@kensio/yulin 1.20.17 → 1.21.1

package/dist/service/cloudfront/command/invalidation/sim-cf-invalidation-commands.d.ts

@@ -0,0 +1,39 @@
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimCloudFrontDistribution, SimCloudFrontDistributionId } from "../../distribution/sim-cloudfront-distribution.js";
+import type { SimCreateInvalidationCommand, SimCreateInvalidationCommandOutput, SimGetInvalidationCommand, SimGetInvalidationCommandOutput, SimListInvalidationsCommand, SimListInvalidationsCommandOutput } from "./sim-cf-invalidation-command.types.js";
+interface SimCfInvalidationCommandsProperties {
+    readonly accountId: SimAwsAccountId;
+    readonly distributions: Map<SimCloudFrontDistributionId, SimCloudFrontDistribution>;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+}
+interface InvalidationRequestOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The invalidation commands on the CloudFront client.
+ *
+ * They are grouped here, the way the Function commands are, because all three
+ * work on state a Distribution holds of its own and share the lookup that
+ * reaches it.
+ */
+export declare class SimCfInvalidationCommands {
+    private readonly access;
+    constructor(properties: SimCfInvalidationCommandsProperties);
+    /**
+     * Handle a Create Invalidation Command from the SDK.
+     */
+    createInvalidation(command: SimCreateInvalidationCommand, options?: InvalidationRequestOptions): Promise<SimCreateInvalidationCommandOutput>;
+    /**
+     * Handle a Get Invalidation Command from the SDK.
+     */
+    getInvalidation(command: SimGetInvalidationCommand, options?: InvalidationRequestOptions): Promise<SimGetInvalidationCommandOutput>;
+    /**
+     * Handle a List Invalidations Command from the SDK.
+     */
+    listInvalidations(command: SimListInvalidationsCommand, options?: InvalidationRequestOptions): Promise<SimListInvalidationsCommandOutput>;
+}
+export {};

package/dist/service/cloudfront/command/invalidation/sim-cf-invalidation-commands.js

@@ -0,0 +1,35 @@
+import { SimCfCreateInvalidation } from "./sim-cf-create-invalidation.js";
+import { SimCfGetInvalidation } from "./sim-cf-get-invalidation.js";
+import { SimCfInvalidationAccess } from "./sim-cf-invalidation-access.js";
+import { SimCfListInvalidations } from "./sim-cf-list-invalidations.js";
+/**
+ * The invalidation commands on the CloudFront client.
+ *
+ * They are grouped here, the way the Function commands are, because all three
+ * work on state a Distribution holds of its own and share the lookup that
+ * reaches it.
+ */
+export class SimCfInvalidationCommands {
+    access;
+    constructor(properties) {
+        this.access = new SimCfInvalidationAccess(properties);
+    }
+    /**
+     * Handle a Create Invalidation Command from the SDK.
+     */
+    async createInvalidation(command, options) {
+        return await new SimCfCreateInvalidation(this.access).handle(command, options);
+    }
+    /**
+     * Handle a Get Invalidation Command from the SDK.
+     */
+    async getInvalidation(command, options) {
+        return await new SimCfGetInvalidation(this.access).handle(command, options);
+    }
+    /**
+     * Handle a List Invalidations Command from the SDK.
+     */
+    async listInvalidations(command, options) {
+        return await new SimCfListInvalidations(this.access).handle(command, options);
+    }
+}

package/dist/service/cloudfront/command/invalidation/sim-cf-list-invalidations.d.ts

@@ -0,0 +1,23 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfInvalidationAccess } from "./sim-cf-invalidation-access.js";
+import type { SimListInvalidationsCommand, SimListInvalidationsCommandOutput } from "./sim-cf-invalidation-command.types.js";
+/**
+ * Simulated CloudFront ListInvalidations command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/ListInvalidationsCommand/
+ */
+export declare class SimCfListInvalidations {
+    private readonly access;
+    private static readonly action;
+    constructor(access: SimCfInvalidationAccess);
+    /**
+     * List a Distribution's invalidations, most recently created first.
+     *
+     * The whole list comes back. `Marker` and `MaxItems` are the paging every
+     * other simulated listing leaves out, so the answer is never truncated and
+     * carries no `NextMarker`.
+     */
+    handle(command: SimListInvalidationsCommand, options?: {
+        readonly caller?: SimAwsCaller;
+    }): Promise<SimListInvalidationsCommandOutput>;
+}

package/dist/service/cloudfront/command/invalidation/sim-cf-list-invalidations.js

@@ -0,0 +1,39 @@
+import { simCfInvalidationSummary } from "../../invalidation/sim-cf-invalidation-view.js";
+/**
+ * What CloudFront reports as `MaxItems` for a listing that asks for none.
+ */
+const defaultMaxItems = 100;
+/**
+ * Simulated CloudFront ListInvalidations command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudfront/command/ListInvalidationsCommand/
+ */
+export class SimCfListInvalidations {
+    access;
+    static action = "cloudfront:ListInvalidations";
+    constructor(access) {
+        this.access = access;
+    }
+    /**
+     * List a Distribution's invalidations, most recently created first.
+     *
+     * The whole list comes back. `Marker` and `MaxItems` are the paging every
+     * other simulated listing leaves out, so the answer is never truncated and
+     * carries no `NextMarker`.
+     */
+    async handle(command, options) {
+        await this.access.background.sequence();
+        const distribution = this.access.authorizedDistribution(SimCfListInvalidations.action, command.input.DistributionId, options?.caller);
+        const invalidations = distribution.invalidations.newestFirst();
+        return {
+            InvalidationList: {
+                Marker: command.input.Marker ?? "",
+                MaxItems: command.input.MaxItems ?? defaultMaxItems,
+                IsTruncated: false,
+                Quantity: invalidations.length,
+                Items: invalidations.map((invalidation) => simCfInvalidationSummary(invalidation)),
+            },
+            $metadata: {},
+        };
+    }
+}

package/dist/service/cloudfront/command/update-distribution/update-distribution.handler.d.ts

@@ -9,6 +9,7 @@ import type { SimCfEdgeFunctions } from "../../edge/sim-cf-edge-functions.js";
 import type { SimCfCustomOriginDispatcher } from "../../origin/custom/sim-cf-custom-origin-dispatcher.js";
 import type { SimCloudFrontS3OriginResolver } from "../../origin/s3/sim-cloudfront-s3-origin.js";
 import type { SimCloudFrontOriginAccessControlRegistry } from "../../origin-access-control/sim-cf-origin-access-control-registry.js";
+import type { SimCloudFrontOriginRequestPolicyRegistry } from "../../origin-request-policy/sim-cf-origin-request-policy-registry.js";
 import type { SimCloudFrontResponseHeadersPolicyRegistry } from "../../response-headers-policy/sim-cf-response-headers-policy-registry.js";
 import type { SimCloudFrontCachePolicyRegistry } from "../../cache-policy/sim-cf-cache-policy-registry.js";
 import type { SimCfWebAclResolver } from "../../web-acl/sim-cf-web-acl.js";
@@ -23,6 +24,7 @@ interface UpdateDistributionCommandHandlerProperties {
     readonly originAccessControls: SimCloudFrontOriginAccessControlRegistry;
     readonly responseHeadersPolicies: SimCloudFrontResponseHeadersPolicyRegistry;
     readonly cachePolicies: SimCloudFrontCachePolicyRegistry;
+    readonly originRequestPolicies: SimCloudFrontOriginRequestPolicyRegistry;
     readonly webAclResolver?: SimCfWebAclResolver | undefined;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly acmRegistry?: SimAcmRegistry | undefined;

package/dist/service/cloudfront/controller/content/sim-cf-content-stage.d.ts

@@ -0,0 +1,51 @@
+import type { SimCloudFrontBehavior } from "../../behaviour/sim-cloud-front-behavior.js";
+import type { SimCloudFrontDistribution } from "../../distribution/sim-cloudfront-distribution.js";
+import type { SimCloudFront } from "../../sim-cloudfront.js";
+import type { SimCfCustomErrorResponder } from "../error/sim-cf-custom-error-responder.js";
+import type { SimCfOriginStage, SimCfOriginStageResult } from "../origin/sim-cf-origin-stage.js";
+/**
+ * One request, and everything the content stage needs to answer it.
+ */
+export interface SimCfContentRequest {
+    readonly request: Request;
+    readonly cloudFront: SimCloudFront;
+    readonly distribution: SimCloudFrontDistribution;
+    readonly behaviour: SimCloudFrontBehavior;
+    /**
+     * The edge the request arrived at, whose cache answers it.
+     */
+    readonly edgeId: string;
+}
+/**
+ * What the content stage produced, and which of the two produced it.
+ */
+export interface SimCfContentStageResult extends SimCfOriginStageResult {
+    /**
+     * Whether the Distribution's cache answered, which the pipeline reports to
+     * the viewer in `X-Cache`.
+     */
+    readonly cacheHit: boolean;
+}
+/**
+ * Answers a request from the Distribution's cache, or from the Origin.
+ *
+ * This is CloudFront's cache lookup and everything behind it. A key the cache
+ * holds unexpired is answered with the Origin left unread. A miss goes to the
+ * Origin, has an error replaced with the Distribution's custom error page, and
+ * is stored under the key it missed on for as long as the Origin's headers and
+ * the cache policy between them allow.
+ *
+ * An error is stored for a TTL of its own. The `ErrorCachingMinTTL` of the
+ * custom error response matching the status decides it, whether the Origin
+ * answered with the error or an origin-response function made one of an
+ * Origin's answer.
+ */
+export declare class SimCfContentStage {
+    private readonly originStage;
+    private readonly customErrorResponder;
+    constructor(originStage: SimCfOriginStage, customErrorResponder: SimCfCustomErrorResponder);
+    /**
+     * Answer one request, reading the Origin only where the cache cannot.
+     */
+    serve(content: SimCfContentRequest): Promise<SimCfContentStageResult>;
+}

package/dist/service/cloudfront/controller/content/sim-cf-content-stage.js

@@ -0,0 +1,65 @@
+import { simCfCacheableRequest } from "../../cache/sim-cf-cacheable-request.js";
+import { simCfCacheTtlSec } from "../../cache/sim-cf-cache-ttl.js";
+import { simCfErrorCacheTtlSec } from "../../cache/sim-cf-error-cache-ttl.js";
+/**
+ * Answers a request from the Distribution's cache, or from the Origin.
+ *
+ * This is CloudFront's cache lookup and everything behind it. A key the cache
+ * holds unexpired is answered with the Origin left unread. A miss goes to the
+ * Origin, has an error replaced with the Distribution's custom error page, and
+ * is stored under the key it missed on for as long as the Origin's headers and
+ * the cache policy between them allow.
+ *
+ * An error is stored for a TTL of its own. The `ErrorCachingMinTTL` of the
+ * custom error response matching the status decides it, whether the Origin
+ * answered with the error or an origin-response function made one of an
+ * Origin's answer.
+ */
+export class SimCfContentStage {
+    originStage;
+    customErrorResponder;
+    constructor(originStage, customErrorResponder) {
+        this.originStage = originStage;
+        this.customErrorResponder = customErrorResponder;
+    }
+    /**
+     * Answer one request, reading the Origin only where the cache cannot.
+     */
+    async serve(content) {
+        const { request, distribution, behaviour } = content;
+        const cacheable = simCfCacheableRequest(content);
+        const cached = cacheable === undefined
+            ? undefined
+            : distribution.cache.read(cacheable.key);
+        // A hit is answered as the Origin answered it when it was stored, so the
+        // status the pipeline reads is the cached one and a viewer-response
+        // function runs on a hit as it ran on the miss that filled the cache.
+        if (cached !== undefined) {
+            return { response: cached, originStatus: cached.status, cacheHit: true };
+        }
+        const originResult = await this.originStage.fetch(request, distribution, behaviour);
+        const response = await this.customErrorResponder.apply(request, distribution, originResult.response);
+        if (cacheable === undefined) {
+            return {
+                response,
+                originStatus: originResult.originStatus,
+                cacheHit: false,
+            };
+        }
+        const errorTtlSec = simCfErrorCacheTtlSec({
+            originStatus: originResult.originStatus,
+            response,
+            customErrorResponses: distribution.customErrorResponses,
+        });
+        return {
+            response: await distribution.cache.store(cacheable.key, response, errorTtlSec ??
+                simCfCacheTtlSec({
+                    response,
+                    policy: cacheable.policy,
+                    now: distribution.clock.now(),
+                })),
+            originStatus: originResult.originStatus,
+            cacheHit: false,
+        };
+    }
+}

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.d.ts

@@ -6,7 +6,7 @@ import { SimCffApplicator } from "../cff/sim-cff-applicator.js";
 import { SimLambdaEdgeApplicator } from "../edge/sim-lambda-edge-applicator.js";
 import { SimLambdaEdgeOriginApplicator } from "../edge/sim-lambda-edge-origin-applicator.js";
 import { SimCloudFrontOriginFetcher } from "../origin/sim-cloudfront-origin-fetcher.js";
-import { SimCfOriginStage } from "../origin/sim-cf-origin-stage.js";
+import { SimCfContentStage } from "../content/sim-cf-content-stage.js";
 import { SimCfCustomErrorResponder } from "../error/sim-cf-custom-error-responder.js";
 import { SimCfResponseHeadersApplicator } from "../response-headers/sim-cf-response-headers-applicator.js";
 import { SimCfWebAclGuard } from "../web-acl/sim-cf-web-acl-guard.js";
@@ -29,8 +29,7 @@ export interface SimCloudFrontControllerDependencies {
     readonly behaviourResolver: SimCloudFrontBehaviorResolver;
     readonly cffApplicator: SimCffApplicator;
     readonly edgeApplicator: SimLambdaEdgeApplicator;
-    readonly originStage: SimCfOriginStage;
-    readonly customErrorResponder: SimCfCustomErrorResponder;
+    readonly contentStage: SimCfContentStage;
     readonly responseHeadersApplicator: SimCfResponseHeadersApplicator;
 }
 /**

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js

@@ -7,6 +7,7 @@ import { SimLambdaEdgeOriginApplicator } from "../edge/sim-lambda-edge-origin-ap
 import { SimAwsCfEdgeFunctions } from "../../edge/sim-aws-cf-edge-functions.js";
 import { SimCloudFrontOriginFetcher } from "../origin/sim-cloudfront-origin-fetcher.js";
 import { SimCfOriginStage } from "../origin/sim-cf-origin-stage.js";
+import { SimCfContentStage } from "../content/sim-cf-content-stage.js";
 import { SimCfCustomErrorResponder } from "../error/sim-cf-custom-error-responder.js";
 import { SimCfResponseHeadersApplicator } from "../response-headers/sim-cf-response-headers-applicator.js";
 import { SimCfWebAclGuard } from "../web-acl/sim-cf-web-acl-guard.js";
@@ -40,10 +41,9 @@ export class SimCloudFrontControllerDependenciesFactory {
             cffApplicator: properties.cffApplicator ?? new SimCffApplicator(),
             edgeApplicator: properties.edgeApplicator ??
                 new SimLambdaEdgeApplicator({ edgeFunctions }),
-            originStage: new SimCfOriginStage(originFetcher, properties.edgeOriginApplicator ??
-                new SimLambdaEdgeOriginApplicator({ edgeFunctions })),
-            customErrorResponder: properties.customErrorResponder ??
-                new SimCfCustomErrorResponder({ behaviourResolver, originFetcher }),
+            contentStage: new SimCfContentStage(new SimCfOriginStage(originFetcher, properties.edgeOriginApplicator ??
+                new SimLambdaEdgeOriginApplicator({ edgeFunctions })), properties.customErrorResponder ??
+                new SimCfCustomErrorResponder({ behaviourResolver, originFetcher })),
             responseHeadersApplicator: properties.responseHeadersApplicator ??
                 new SimCfResponseHeadersApplicator(),
         };

package/dist/service/cloudfront/controller/error/sim-cf-custom-error-responder.d.ts

@@ -12,6 +12,10 @@ interface SimCfCustomErrorResponderProperties {
  * matching the response page path decides which Origin it comes from. That is
  * what lets a Distribution keep its error pages somewhere other than the
  * content that failed, as CloudFront does.
+ *
+ * A rule carrying `ErrorCachingMinTTL` alone has no page. The Origin's error
+ * reaches the viewer, and the rule says how long the Distribution holds it
+ * for.
  */
 export declare class SimCfCustomErrorResponder {
     private readonly behaviourResolver;

package/dist/service/cloudfront/controller/error/sim-cf-custom-error-responder.js

@@ -5,6 +5,10 @@
  * matching the response page path decides which Origin it comes from. That is
  * what lets a Distribution keep its error pages somewhere other than the
  * content that failed, as CloudFront does.
+ *
+ * A rule carrying `ErrorCachingMinTTL` alone has no page. The Origin's error
+ * reaches the viewer, and the rule says how long the Distribution holds it
+ * for.
  */
 export class SimCfCustomErrorResponder {
     behaviourResolver;
@@ -18,14 +22,14 @@ export class SimCfCustomErrorResponder {
      * Distribution configures one for its status.
      */
     async apply(request, distribution, response) {
-        const customErrorResponse = distribution.customErrorResponses.find((candidate) => candidate.errorCode === response.status);
-        if (customErrorResponse === undefined) {
+        const page = distribution.customErrorResponses.find((candidate) => candidate.errorCode === response.status)?.page;
+        if (page === undefined) {
             return response;
         }
-        return await this.responsePage(request, distribution, customErrorResponse);
+        return await this.responsePage(request, distribution, page);
     }
-    async responsePage(request, distribution, customErrorResponse) {
-        const pageRequest = this.pageRequest(request, customErrorResponse);
+    async responsePage(request, distribution, page) {
+        const pageRequest = this.pageRequest(request, page);
         const behaviour = this.behaviourResolver.resolve(pageRequest, distribution);
         const pageResponse = await this.originFetcher.fetch(pageRequest, distribution, behaviour);
         // A response page that is itself unavailable leaves the viewer with the
@@ -34,13 +38,13 @@ export class SimCfCustomErrorResponder {
             return pageResponse;
         }
         return new Response(pageResponse.body, {
-            status: customErrorResponse.responseCode,
+            status: page.responseCode,
             headers: pageResponse.headers,
         });
     }
-    pageRequest(request, customErrorResponse) {
+    pageRequest(request, page) {
         const url = new URL(request.url);
-        url.pathname = customErrorResponse.responsePagePath;
+        url.pathname = page.responsePagePath;
         url.search = "";
         // The response page is fetched without a body, whatever the viewer sent,
         // so headers describing the viewer's body would describe nothing.

package/dist/service/cloudfront/controller/origin/sim-cf-origin-stage.d.ts

@@ -25,8 +25,8 @@ export interface SimCfOriginStageResult {
  * Fetches from the Behavior's Origin, running the Lambda@Edge functions on
  * either side of the fetch.
  *
- * Real CloudFront runs the origin events on a cache miss only. Nothing here
- * caches, so every request is a miss and both events run every time.
+ * Real CloudFront runs the origin events on a cache miss only, and so does
+ * this. A request the Distribution's cache answers never reaches this stage.
  */
 export declare class SimCfOriginStage {
     private readonly originFetcher;

package/dist/service/cloudfront/controller/origin/sim-cf-origin-stage.js

@@ -2,8 +2,8 @@
  * Fetches from the Behavior's Origin, running the Lambda@Edge functions on
  * either side of the fetch.
  *
- * Real CloudFront runs the origin events on a cache miss only. Nothing here
- * caches, so every request is a miss and both events run every time.
+ * Real CloudFront runs the origin events on a cache miss only, and so does
+ * this. A request the Distribution's cache answers never reaches this stage.
  */
 export class SimCfOriginStage {
     originFetcher;

package/dist/service/cloudfront/controller/sim-cloudfront-request-pipeline.d.ts

@@ -1,12 +1,12 @@
 import type { SimCloudFrontControllerDependencies } from "./dependency/sim-cf-controller-dependency.js";
 /**
  * Runs a single simulated CloudFront request through its lifecycle:
- * route to a Distribution, put the request through the Distribution's web ACL,
- * apply the default root object, resolve the matching Behavior, run
- * viewer-request hooks, fetch from the Origin with the origin hooks either
- * side of the fetch, replace an error response with the Distribution's custom
- * error page, apply the Behavior's response headers policy, then run
- * viewer-response hooks where the Origin did not answer with an error.
+ * read the edge it arrived at, route to a Distribution, put the request
+ * through the Distribution's web ACL, apply the default root object, resolve
+ * the matching Behavior, run viewer-request hooks, answer from that edge's
+ * cache or from the Origin, say which of the two answered in `X-Cache`, apply
+ * the Behavior's response headers policy, then run viewer-response hooks where
+ * the Origin did not answer with an error.
  *
  * A viewer hook is a CloudFront Function or a Lambda@Edge function. A Behavior
  * carries at most one of the two kinds at the viewer events, which

package/dist/service/cloudfront/controller/sim-cloudfront-request-pipeline.js

@@ -1,12 +1,14 @@
+import { simCfCacheStatusResponse } from "../cache/sim-cf-cache-status.js";
+import { simCfRequestEdge } from "../cache/sim-cf-edge.js";
 import { simCfDefaultRootObjectRequest } from "./root-object/sim-cf-default-root-object-request.js";
 /**
  * Runs a single simulated CloudFront request through its lifecycle:
- * route to a Distribution, put the request through the Distribution's web ACL,
- * apply the default root object, resolve the matching Behavior, run
- * viewer-request hooks, fetch from the Origin with the origin hooks either
- * side of the fetch, replace an error response with the Distribution's custom
- * error page, apply the Behavior's response headers policy, then run
- * viewer-response hooks where the Origin did not answer with an error.
+ * read the edge it arrived at, route to a Distribution, put the request
+ * through the Distribution's web ACL, apply the default root object, resolve
+ * the matching Behavior, run viewer-request hooks, answer from that edge's
+ * cache or from the Origin, say which of the two answered in `X-Cache`, apply
+ * the Behavior's response headers policy, then run viewer-response hooks where
+ * the Origin did not answer with an error.
  *
  * A viewer hook is a CloudFront Function or a Lambda@Edge function. A Behavior
  * carries at most one of the two kinds at the viewer events, which
@@ -27,7 +29,11 @@ export class SimCloudFrontRequestPipeline {
      * Process one incoming request and produce the response the caller sees.
      */
     async handle(request) {
-        let requestReference = request;
+        // The edge is read first and its header taken off the request. A web ACL
+        // rule, an edge function and the Origin therefore never see an instruction
+        // that was addressed to the simulator.
+        const edge = simCfRequestEdge(request);
+        let requestReference = edge.request;
         const route = this.stages.distroRouter.routeForRequest(requestReference);
         if (route === undefined) {
             return new Response("Suitable sim CloudFront Distribution not found", {
@@ -62,25 +68,34 @@ export class SimCloudFrontRequestPipeline {
             return edgeResult;
         }
         requestReference = edgeResult;
-        // Fetch from the Origin, running the origin-request and origin-response
-        // Lambda@Edge functions on either side of the fetch. An origin-request
-        // function that answered with a response of its own leaves the Origin
-        // unread, and the response takes the Origin response's place from here on.
-        const originResult = await this.stages.originStage.fetch(requestReference, distro, behaviour);
-        // Replace an Origin error with the Distribution's custom error page, if it
-        // configures one for that status.
-        const errorResponse = await this.stages.customErrorResponder.apply(requestReference, distro, originResult.response);
+        // Answer from this edge's cache where it holds the key, and from the Origin
+        // where it does not. A miss runs the origin-request and origin-response
+        // Lambda@Edge functions either side of the fetch, has an Origin error
+        // replaced with the Distribution's custom error page, and is stored.
+        const content = await this.stages.contentStage.serve({
+            request: requestReference,
+            cloudFront,
+            distribution: distro,
+            behaviour,
+            edgeId: edge.edgeId,
+        });
+        // Say whether the cache or the Origin answered, as CloudFront says it. A
+        // hit already carries the `Age` the cache measured. Both go on ahead of the
+        // response headers policy and the viewer-response event. A policy can take
+        // either off, and a viewer-response function sees them.
+        const served = simCfCacheStatusResponse(content.response, content.cacheHit);
         // Apply the Behavior's response headers policy, if it names one. CloudFront
         // does this after the response leaves the cache and before the
         // viewer-response event, so the custom error page above carries the
         // policy's headers and a viewer-response function that runs sees them.
-        const response = this.stages.responseHeadersApplicator.apply(cloudFront, requestReference, errorResponse, behaviour);
+        const response = this.stages.responseHeadersApplicator.apply(cloudFront, requestReference, served, behaviour);
         // CloudFront runs no viewer-response function when the Origin answered
         // 400 or higher, for either kind of function. The status that decides it
-        // is the one the Origin returned, so neither a custom error response
-        // carrying `ResponseCode: 200` above nor an origin-response function that
-        // replaced the status brings the function back.
-        if (originResult.originStatus >= 400) {
+        // is the one the Origin returned, or the one it returned when the cache
+        // entry being served was stored. Neither a custom error response carrying
+        // `ResponseCode: 200` nor an origin-response function that replaced the
+        // status brings the function back.
+        if (content.originStatus >= 400) {
             return response;
         }
         // Handle viewer-response CFF, if any.

package/dist/service/cloudfront/custom-error/sim-cloudfront-custom-error-response.d.ts

@@ -9,15 +9,33 @@ export declare const simCloudFrontCustomErrorCodes: ReadonlySet<number>;
  * page for an error without telling the viewer anything went wrong.
  */
 export declare const simCloudFrontCustomErrorResponseCodes: ReadonlySet<number>;
+/**
+ * How long CloudFront holds an error for where a rule names no
+ * `ErrorCachingMinTTL`, and where a Distribution configures no rule for the
+ * status at all.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HTTPStatusCodes.html
+ */
+export declare const simCloudFrontDefaultErrorCachingMinTtlSec = 10;
+/**
+ * The page a custom error response serves in place of the Origin's error.
+ *
+ * CloudFront pairs `ResponsePagePath` and `ResponseCode`. A rule carries both
+ * or neither.
+ */
+export interface SimCloudFrontCustomErrorPage {
+    readonly responsePagePath: string;
+    readonly responseCode: number;
+}
 /**
  * A custom error response of a sim CloudFront Distribution.
  *
- * Only a rule with a response page reaches this model. A rule carrying nothing
- * but `ErrorCode` and `ErrorCachingMinTTL` configures error caching, which the
- * simulator has nothing to cache with.
+ * A rule carrying nothing but `ErrorCode` and `ErrorCachingMinTTL` configures
+ * how long the Origin's own error is held for. It has no page, and the viewer
+ * gets what the Origin answered.
  */
 export interface SimCloudFrontCustomErrorResponse {
     readonly errorCode: number;
-    readonly responsePagePath: string;
-    readonly responseCode: number;
+    readonly errorCachingMinTtlSec: number;
+    readonly page?: SimCloudFrontCustomErrorPage | undefined;
 }

package/dist/service/cloudfront/custom-error/sim-cloudfront-custom-error-response.js

@@ -11,3 +11,11 @@ export const simCloudFrontCustomErrorCodes = new Set([
  * page for an error without telling the viewer anything went wrong.
  */
 export const simCloudFrontCustomErrorResponseCodes = new Set([200, ...simCloudFrontCustomErrorCodes]);
+/**
+ * How long CloudFront holds an error for where a rule names no
+ * `ErrorCachingMinTTL`, and where a Distribution configures no rule for the
+ * status at all.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HTTPStatusCodes.html
+ */
+export const simCloudFrontDefaultErrorCachingMinTtlSec = 10;

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-origin-request-policy.d.ts

@@ -0,0 +1,18 @@
+import type { SimCloudFrontOriginRequestPolicyRegistry } from "../../origin-request-policy/sim-cf-origin-request-policy-registry.js";
+/**
+ * Refuses a Cache Behavior naming an origin request policy this simulation
+ * does not hold.
+ *
+ * Real CloudFront checks this when the Distribution is created or updated, so
+ * a template naming a mistyped policy ID fails the deploy there too, rather
+ * than deploying successfully and only failing the first request that reaches
+ * the Behavior.
+ */
+export declare class SimCfBehaviorOriginRequestPolicy {
+    private readonly policies;
+    constructor(policies: SimCloudFrontOriginRequestPolicyRegistry);
+    /**
+     * Refuse one Behavior naming a policy which is not there.
+     */
+    assertExists(targetOriginId: string | undefined, originRequestPolicyId: string | undefined): void;
+}

package/dist/service/cloudfront/distribution/configurator/sim-cf-behavior-origin-request-policy.js

@@ -0,0 +1,30 @@
+import { SimCloudFrontNoSuchOriginRequestPolicy } from "../../error/sim-cf-origin-request-policy.error.js";
+/**
+ * Refuses a Cache Behavior naming an origin request policy this simulation
+ * does not hold.
+ *
+ * Real CloudFront checks this when the Distribution is created or updated, so
+ * a template naming a mistyped policy ID fails the deploy there too, rather
+ * than deploying successfully and only failing the first request that reaches
+ * the Behavior.
+ */
+export class SimCfBehaviorOriginRequestPolicy {
+    policies;
+    constructor(policies) {
+        this.policies = policies;
+    }
+    /**
+     * Refuse one Behavior naming a policy which is not there.
+     */
+    assertExists(targetOriginId, originRequestPolicyId) {
+        if (originRequestPolicyId === undefined ||
+            this.policies.byId(originRequestPolicyId) !== undefined) {
+            return;
+        }
+        throw new SimCloudFrontNoSuchOriginRequestPolicy(`Sim CloudFront Behavior for Origin ${targetOriginId} names origin ` +
+            `request policy ${originRequestPolicyId}, which does not exist. A ` +
+            `Behavior names one of CloudFront's eight managed policies, or a ` +
+            `policy an AWS::CloudFront::OriginRequestPolicy Resource created in ` +
+            `this simulation. A policy ID from a real account is neither.`);
+    }
+}