@kensio/yulin 1.20.17 → 1.21.1

package/dist/service/cloudfront/invalidation/sim-cf-invalidation-view.js

@@ -0,0 +1,33 @@
+/**
+ * Build the API view of a sim CloudFront invalidation.
+ */
+export function simCfInvalidationView(invalidation) {
+    return {
+        Id: invalidation.invalidationId,
+        Status: invalidation.status,
+        CreateTime: invalidation.createTime,
+        InvalidationBatch: {
+            Paths: {
+                Quantity: invalidation.paths.length,
+                Items: invalidation.paths,
+            },
+            CallerReference: invalidation.callerReference,
+        },
+    };
+}
+/**
+ * Build the listing view of a sim CloudFront invalidation.
+ */
+export function simCfInvalidationSummary(invalidation) {
+    return {
+        Id: invalidation.invalidationId,
+        CreateTime: invalidation.createTime,
+        Status: invalidation.status,
+    };
+}
+/**
+ * The URL CreateInvalidation reports the new invalidation at.
+ */
+export function simCfInvalidationLocation(distributionId, invalidationId) {
+    return `https://cloudfront.amazonaws.com/2020-05-31/distribution/${distributionId}/invalidation/${invalidationId}`;
+}

package/dist/service/cloudfront/invalidation/sim-cf-invalidation.d.ts

@@ -0,0 +1,55 @@
+import type { Brand } from "../../../util/brand.type.js";
+export type SimCfInvalidationId = Brand<string, "SimCfInvalidationId">;
+/**
+ * How far an invalidation has got.
+ *
+ * CloudFront answers CreateInvalidation with `InProgress` and moves the
+ * invalidation to `Completed` once every edge has been told, the way a
+ * Distribution reaches `Deployed`.
+ */
+export type SimCfInvalidationStatus = "InProgress" | "Completed";
+interface SimCfInvalidationProperties {
+    readonly invalidationId: SimCfInvalidationId;
+    readonly callerReference: string;
+    readonly paths: readonly string[];
+    readonly createTime: Date;
+}
+/**
+ * One simulated CloudFront invalidation.
+ *
+ * An invalidation is the batch of paths a caller asked to be cleared, plus
+ * where clearing them has got to. It belongs to the Distribution it was
+ * created against, which is what GetInvalidation and ListInvalidations read it
+ * back from.
+ */
+export declare class SimCfInvalidation {
+    #private;
+    readonly invalidationId: SimCfInvalidationId;
+    readonly callerReference: string;
+    readonly paths: readonly string[];
+    readonly createTime: Date;
+    constructor(properties: SimCfInvalidationProperties);
+    /**
+     * Whether this invalidation is still running.
+     */
+    get status(): SimCfInvalidationStatus;
+    /**
+     * Move this invalidation into Completed status.
+     */
+    completeInvalidation(): Promise<void>;
+    /**
+     * Whether a batch names the same paths as this one did.
+     *
+     * This is what decides whether a repeated `CallerReference` answers with the
+     * invalidation already created or is refused. The paths are compared in the
+     * order they were sent, since that is the batch CloudFront was given, and
+     * each one is read the way an invalidation reads it, so `*` and `/*` are the
+     * same batch.
+     */
+    namesSamePaths(paths: readonly string[]): boolean;
+}
+/**
+ * Generate a fake sim CloudFront invalidation ID.
+ */
+export declare function makeSimCfInvalidationId(): SimCfInvalidationId;
+export {};

package/dist/service/cloudfront/invalidation/sim-cf-invalidation.js

@@ -0,0 +1,56 @@
+import { faker } from "@faker-js/faker";
+import { simCfInvalidationPath } from "./sim-cf-invalidation-path.js";
+/**
+ * One simulated CloudFront invalidation.
+ *
+ * An invalidation is the batch of paths a caller asked to be cleared, plus
+ * where clearing them has got to. It belongs to the Distribution it was
+ * created against, which is what GetInvalidation and ListInvalidations read it
+ * back from.
+ */
+export class SimCfInvalidation {
+    invalidationId;
+    callerReference;
+    paths;
+    createTime;
+    #status = "InProgress";
+    constructor(properties) {
+        this.invalidationId = properties.invalidationId;
+        this.callerReference = properties.callerReference;
+        this.paths = properties.paths;
+        this.createTime = properties.createTime;
+    }
+    /**
+     * Whether this invalidation is still running.
+     */
+    get status() {
+        return this.#status;
+    }
+    /**
+     * Move this invalidation into Completed status.
+     */
+    completeInvalidation() {
+        this.#status = "Completed";
+        return Promise.resolve();
+    }
+    /**
+     * Whether a batch names the same paths as this one did.
+     *
+     * This is what decides whether a repeated `CallerReference` answers with the
+     * invalidation already created or is refused. The paths are compared in the
+     * order they were sent, since that is the batch CloudFront was given, and
+     * each one is read the way an invalidation reads it, so `*` and `/*` are the
+     * same batch.
+     */
+    namesSamePaths(paths) {
+        const named = paths.map((path) => simCfInvalidationPath(path));
+        return (this.paths.length === named.length &&
+            this.paths.every((path, index) => simCfInvalidationPath(path) === named.at(index)));
+    }
+}
+/**
+ * Generate a fake sim CloudFront invalidation ID.
+ */
+export function makeSimCfInvalidationId() {
+    return faker.helpers.fromRegExp(/I[0-9A-Z]{13}/);
+}

package/dist/service/cloudfront/invalidation/sim-cf-invalidations.d.ts

@@ -0,0 +1,41 @@
+import { type SimCfInvalidation, type SimCfInvalidationId } from "./sim-cf-invalidation.js";
+/**
+ * The invalidations one simulated Distribution has been asked for.
+ *
+ * An invalidation is scoped to its Distribution, so this hangs off the
+ * Distribution rather than off the service. It holds them in the order they
+ * were created, which is the order the counts and the listing are read back
+ * from.
+ */
+export declare class SimCfInvalidations {
+    private readonly invalidations;
+    /**
+     * Allocate an invalidation ID no invalidation of this Distribution holds.
+     */
+    allocateInvalidationId(): SimCfInvalidationId;
+    /**
+     * Hold on to an invalidation.
+     */
+    add(invalidation: SimCfInvalidation): void;
+    /**
+     * Get an invalidation by ID.
+     */
+    byId(invalidationId: SimCfInvalidationId | string): SimCfInvalidation | undefined;
+    /**
+     * Get the invalidation created under a `CallerReference`, if there is one.
+     *
+     * A `CallerReference` is what makes a batch idempotent, so this is what a
+     * repeated one is answered from.
+     */
+    byCallerReference(callerReference: string): SimCfInvalidation | undefined;
+    /**
+     * The invalidations of this Distribution, most recently created first, as
+     * CloudFront lists them.
+     */
+    newestFirst(): readonly SimCfInvalidation[];
+    /**
+     * How many invalidations of this Distribution are still running, which is
+     * what GetDistribution reports as `InProgressInvalidationBatches`.
+     */
+    get inProgressCount(): number;
+}

package/dist/service/cloudfront/invalidation/sim-cf-invalidations.js

@@ -0,0 +1,58 @@
+import { makeSimCfInvalidationId, } from "./sim-cf-invalidation.js";
+/**
+ * The invalidations one simulated Distribution has been asked for.
+ *
+ * An invalidation is scoped to its Distribution, so this hangs off the
+ * Distribution rather than off the service. It holds them in the order they
+ * were created, which is the order the counts and the listing are read back
+ * from.
+ */
+export class SimCfInvalidations {
+    invalidations = [];
+    /**
+     * Allocate an invalidation ID no invalidation of this Distribution holds.
+     */
+    allocateInvalidationId() {
+        let invalidationId = makeSimCfInvalidationId();
+        while (this.byId(invalidationId) !== undefined) {
+            /* v8 ignore next -- does not happen in practice */
+            invalidationId = makeSimCfInvalidationId();
+        }
+        return invalidationId;
+    }
+    /**
+     * Hold on to an invalidation.
+     */
+    add(invalidation) {
+        this.invalidations.push(invalidation);
+    }
+    /**
+     * Get an invalidation by ID.
+     */
+    byId(invalidationId) {
+        return this.invalidations.find((invalidation) => invalidation.invalidationId === invalidationId);
+    }
+    /**
+     * Get the invalidation created under a `CallerReference`, if there is one.
+     *
+     * A `CallerReference` is what makes a batch idempotent, so this is what a
+     * repeated one is answered from.
+     */
+    byCallerReference(callerReference) {
+        return this.invalidations.find((invalidation) => invalidation.callerReference === callerReference);
+    }
+    /**
+     * The invalidations of this Distribution, most recently created first, as
+     * CloudFront lists them.
+     */
+    newestFirst() {
+        return this.invalidations.toReversed();
+    }
+    /**
+     * How many invalidations of this Distribution are still running, which is
+     * what GetDistribution reports as `InProgressInvalidationBatches`.
+     */
+    get inProgressCount() {
+        return this.invalidations.filter((invalidation) => invalidation.status === "InProgress").length;
+    }
+}

package/dist/service/cloudfront/invalidation/sim-cf-repeated-invalidation.d.ts

@@ -0,0 +1,15 @@
+import type { SimCloudFrontDistribution } from "../distribution/sim-cloudfront-distribution.js";
+import type { SimCfInvalidation } from "./sim-cf-invalidation.js";
+/**
+ * The invalidation a `CallerReference` already created, where a batch repeats
+ * it.
+ *
+ * A `CallerReference` makes a batch idempotent. A repeat naming the same paths
+ * is answered with what it created the first time, and nothing is cleared
+ * again. A repeat naming different paths is refused, since the reference then
+ * names two batches.
+ *
+ * A reference this Distribution has never seen answers with nothing, and the
+ * caller creates an invalidation for it.
+ */
+export declare function simCfRepeatedInvalidation(distribution: SimCloudFrontDistribution, callerReference: string, paths: readonly string[]): SimCfInvalidation | undefined;

package/dist/service/cloudfront/invalidation/sim-cf-repeated-invalidation.js

@@ -0,0 +1,23 @@
+import { SimCloudFrontInvalidationBatchAlreadyExists } from "../error/sim-cf-invalidation.error.js";
+/**
+ * The invalidation a `CallerReference` already created, where a batch repeats
+ * it.
+ *
+ * A `CallerReference` makes a batch idempotent. A repeat naming the same paths
+ * is answered with what it created the first time, and nothing is cleared
+ * again. A repeat naming different paths is refused, since the reference then
+ * names two batches.
+ *
+ * A reference this Distribution has never seen answers with nothing, and the
+ * caller creates an invalidation for it.
+ */
+export function simCfRepeatedInvalidation(distribution, callerReference, paths) {
+    const existing = distribution.invalidations.byCallerReference(callerReference);
+    if (existing === undefined) {
+        return undefined;
+    }
+    if (!existing.namesSamePaths(paths)) {
+        throw new SimCloudFrontInvalidationBatchAlreadyExists(`Sim CloudFront invalidation batch ${existing.invalidationId} on Distribution ${distribution.distributionId} was created with CallerReference ${callerReference} and different paths`);
+    }
+    return existing;
+}

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-forwarding.d.ts

@@ -0,0 +1,19 @@
+import type { SimCfForwardedToOrigin } from "../../origin-request-policy/sim-cf-forwarded-to-origin.js";
+/**
+ * The query string the Origin is asked for, holding the names the policies
+ * carry and nothing else.
+ *
+ * The pairs that travel keep the spelling the viewer wrote them in. A query
+ * string re-encoded on the way through is no longer the one the viewer asked
+ * for. A name the viewer repeated is repeated to the Origin, which dropping a
+ * repeat would change.
+ */
+export declare function simCfForwardedOriginSearch(viewerSearch: string, forwarded: SimCfForwardedToOrigin): string;
+/**
+ * The headers the Origin is sent, which are the viewer's narrowed to what the
+ * policies carry plus the ones CloudFront sends regardless.
+ *
+ * `Host` is left to the caller, which is the one part of the Origin request
+ * that comes from the Origin rather than from the viewer or the policies.
+ */
+export declare function simCfForwardedOriginHeaders(viewerHeaders: Headers, forwarded: SimCfForwardedToOrigin): Headers;

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-forwarding.js

@@ -0,0 +1,116 @@
+/**
+ * The `User-Agent` CloudFront sends when the policies do not carry the
+ * viewer's own.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html
+ */
+const cloudFrontUserAgent = "Amazon CloudFront";
+/**
+ * The headers CloudFront sends whatever the policies name.
+ *
+ * These describe the body travelling with the request rather than the viewer
+ * making it, and an Origin that lost them would read the wrong bytes.
+ */
+const bodyHeaders = new Set([
+    "content-length",
+    "content-type",
+    "transfer-encoding",
+]);
+/**
+ * The query string the Origin is asked for, holding the names the policies
+ * carry and nothing else.
+ *
+ * The pairs that travel keep the spelling the viewer wrote them in. A query
+ * string re-encoded on the way through is no longer the one the viewer asked
+ * for. A name the viewer repeated is repeated to the Origin, which dropping a
+ * repeat would change.
+ */
+export function simCfForwardedOriginSearch(viewerSearch, forwarded) {
+    const forwardedPairs = viewerSearch
+        .replace(/^\?/u, "")
+        .split("&")
+        .filter((pair) => pair.length > 0)
+        .filter((pair) => forwarded.forwardsQueryString(queryStringName(pair)));
+    return forwardedPairs.length === 0 ? "" : `?${forwardedPairs.join("&")}`;
+}
+/**
+ * The headers the Origin is sent, which are the viewer's narrowed to what the
+ * policies carry plus the ones CloudFront sends regardless.
+ *
+ * `Host` is left to the caller, which is the one part of the Origin request
+ * that comes from the Origin rather than from the viewer or the policies.
+ */
+export function simCfForwardedOriginHeaders(viewerHeaders, forwarded) {
+    const headers = new Headers();
+    for (const [name, value] of viewerHeaders) {
+        if (bodyHeaders.has(name) || forwarded.forwardsHeader(name)) {
+            headers.set(name, value);
+        }
+    }
+    applyForwardedCookies(viewerHeaders, headers, forwarded);
+    applyUserAgent(headers, forwarded);
+    applyAcceptEncoding(viewerHeaders, headers, forwarded);
+    return headers;
+}
+/**
+ * The name half of one `name=value` pair, read the way a viewer's own client
+ * wrote it rather than as the bytes it was sent as.
+ */
+function queryStringName(pair) {
+    const [name = ""] = new URLSearchParams(pair).keys();
+    return name;
+}
+/**
+ * Write the cookies the policies carry into the one `Cookie` header a request
+ * sends them all in, leaving the header off where none of them travels.
+ *
+ * A policy naming `Cookie` in its headers section carries the header whole,
+ * whatever its cookies section says.
+ */
+function applyForwardedCookies(viewerHeaders, headers, forwarded) {
+    if (forwarded.forwardsHeader("cookie")) {
+        return;
+    }
+    const cookies = (viewerHeaders.get("cookie") ?? "")
+        .split(";")
+        .map((cookie) => cookie.trim())
+        .filter((cookie) => cookie.length > 0)
+        .filter((cookie) => forwarded.forwardsCookie(cookieName(cookie)));
+    if (cookies.length > 0) {
+        headers.set("cookie", cookies.join("; "));
+    }
+}
+/**
+ * The name half of one `name=value` cookie.
+ */
+function cookieName(cookie) {
+    const [name = ""] = cookie.split("=", 1);
+    return name;
+}
+/**
+ * State CloudFront as the user agent where the policies do not carry the
+ * viewer's own, as CloudFront states itself.
+ */
+function applyUserAgent(headers, forwarded) {
+    if (!forwarded.forwardsHeader("user-agent")) {
+        headers.set("user-agent", cloudFrontUserAgent);
+    }
+}
+/**
+ * Ask the Origin for the compression the cache policy keyed on.
+ *
+ * A cache policy that set either `EnableAcceptEncoding` flag decides this
+ * header on its own, and the normalized value replaces a viewer's own that an
+ * origin request policy carried. A policy that set neither leaves whatever the
+ * policies carried, which is the viewer's header or no header at all.
+ */
+function applyAcceptEncoding(viewerHeaders, headers, forwarded) {
+    if (!forwarded.keysOnCompression) {
+        return;
+    }
+    const acceptEncoding = forwarded.normalizedAcceptEncoding(viewerHeaders);
+    headers.delete("accept-encoding");
+    if (acceptEncoding !== undefined) {
+        headers.set("accept-encoding", acceptEncoding);
+    }
+}

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-request.d.ts

@@ -1,7 +1,13 @@
+import type { SimCfForwardedToOrigin } from "../../origin-request-policy/sim-cf-forwarded-to-origin.js";
 interface SimCfCustomOriginRequestProperties {
     readonly domainName: string;
     readonly originPath: string;
     readonly request: Request;
+    /**
+     * What the Behavior's cache policy and origin request policy carry to the
+     * Origin between them.
+     */
+    readonly forwarded: SimCfForwardedToOrigin;
     /**
      * The Origin's own custom headers, keyed by lower-case header name.
      */
@@ -16,11 +22,15 @@ interface SimCfCustomOriginRequestProperties {
 /**
  * Build the request sim CloudFront sends on to a custom Origin.
  *
- * CloudFront keeps the viewer's method, headers, query string and body, sends
- * the Origin's own domain as the host, and prefixes the Origin path to the
- * request path. The Origin domain is rewritten to its Yulin-local form here,
- * so that an AWS endpoint hostname is resolved by the same host handling that
- * serves the simulated environment on localhost.
+ * CloudFront keeps the viewer's method and body, prefixes the Origin path to
+ * the request path, and sends the Origin's own domain as the host. Of the
+ * viewer's headers, cookies and query strings it sends what the Behavior's two
+ * policies name between them and drops the rest. An Origin reads what the
+ * Distribution was configured to tell it.
+ *
+ * The Origin domain is rewritten to its Yulin-local form here, so that an AWS
+ * endpoint hostname is resolved by the same host handling that serves the
+ * simulated environment on localhost.
  */
 export declare function simCfCustomOriginRequest(properties: SimCfCustomOriginRequestProperties): Request;
 export {};

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-request.js

@@ -1,23 +1,28 @@
 import { SimAwsLocalUrl } from "../../../../serve/http/url/sim-aws-local-url.js";
 import { stripSimAwsControlHeaders } from "../../../iam/request/sim-aws-control-headers.js";
+import { simCfForwardedOriginHeaders, simCfForwardedOriginSearch, } from "./sim-cf-custom-origin-forwarding.js";
 /**
  * Build the request sim CloudFront sends on to a custom Origin.
  *
- * CloudFront keeps the viewer's method, headers, query string and body, sends
- * the Origin's own domain as the host, and prefixes the Origin path to the
- * request path. The Origin domain is rewritten to its Yulin-local form here,
- * so that an AWS endpoint hostname is resolved by the same host handling that
- * serves the simulated environment on localhost.
+ * CloudFront keeps the viewer's method and body, prefixes the Origin path to
+ * the request path, and sends the Origin's own domain as the host. Of the
+ * viewer's headers, cookies and query strings it sends what the Behavior's two
+ * policies name between them and drops the rest. An Origin reads what the
+ * Distribution was configured to tell it.
+ *
+ * The Origin domain is rewritten to its Yulin-local form here, so that an AWS
+ * endpoint hostname is resolved by the same host handling that serves the
+ * simulated environment on localhost.
  */
 export function simCfCustomOriginRequest(properties) {
-    const { request } = properties;
+    const { request, forwarded } = properties;
     const viewerUrl = new URL(request.url);
     const originUrl = new SimAwsLocalUrl({
         input: `https://${properties.domainName}`,
     }).toURL();
     originUrl.pathname = originRequestPath(properties.originPath, viewerUrl.pathname);
-    originUrl.search = viewerUrl.search;
-    const headers = new Headers(request.headers);
+    originUrl.search = simCfForwardedOriginSearch(viewerUrl.search, forwarded);
+    const headers = simCfForwardedOriginHeaders(request.headers, forwarded);
     headers.set("host", originUrl.host);
     // Who the Origin request is from is the Origin's business, not the viewer's,
     // so a viewer's own control headers are dropped before the Origin's are

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.js

@@ -66,15 +66,18 @@ export class SimCfCustomOriginSigner {
  * POST or PUT that carried no hash through a signing origin access control is
  * refused at the Origin, which is what real CloudFront and Lambda do with one.
  *
- * A viewer's own header travels with the rest of its headers, so nothing is
- * stated for it here.
+ * The viewer's own header is restated here rather than left to travel with the
+ * rest of them, since the Behavior's policies decide which of the viewer's
+ * headers reach the Origin and a signature is not theirs to withhold.
  *
  * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-lambda.html
  */
 function payloadDeclaration(viewerRequest) {
-    if (!bodyCarryingMethods.has(viewerRequest.method.toUpperCase()) ||
-        viewerRequest.headers.has(simIamSigV4ContentSha256Header)) {
+    if (!bodyCarryingMethods.has(viewerRequest.method.toUpperCase())) {
         return {};
     }
-    return { [simIamSigV4ContentSha256Header]: simIamSigV4UnsignedPayload };
+    return {
+        [simIamSigV4ContentSha256Header]: viewerRequest.headers.get(simIamSigV4ContentSha256Header) ??
+            simIamSigV4UnsignedPayload,
+    };
 }

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.d.ts

@@ -2,6 +2,7 @@ import type { LambdaAtEdge } from "../../typings/lambda-at-edge.namespace.js";
 import type { SimCloudFrontOriginAccessControl } from "../../origin-access-control/sim-cf-origin-access-control.js";
 import type { SimCloudFrontOrigin } from "../sim-cloudfront-origin.js";
 import type { SimCloudFrontOriginRequest } from "../sim-cloudfront-request-response.js";
+import { type SimCfBehaviorPolicyRegistries } from "../../origin-request-policy/sim-cf-behavior-forwarded.js";
 import type { SimCfCustomOriginDispatcher } from "./sim-cf-custom-origin-dispatcher.js";
 interface SimCloudFrontCustomOriginProperties {
     readonly originId: string;
@@ -14,6 +15,13 @@ interface SimCloudFrontCustomOriginProperties {
      * keyed by lower-case header name.
      */
     readonly customHeaders?: Readonly<Record<string, string>> | undefined;
+    /**
+     * The policies a Behavior's forwarding is read from, which decide what of
+     * the viewer's request reaches this Origin. Without them a Behavior names no
+     * policy this Origin can read, and carries what CloudFront sends of its own
+     * accord and nothing else.
+     */
+    readonly policies?: SimCfBehaviorPolicyRegistries | undefined;
 }
 /**
  * Simulated CloudFront custom Origin.
@@ -45,10 +53,15 @@ export declare class SimCloudFrontCustomOrigin implements SimCloudFrontOrigin {
     private readonly originId;
     private readonly dispatcher;
     private readonly signer;
+    private readonly policies;
     constructor(properties: SimCloudFrontCustomOriginProperties);
     /**
      * Fetch the request from the simulated service behind this Origin.
      *
+     * The Behavior the request resolved to decides what of the viewer's headers,
+     * cookies and query strings travels, so the policies are read per request
+     * rather than when the Origin was built.
+     *
      * An Origin domain naming nothing in the simulation fails here rather than
      * being sent to the real domain, because a simulated Distribution reaching
      * out to the internet is never what a test meant.

package/dist/service/cloudfront/origin/custom/sim-cloudfront-custom-origin.js

@@ -1,4 +1,5 @@
 import { customOriginEdgeOrigin, customOriginEdgeParts, } from "./sim-cf-custom-origin-edge.js";
+import { simCfBehaviorForwardedToOrigin, } from "../../origin-request-policy/sim-cf-behavior-forwarded.js";
 import { simCfCustomOriginRequest } from "./sim-cf-custom-origin-request.js";
 import { SimCfCustomOriginSigner } from "./sim-cf-custom-origin-signer.js";
 /**
@@ -31,6 +32,7 @@ export class SimCloudFrontCustomOrigin {
     originId;
     dispatcher;
     signer;
+    policies;
     constructor(properties) {
         this.properties = properties;
         this.originId = properties.originId;
@@ -40,10 +42,15 @@ export class SimCloudFrontCustomOrigin {
         this.originAccessControl = properties.originAccessControl;
         this.signer = new SimCfCustomOriginSigner(properties.originAccessControl);
         this.customHeaders = properties.customHeaders ?? {};
+        this.policies = properties.policies;
     }
     /**
      * Fetch the request from the simulated service behind this Origin.
      *
+     * The Behavior the request resolved to decides what of the viewer's headers,
+     * cookies and query strings travels, so the policies are read per request
+     * rather than when the Origin was built.
+     *
      * An Origin domain naming nothing in the simulation fails here rather than
      * being sent to the real domain, because a simulated Distribution reaching
      * out to the internet is never what a test meant.
@@ -53,6 +60,7 @@ export class SimCloudFrontCustomOrigin {
             domainName: this.domainName,
             originPath: this.originPath,
             request: request.req,
+            forwarded: simCfBehaviorForwardedToOrigin(request.behavior, this.policies),
             customHeaders: this.customHeaders,
             signingHeaders: this.signer.forRequest(request),
         });

package/dist/service/cloudfront/origin-request-policy/sim-cf-behavior-forwarded.d.ts

@@ -0,0 +1,24 @@
+import type { SimCloudFrontBehavior } from "../behaviour/sim-cloud-front-behavior.js";
+import type { SimCloudFrontCachePolicyRegistry } from "../cache-policy/sim-cf-cache-policy-registry.js";
+import { SimCfForwardedToOrigin } from "./sim-cf-forwarded-to-origin.js";
+import type { SimCloudFrontOriginRequestPolicyRegistry } from "./sim-cf-origin-request-policy-registry.js";
+/**
+ * The two policy registries a Behavior's forwarding is read from.
+ *
+ * They are asked per request rather than when the Distribution was configured,
+ * so a policy a template replaced decides the next Origin request rather than
+ * the one it replaced.
+ */
+export interface SimCfBehaviorPolicyRegistries {
+    readonly cachePolicies: SimCloudFrontCachePolicyRegistry;
+    readonly originRequestPolicies: SimCloudFrontOriginRequestPolicyRegistry;
+}
+/**
+ * What one Behavior carries to its Origin, from the two policies it names.
+ *
+ * A Behavior naming a policy this simulation does not hold is read as naming
+ * none, which is the same reading the Distribution's cache takes. Without
+ * either registry there is nothing to read a policy from, and the Behavior
+ * carries the same nothing.
+ */
+export declare function simCfBehaviorForwardedToOrigin(behaviour: SimCloudFrontBehavior, registries?: SimCfBehaviorPolicyRegistries): SimCfForwardedToOrigin;

package/dist/service/cloudfront/origin-request-policy/sim-cf-behavior-forwarded.js

@@ -0,0 +1,21 @@
+import { SimCfForwardedToOrigin } from "./sim-cf-forwarded-to-origin.js";
+/**
+ * What one Behavior carries to its Origin, from the two policies it names.
+ *
+ * A Behavior naming a policy this simulation does not hold is read as naming
+ * none, which is the same reading the Distribution's cache takes. Without
+ * either registry there is nothing to read a policy from, and the Behavior
+ * carries the same nothing.
+ */
+export function simCfBehaviorForwardedToOrigin(behaviour, registries) {
+    const cachePolicy = behaviour.cachePolicyId === undefined
+        ? undefined
+        : registries?.cachePolicies.byId(behaviour.cachePolicyId);
+    const originRequestPolicy = behaviour.originRequestPolicyId === undefined
+        ? undefined
+        : registries?.originRequestPolicies.byId(behaviour.originRequestPolicyId);
+    return new SimCfForwardedToOrigin({
+        cacheKey: cachePolicy?.cacheKey,
+        forwarding: originRequestPolicy?.forwarding,
+    });
+}