOriginRequestPolicyMap } from "./sim-cf-origin-request-policy.js";
+/**
+ * The IDs AWS publishes for its managed origin request policies.
+ *
+ * A template names one of these directly. CDK's `OriginRequestPolicy` statics
+ * carry the same eight, and synthesize the ID into a Behavior's
+ * `OriginRequestPolicyId` with no Resource behind it.
+ */
+export declare const simCfManagedOriginRequestPolicyIds: {
+    readonly allViewer: "216adef6-5c7f-47e4-b989-5492eafa07d3";
+    readonly allViewerAndCloudFrontHeaders2022: "33f36d7e-f396-46d9-90e0-52428a34d9dc";
+    readonly allViewerExceptHostHeader: "b689b0a8-53d0-40ab-baf2-68738e2966ac";
+    readonly corsCustomOrigin: "59781a5b-3903-41f3-afcb-af62929ccde1";
+    readonly corsS3Origin: "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf";
+    readonly elementalMediaTailorPersonalizedManifests: "775133bc-15f2-49f9-abea-afb2e0bf67d2";
+    readonly hostHeaderOnly: "bf0718e1-ba1e-49d1-88b1-f726733018ae";
+    readonly userAgentRefererHeaders: "acba4595-bd28-49b8-b9fe-13317c0390fa";
+};
+/**
+ * The eight managed origin request policies, built fresh for one simulated
+ * CloudFront.
+ *
+ * CloudFront owns these and every account has them, so a Behavior can name one
+ * without a template creating anything. Each carries the ID, the name and the
+ * three sections AWS publishes for it, so an Origin behind `AllViewer` here
+ * reads what one behind `AllViewer` in an account reads.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html
+ */
+export declare function simCfManagedOriginRequestPolicies(): SimCloudFrontOriginRequestPolicyMap;

package/dist/service/cloudfront/origin-request-policy/sim-cf-managed-origin-request-policies.js

@@ -0,0 +1,121 @@
+import { SimCfOriginRequestForwarding } from "./sim-cf-origin-request-forwarding.js";
+import { SimCloudFrontOriginRequestPolicy, } from "./sim-cf-origin-request-policy.js";
+/**
+ * The IDs AWS publishes for its managed origin request policies.
+ *
+ * A template names one of these directly. CDK's `OriginRequestPolicy` statics
+ * carry the same eight, and synthesize the ID into a Behavior's
+ * `OriginRequestPolicyId` with no Resource behind it.
+ */
+export const simCfManagedOriginRequestPolicyIds = {
+    allViewer: "216adef6-5c7f-47e4-b989-5492eafa07d3",
+    allViewerAndCloudFrontHeaders2022: "33f36d7e-f396-46d9-90e0-52428a34d9dc",
+    allViewerExceptHostHeader: "b689b0a8-53d0-40ab-baf2-68738e2966ac",
+    corsCustomOrigin: "59781a5b-3903-41f3-afcb-af62929ccde1",
+    corsS3Origin: "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf",
+    elementalMediaTailorPersonalizedManifests: "775133bc-15f2-49f9-abea-afb2e0bf67d2",
+    hostHeaderOnly: "bf0718e1-ba1e-49d1-88b1-f726733018ae",
+    userAgentRefererHeaders: "acba4595-bd28-49b8-b9fe-13317c0390fa",
+};
+/**
+ * The CloudFront headers `AllViewerAndCloudFrontHeaders-2022-06` adds to the
+ * viewer's own. They are the ones CloudFront had released by June 2022, and
+ * the policy is pinned to that set rather than growing with CloudFront.
+ */
+const cloudFrontHeaders2022 = [
+    "CloudFront-Forwarded-Proto",
+    "CloudFront-Is-Android-Viewer",
+    "CloudFront-Is-Desktop-Viewer",
+    "CloudFront-Is-IOS-Viewer",
+    "CloudFront-Is-Mobile-Viewer",
+    "CloudFront-Is-SmartTV-Viewer",
+    "CloudFront-Is-Tablet-Viewer",
+    "CloudFront-Viewer-Address",
+    "CloudFront-Viewer-ASN",
+    "CloudFront-Viewer-City",
+    "CloudFront-Viewer-Country",
+    "CloudFront-Viewer-Country-Name",
+    "CloudFront-Viewer-Country-Region",
+    "CloudFront-Viewer-Country-Region-Name",
+    "CloudFront-Viewer-Http-Version",
+    "CloudFront-Viewer-Latitude",
+    "CloudFront-Viewer-Longitude",
+    "CloudFront-Viewer-Metro-Code",
+    "CloudFront-Viewer-Postal-Code",
+    "CloudFront-Viewer-Time-Zone",
+    "CloudFront-Viewer-TLS",
+];
+/**
+ * The CORS request headers `CORS-S3Origin` forwards, which
+ * `Elemental-MediaTailor-PersonalizedManifests` forwards along with two of its
+ * own.
+ */
+const corsRequestHeaders = [
+    "Origin",
+    "Access-Control-Request-Headers",
+    "Access-Control-Request-Method",
+];
+/**
+ * The eight managed origin request policies, built fresh for one simulated
+ * CloudFront.
+ *
+ * CloudFront owns these and every account has them, so a Behavior can name one
+ * without a template creating anything. Each carries the ID, the name and the
+ * three sections AWS publishes for it, so an Origin behind `AllViewer` here
+ * reads what one behind `AllViewer` in an account reads.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html
+ */
+export function simCfManagedOriginRequestPolicies() {
+    const policies = [
+        managedOriginRequestPolicy(simCfManagedOriginRequestPolicyIds.allViewer, "AllViewer", new SimCfOriginRequestForwarding({
+            cookieBehavior: "all",
+            headerBehavior: "allViewer",
+            queryStringBehavior: "all",
+        })),
+        managedOriginRequestPolicy(simCfManagedOriginRequestPolicyIds.allViewerAndCloudFrontHeaders2022, "AllViewerAndCloudFrontHeaders-2022-06", new SimCfOriginRequestForwarding({
+            cookieBehavior: "all",
+            headerBehavior: "allViewerAndWhitelistCloudFront",
+            headers: cloudFrontHeaders2022,
+            queryStringBehavior: "all",
+        })),
+        managedOriginRequestPolicy(simCfManagedOriginRequestPolicyIds.allViewerExceptHostHeader, "AllViewerExceptHostHeader", new SimCfOriginRequestForwarding({
+            cookieBehavior: "all",
+            headerBehavior: "allExcept",
+            headers: ["Host"],
+            queryStringBehavior: "all",
+        })),
+        managedOriginRequestPolicy(simCfManagedOriginRequestPolicyIds.corsCustomOrigin, "CORS-CustomOrigin", new SimCfOriginRequestForwarding({
+            headerBehavior: "whitelist",
+            headers: ["Origin"],
+        })),
+        managedOriginRequestPolicy(simCfManagedOriginRequestPolicyIds.corsS3Origin, "CORS-S3Origin", new SimCfOriginRequestForwarding({
+            headerBehavior: "whitelist",
+            headers: corsRequestHeaders,
+        })),
+        managedOriginRequestPolicy(simCfManagedOriginRequestPolicyIds.elementalMediaTailorPersonalizedManifests, "Elemental-MediaTailor-PersonalizedManifests", new SimCfOriginRequestForwarding({
+            headerBehavior: "whitelist",
+            headers: [...corsRequestHeaders, "User-Agent", "X-Forwarded-For"],
+            queryStringBehavior: "all",
+        })),
+        managedOriginRequestPolicy(simCfManagedOriginRequestPolicyIds.hostHeaderOnly, "HostHeaderOnly", new SimCfOriginRequestForwarding({
+            headerBehavior: "whitelist",
+            headers: ["Host"],
+        })),
+        managedOriginRequestPolicy(simCfManagedOriginRequestPolicyIds.userAgentRefererHeaders, "UserAgentRefererHeaders", new SimCfOriginRequestForwarding({
+            headerBehavior: "whitelist",
+            headers: ["User-Agent", "Referer"],
+        })),
+    ];
+    return new Map(policies.map((policy) => [policy.id, policy]));
+}
+/**
+ * One managed policy, under the ID, the name and the sections AWS gives it.
+ */
+function managedOriginRequestPolicy(id, name, forwarding) {
+    return new SimCloudFrontOriginRequestPolicy({
+        id: id,
+        name,
+        forwarding,
+    });
+}

package/dist/service/cloudfront/origin-request-policy/sim-cf-origin-request-forwarding.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The cookie behaviours an origin request policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-originrequestpolicy-cookiesconfig.html
+ */
+export declare const simCfForwardedCookieBehaviors: readonly ["none", "whitelist", "allExcept", "all"];
+export type SimCfForwardedCookieBehavior = (typeof simCfForwardedCookieBehaviors)[number];
+/**
+ * The header behaviours an origin request policy may name.
+ *
+ * These are the two a cache key offers and three more. A policy can forward
+ * every header the viewer sent, which is no use as a cache key but is what an
+ * Origin behind `AllViewer` receives, and it can add CloudFront's own headers
+ * to that or forward everything but a list.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-originrequestpolicy-headersconfig.html
+ */
+export declare const simCfForwardedHeaderBehaviors: readonly ["none", "whitelist", "allViewer", "allViewerAndWhitelistCloudFront", "allExcept"];
+export type SimCfForwardedHeaderBehavior = (typeof simCfForwardedHeaderBehaviors)[number];
+/**
+ * The query string behaviours an origin request policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-originrequestpolicy-querystringsconfig.html
+ */
+export declare const simCfForwardedQueryStringBehaviors: readonly ["none", "whitelist", "allExcept", "all"];
+export type SimCfForwardedQueryStringBehavior = (typeof simCfForwardedQueryStringBehaviors)[number];
+interface SimCfOriginRequestForwardingProperties {
+    readonly cookieBehavior?: SimCfForwardedCookieBehavior;
+    readonly cookies?: readonly string[];
+    readonly headerBehavior?: SimCfForwardedHeaderBehavior;
+    readonly headers?: readonly string[];
+    readonly queryStringBehavior?: SimCfForwardedQueryStringBehavior;
+    readonly queryStrings?: readonly string[];
+}
+/**
+ * What an origin request policy carries to the Origin.
+ *
+ * These are the three `<name>Config` sections of an `OriginRequestPolicyConfig`.
+ * Each carries a behaviour and the names it applies to: a `whitelist` forwards
+ * the names listed, an `allExcept` forwards everything but them, and `all`,
+ * `allViewer` and `none` ignore the list. The header section's
+ * `allViewerAndWhitelistCloudFront` forwards every viewer header and the
+ * CloudFront headers it lists on top.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html
+ */
+export declare class SimCfOriginRequestForwarding {
+    readonly cookieBehavior: SimCfForwardedCookieBehavior;
+    readonly cookies: readonly string[];
+    readonly headerBehavior: SimCfForwardedHeaderBehavior;
+    readonly headers: readonly string[];
+    readonly queryStringBehavior: SimCfForwardedQueryStringBehavior;
+    readonly queryStrings: readonly string[];
+    constructor(properties?: SimCfOriginRequestForwardingProperties);
+}
+export {};

package/dist/service/cloudfront/origin-request-policy/sim-cf-origin-request-forwarding.js

@@ -0,0 +1,67 @@
+/**
+ * The cookie behaviours an origin request policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-originrequestpolicy-cookiesconfig.html
+ */
+export const simCfForwardedCookieBehaviors = [
+    "none",
+    "whitelist",
+    "allExcept",
+    "all",
+];
+/**
+ * The header behaviours an origin request policy may name.
+ *
+ * These are the two a cache key offers and three more. A policy can forward
+ * every header the viewer sent, which is no use as a cache key but is what an
+ * Origin behind `AllViewer` receives, and it can add CloudFront's own headers
+ * to that or forward everything but a list.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-originrequestpolicy-headersconfig.html
+ */
+export const simCfForwardedHeaderBehaviors = [
+    "none",
+    "whitelist",
+    "allViewer",
+    "allViewerAndWhitelistCloudFront",
+    "allExcept",
+];
+/**
+ * The query string behaviours an origin request policy may name.
+ *
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-originrequestpolicy-querystringsconfig.html
+ */
+export const simCfForwardedQueryStringBehaviors = [
+    "none",
+    "whitelist",
+    "allExcept",
+    "all",
+];
+/**
+ * What an origin request policy carries to the Origin.
+ *
+ * These are the three `<name>Config` sections of an `OriginRequestPolicyConfig`.
+ * Each carries a behaviour and the names it applies to: a `whitelist` forwards
+ * the names listed, an `allExcept` forwards everything but them, and `all`,
+ * `allViewer` and `none` ignore the list. The header section's
+ * `allViewerAndWhitelistCloudFront` forwards every viewer header and the
+ * CloudFront headers it lists on top.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html
+ */
+export class SimCfOriginRequestForwarding {
+    cookieBehavior;
+    cookies;
+    headerBehavior;
+    headers;
+    queryStringBehavior;
+    queryStrings;
+    constructor(properties = {}) {
+        this.cookieBehavior = properties.cookieBehavior ?? "none";
+        this.cookies = properties.cookies ?? [];
+        this.headerBehavior = properties.headerBehavior ?? "none";
+        this.headers = properties.headers ?? [];
+        this.queryStringBehavior = properties.queryStringBehavior ?? "none";
+        this.queryStrings = properties.queryStrings ?? [];
+    }
+}

package/dist/service/cloudfront/origin-request-policy/sim-cf-origin-request-policy-registry.d.ts

@@ -0,0 +1,38 @@
+import type { SimCloudFrontOriginRequestPolicy, SimCloudFrontOriginRequestPolicyId } from "./sim-cf-origin-request-policy.js";
+/**
+ * The origin request policies one simulated CloudFront holds.
+ *
+ * Policies are found by ID, which is what a cache Behavior's
+ * `originRequestPolicyId` names, and by name, which is what decides whether a
+ * new one may be stored.
+ *
+ * AWS's eight managed policies are held apart from the ones a template
+ * creates. CloudFront keeps them in its own namespace, so a template may
+ * create a policy called `AllViewer` of its own, and deleting the stack that
+ * created it leaves the managed one where it was.
+ */
+export declare class SimCloudFrontOriginRequestPolicyRegistry {
+    private readonly policies;
+    private readonly managedPolicies;
+    /**
+     * Store a policy a template created, refusing a name another such policy
+     * already holds as CloudFront does.
+     */
+    add(policy: SimCloudFrontOriginRequestPolicy): void;
+    /**
+     * Forget a policy.
+     */
+    remove(policyId: SimCloudFrontOriginRequestPolicyId): void;
+    /**
+     * Get a policy by ID, whether a template created it or AWS manages it.
+     */
+    byId(policyId: SimCloudFrontOriginRequestPolicyId | string): SimCloudFrontOriginRequestPolicy | undefined;
+    /**
+     * Get a policy a template created, by name.
+     *
+     * A managed policy is left out. Its name belongs to CloudFront's own
+     * namespace, and this is what decides whether a template may store a policy
+     * under a name.
+     */
+    byName(policyName: string): SimCloudFrontOriginRequestPolicy | undefined;
+}

package/dist/service/cloudfront/origin-request-policy/sim-cf-origin-request-policy-registry.js

@@ -0,0 +1,51 @@
+import { SimCloudFrontOriginRequestPolicyAlreadyExists } from "../error/sim-cf-origin-request-policy.error.js";
+import { simCfManagedOriginRequestPolicies } from "./sim-cf-managed-origin-request-policies.js";
+/**
+ * The origin request policies one simulated CloudFront holds.
+ *
+ * Policies are found by ID, which is what a cache Behavior's
+ * `originRequestPolicyId` names, and by name, which is what decides whether a
+ * new one may be stored.
+ *
+ * AWS's eight managed policies are held apart from the ones a template
+ * creates. CloudFront keeps them in its own namespace, so a template may
+ * create a policy called `AllViewer` of its own, and deleting the stack that
+ * created it leaves the managed one where it was.
+ */
+export class SimCloudFrontOriginRequestPolicyRegistry {
+    policies = new Map();
+    managedPolicies = simCfManagedOriginRequestPolicies();
+    /**
+     * Store a policy a template created, refusing a name another such policy
+     * already holds as CloudFront does.
+     */
+    add(policy) {
+        if (this.byName(policy.name) !== undefined) {
+            throw new SimCloudFrontOriginRequestPolicyAlreadyExists(`Sim CloudFront origin request policy ${policy.name} already exists`);
+        }
+        this.policies.set(policy.id, policy);
+    }
+    /**
+     * Forget a policy.
+     */
+    remove(policyId) {
+        this.policies.delete(policyId);
+    }
+    /**
+     * Get a policy by ID, whether a template created it or AWS manages it.
+     */
+    byId(policyId) {
+        const id = policyId;
+        return this.policies.get(id) ?? this.managedPolicies.get(id);
+    }
+    /**
+     * Get a policy a template created, by name.
+     *
+     * A managed policy is left out. Its name belongs to CloudFront's own
+     * namespace, and this is what decides whether a template may store a policy
+     * under a name.
+     */
+    byName(policyName) {
+        return this.policies.values().find((policy) => policy.name === policyName);
+    }
+}

package/dist/service/cloudfront/origin-request-policy/sim-cf-origin-request-policy.d.ts

@@ -0,0 +1,32 @@
+import type { Brand } from "../../../util/brand.type.js";
+import { SimCfOriginRequestForwarding } from "./sim-cf-origin-request-forwarding.js";
+export type SimCloudFrontOriginRequestPolicyId = Brand<string, "SimCloudFrontOriginRequestPolicyId">;
+interface SimCloudFrontOriginRequestPolicyProperties {
+    readonly id?: SimCloudFrontOriginRequestPolicyId;
+    readonly name: string;
+    readonly comment?: string | undefined;
+    readonly forwarding?: SimCfOriginRequestForwarding;
+}
+/**
+ * Simulated CloudFront origin request policy.
+ *
+ * An origin request policy decides which of the viewer's headers, cookies and
+ * query strings a cache Behavior carries to its Origin. This simulation holds
+ * the policy under its ID, along with the three sections that say what it
+ * forwards, and narrows a custom Origin request to them.
+ *
+ * What reaches the Origin is the union of these sections and the Behavior's
+ * cache key, since CloudFront forwards everything it keyed the cache on as
+ * well.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html
+ */
+export declare class SimCloudFrontOriginRequestPolicy {
+    readonly id: SimCloudFrontOriginRequestPolicyId;
+    readonly name: string;
+    readonly comment: string | undefined;
+    readonly forwarding: SimCfOriginRequestForwarding;
+    constructor(properties: SimCloudFrontOriginRequestPolicyProperties);
+}
+export type SimCloudFrontOriginRequestPolicyMap = Map<SimCloudFrontOriginRequestPolicyId, SimCloudFrontOriginRequestPolicy>;
+export {};

package/dist/service/cloudfront/origin-request-policy/sim-cf-origin-request-policy.js

@@ -0,0 +1,30 @@
+import { randomUUID } from "node:crypto";
+import { SimCfOriginRequestForwarding } from "./sim-cf-origin-request-forwarding.js";
+/**
+ * Simulated CloudFront origin request policy.
+ *
+ * An origin request policy decides which of the viewer's headers, cookies and
+ * query strings a cache Behavior carries to its Origin. This simulation holds
+ * the policy under its ID, along with the three sections that say what it
+ * forwards, and narrows a custom Origin request to them.
+ *
+ * What reaches the Origin is the union of these sections and the Behavior's
+ * cache key, since CloudFront forwards everything it keyed the cache on as
+ * well.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html
+ */
+export class SimCloudFrontOriginRequestPolicy {
+    id;
+    name;
+    comment;
+    forwarding;
+    constructor(properties) {
+        this.id =
+            properties.id ?? randomUUID();
+        this.name = properties.name;
+        this.comment = properties.comment;
+        this.forwarding =
+            properties.forwarding ?? new SimCfOriginRequestForwarding();
+    }
+}

package/dist/service/cloudfront/registry/sim-cloud-front-registry.d.ts

@@ -1,16 +1,41 @@
 import { type SimCloudFrontDistributionId } from "../distribution/sim-cloudfront-distribution.js";
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+/**
+ * How a simulated AWS caches what its Distributions serve.
+ */
+export interface SimCfCachingConfiguration {
+    readonly enabled: boolean;
+}
 /**
  * Simulated CloudFront cross-Account registry of Distribution IDs.
  *
  * CloudFront is not region-scoped, so all region-scoped CloudFront service
  * instances for the same Account should delegate to the same Account-global
  * state.
+ *
+ * Whether Distributions cache what they serve lives here for the same reason.
+ * One registry is built per `SimAws` and shared by every Account and Region,
+ * so turning caching off turns it off for the whole simulated AWS rather than
+ * for one Account's Distributions.
  */
 export declare class SimCloudFrontRegistry {
+    #private;
     private readonly distributionAccountIds;
     private readonly accountDistributionIds;
     private readonly alternateDomainDistributionIds;
+    /**
+     * Whether Distributions here cache what they serve.
+     */
+    get cachingEnabled(): boolean;
+    /**
+     * Turn the edge cache on or off for every Distribution in this simulated
+     * AWS.
+     *
+     * Caching is on, as CloudFront's is. Turning it off is for a suite that
+     * repeats a request and wants the Origin read every time, and it is the
+     * behaviour sim CloudFront had before it held a cache at all.
+     */
+    configureCaching(configuration: SimCfCachingConfiguration): void;
     /**
      * Allocate a globally unique simulated CloudFront Distribution ID.
      */