@kensio/yulin 0.36.0 → 0.38.0

package/dist/service/s3/command/get-bucket-policy/get-bucket-policy.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-bucket-policy.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-bucket-policy/get-bucket-policy.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAK5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;GAEG;AACH,MAAM,OAAO,6BAA6B;IAIvB,OAAO,CAAoC;IAC3C,UAAU,CAA4B;IACtC,UAAU,CAAsB;IAEjD,YAAY,UAAmD;QAC7D,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAkC,EAClC,OAA8C;QAE9C,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAE3E,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAC/B,iCAAiC,UAAU,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;YAC7B,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/get-public-access-block/get-public-access-block.command.d.ts

@@ -0,0 +1,22 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3PublicAccessBlockSettings } from "../../bucket/public-access/sim-s3-public-access-block.js";
+/**
+ * Minimal structural sim S3 GetPublicAccessBlock command.
+ */
+export interface SimGetPublicAccessBlockCommand {
+    readonly input: SimGetPublicAccessBlockCommandInput;
+}
+/**
+ * Minimal structural sim S3 GetPublicAccessBlock input.
+ */
+export interface SimGetPublicAccessBlockCommandInput {
+    readonly Bucket?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 GetPublicAccessBlock output.
+ */
+export interface SimGetPublicAccessBlockCommandOutput {
+    readonly PublicAccessBlockConfiguration: SimS3PublicAccessBlockSettings;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=get-public-access-block.command.d.ts.map

package/dist/service/s3/command/get-public-access-block/get-public-access-block.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-public-access-block.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-public-access-block/get-public-access-block.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0DAA0D,CAAC;AAE/G;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,8BAA8B,EAAE,8BAA8B,CAAC;IACxE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/s3/command/get-public-access-block/get-public-access-block.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=get-public-access-block.command.js.map

package/dist/service/s3/command/get-public-access-block/get-public-access-block.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-public-access-block.command.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-public-access-block/get-public-access-block.command.ts"],"names":[],"mappings":""}

package/dist/service/s3/command/get-public-access-block/get-public-access-block.handler.d.ts

@@ -0,0 +1,32 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimGetPublicAccessBlockCommand, SimGetPublicAccessBlockCommandOutput } from "./get-public-access-block.command.js";
+interface GetPublicAccessBlockCommandHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+interface GetPublicAccessBlockCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Simulated S3 GetPublicAccessBlockCommand handler.
+ */
+export declare class GetPublicAccessBlockCommandHandler implements CommandHandler<SimGetPublicAccessBlockCommand, SimGetPublicAccessBlockCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: GetPublicAccessBlockCommandHandlerProperties);
+    /**
+     * Authorize and return a Bucket's Block Public Access settings.
+     *
+     * Every simulated Bucket has settings, so unlike the Bucket policy there is
+     * no missing-configuration case to report.
+     */
+    handle(command: SimGetPublicAccessBlockCommand, options?: GetPublicAccessBlockCommandHandlerOptions): Promise<SimGetPublicAccessBlockCommandOutput>;
+}
+export {};
+//# sourceMappingURL=get-public-access-block.handler.d.ts.map

package/dist/service/s3/command/get-public-access-block/get-public-access-block.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-public-access-block.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-public-access-block/get-public-access-block.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,EACrC,MAAM,sCAAsC,CAAC;AAE9C,UAAU,4CAA4C;IACpD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,kCAAmC,YAAW,cAAc,CACvE,8BAA8B,EAC9B,oCAAoC,CACrC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,4CAA4C,EAUnE;IAED;;;;;OAKG;IACG,MAAM,CACV,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,yCAAyC,GAClD,OAAO,CAAC,oCAAoC,CAAC,CAmB/C;CACF"}

package/dist/service/s3/command/get-public-access-block/get-public-access-block.handler.js

@@ -0,0 +1,39 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3PublicAccessBlockAuthorizer } from "../public-access-block/sim-s3-public-access-block-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 GetPublicAccessBlockCommand handler.
+ */
+export class GetPublicAccessBlockCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3PublicAccessBlockAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and return a Bucket's Block Public Access settings.
+     *
+     * Every simulated Bucket has settings, so unlike the Bucket policy there is
+     * no missing-configuration case to report.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "GetPublicAccessBlockCommand.input.Bucket");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeRead(bucket, options?.caller);
+        return {
+            PublicAccessBlockConfiguration: bucket
+                .getPublicAccessBlock()
+                .toConfiguration(),
+            $metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=get-public-access-block.handler.js.map

package/dist/service/s3/command/get-public-access-block/get-public-access-block.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-public-access-block.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/get-public-access-block/get-public-access-block.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAK5F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAgBjE;;GAEG;AACH,MAAM,OAAO,kCAAkC;IAI5B,OAAO,CAAoC;IAC3C,UAAU,CAAmC;IAC7C,UAAU,CAAsB;IAEjD,YAAY,UAAwD;QAClE,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACV,OAAuC,EACvC,OAAmD;QAEnD,aAAa,CACX,OAAO,CAAC,KAAK,CAAC,MAAM,EACpB,0CAA0C,CAC3C,CAAC;QAEF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvD,OAAO;YACL,8BAA8B,EAAE,MAAM;iBACnC,oBAAoB,EAAE;iBACtB,eAAe,EAAE;YACpB,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+interface SimS3PublicAccessBlockAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to the S3 Block Public Access commands.
+ *
+ * Reading the configuration is governed by s3:GetBucketPublicAccessBlock.
+ * Both writing and removing it are governed by s3:PutBucketPublicAccessBlock:
+ * real S3 has no separate delete permission, so removing the configuration
+ * needs exactly what setting it needs.
+ */
+export declare class SimS3PublicAccessBlockAuthorizer {
+    private static readonly readAction;
+    private static readonly writeAction;
+    private readonly iam;
+    constructor(properties: SimS3PublicAccessBlockAuthorizerProperties);
+    /**
+     * Ensure the caller may read the Bucket's Block Public Access settings.
+     */
+    authorizeRead(bucket: SimS3Bucket, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may replace or remove the Block Public Access settings.
+     */
+    authorizeWrite(bucket: SimS3Bucket, caller?: SimAwsCaller): void;
+    private authorize;
+}
+export {};
+//# sourceMappingURL=sim-s3-public-access-block-authorizer.d.ts.map

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-access-block-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,UAAU,0CAA0C;IAClD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAmC;IACrE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAmC;IAEtE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,0CAA0C,EAEjE;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAE9D;IAED;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAM/D;IAED,OAAO,CAAC,SAAS;CAqBlB"}

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.js

@@ -0,0 +1,48 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+import { simS3BucketResourcePolicies } from "../authorize/sim-s3-bucket-resource-policies.js";
+/**
+ * Applies IAM authorization to the S3 Block Public Access commands.
+ *
+ * Reading the configuration is governed by s3:GetBucketPublicAccessBlock.
+ * Both writing and removing it are governed by s3:PutBucketPublicAccessBlock:
+ * real S3 has no separate delete permission, so removing the configuration
+ * needs exactly what setting it needs.
+ */
+export class SimS3PublicAccessBlockAuthorizer {
+    static readAction = "s3:GetBucketPublicAccessBlock";
+    static writeAction = "s3:PutBucketPublicAccessBlock";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may read the Bucket's Block Public Access settings.
+     */
+    authorizeRead(bucket, caller) {
+        this.authorize(SimS3PublicAccessBlockAuthorizer.readAction, bucket, caller);
+    }
+    /**
+     * Ensure the caller may replace or remove the Block Public Access settings.
+     */
+    authorizeWrite(bucket, caller) {
+        this.authorize(SimS3PublicAccessBlockAuthorizer.writeAction, bucket, caller);
+    }
+    authorize(action, bucket, caller) {
+        const resource = simS3BucketArn(bucket.bucketName);
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller,
+            resourcePolicies: simS3BucketResourcePolicies(bucket),
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-s3-public-access-block-authorizer.js.map

package/dist/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-access-block-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/public-access-block/sim-s3-public-access-block-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAM9F;;;;;;;GAOG;AACH,MAAM,OAAO,gCAAgC;IACnC,MAAM,CAAU,UAAU,GAAG,+BAA+B,CAAC;IAC7D,MAAM,CAAU,WAAW,GAAG,+BAA+B,CAAC;IAErD,GAAG,CAA0B;IAE9C,YAAY,UAAsD;QAChE,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAmB,EAAE,MAAqB;QACtD,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAmB,EAAE,MAAqB;QACvD,IAAI,CAAC,SAAS,CACZ,gCAAgC,CAAC,WAAW,EAC5C,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,MAAc,EACd,MAAmB,EACnB,MAAqB;QAErB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM;YACN,QAAQ;YACR,MAAM;YACN,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.d.ts

@@ -20,6 +20,7 @@ export declare class PutBucketPolicyCommandHandler implements CommandHandler<Sim
     private readonly authorizer;
     private readonly background;
     private readonly policyValidator;
+    private readonly publicPolicyGuard;
     constructor(properties: PutBucketPolicyCommandHandlerProperties);
     /**
      * Validate, authorize, and replace a Bucket's resource policy.

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"put-bucket-policy.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,gCAAgC,CAAC;AAExC,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,6BAA8B,YAAW,cAAc,CAClE,yBAAyB,EACzB,+BAA+B,CAChC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;IAEhE,YAAY,UAAU,EAAE,uCAAuC,EAW9D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,OAAO,CAAC,+BAA+B,CAAC,CAoB1C;CACF"}
+{"version":3,"file":"put-bucket-policy.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,gCAAgC,CAAC;AAExC,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,6BAA8B,YAAW,cAAc,CAClE,yBAAyB,EACzB,+BAA+B,CAChC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;IAChE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgC;IAElE,YAAY,UAAU,EAAE,uCAAuC,EAW9D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,oCAAoC,GAC7C,OAAO,CAAC,+BAA+B,CAAC,CAqB1C;CACF"}

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.js

@@ -3,7 +3,8 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { jsonParse } from "../../../../util/type-guard/json.js";
 import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimIamPolicyDocumentValidator } from "../../../iam/validate/sim-iam-policy-document-validator.js";
-import { SimS3NoSuchBucket } from "../../error/sim-s3.error.js";
+import { SimS3PublicPolicyGuard } from "../../bucket/public-access/sim-s3-public-policy-guard.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
 import { PutBucketPolicyAuthorizer } from "./put-bucket-policy-authorizer.js";
 /**
  * Simulated S3 PutBucketPolicyCommand handler.
@@ -13,6 +14,7 @@ export class PutBucketPolicyCommandHandler {
     authorizer;
     background;
     policyValidator;
+    publicPolicyGuard = new SimS3PublicPolicyGuard();
     constructor(properties) {
         const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
         this.buckets = buckets;
@@ -28,13 +30,12 @@ export class PutBucketPolicyCommandHandler {
         assertDefined(command.input.Policy, "PutBucketPolicyCommand.input.Policy");
         this.policyValidator.validateRequired(command.input.Policy);
         const bucketName = command.input.Bucket;
-        const bucket = this.buckets.get(bucketName);
-        if (bucket === undefined) {
-            throw new SimS3NoSuchBucket(`No S3 Bucket named ${bucketName}`);
-        }
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
         await this.background.sequence();
         this.authorizer.authorize(bucketName, options?.caller);
-        bucket.configurePolicy(jsonParse(command.input.Policy));
+        const document = jsonParse(command.input.Policy);
+        this.publicPolicyGuard.guard(bucket, document);
+        bucket.configurePolicy(document);
         return {
             $metadata: {},
         };

package/dist/service/s3/command/put-bucket-policy/put-bucket-policy.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"put-bucket-policy.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;GAEG;AACH,MAAM,OAAO,6BAA6B;IAIvB,OAAO,CAAoC;IAC3C,UAAU,CAA4B;IACtC,UAAU,CAAsB;IAChC,eAAe,CAAgC;IAEhE,YAAY,UAAmD;QAC7D,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAkC,EAClC,OAA8C;QAE9C,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAC3E,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE5D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"put-bucket-policy.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-bucket-policy/put-bucket-policy.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAK3G,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAgB9E;;GAEG;AACH,MAAM,OAAO,6BAA6B;IAIvB,OAAO,CAAoC;IAC3C,UAAU,CAA4B;IACtC,UAAU,CAAsB;IAChC,eAAe,CAAgC;IAC/C,iBAAiB,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAElE,YAAY,UAAmD;QAC7D,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAkC,EAClC,OAA8C;QAE9C,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAC3E,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE5D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE/C,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEjC,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/put-public-access-block/put-public-access-block.command.d.ts

@@ -0,0 +1,22 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3PublicAccessBlockConfiguration } from "../../bucket/public-access/sim-s3-public-access-block.js";
+/**
+ * Minimal structural sim S3 PutPublicAccessBlock command.
+ */
+export interface SimPutPublicAccessBlockCommand {
+    readonly input: SimPutPublicAccessBlockCommandInput;
+}
+/**
+ * Minimal structural sim S3 PutPublicAccessBlock input.
+ */
+export interface SimPutPublicAccessBlockCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly PublicAccessBlockConfiguration?: SimS3PublicAccessBlockConfiguration | undefined;
+}
+/**
+ * Minimal structural sim S3 PutPublicAccessBlock output.
+ */
+export interface SimPutPublicAccessBlockCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=put-public-access-block.command.d.ts.map

package/dist/service/s3/command/put-public-access-block/put-public-access-block.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-public-access-block.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-public-access-block/put-public-access-block.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,0DAA0D,CAAC;AAEpH;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,8BAA8B,CAAC,EACtC,mCAAmC,GAAG,SAAS,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/s3/command/put-public-access-block/put-public-access-block.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=put-public-access-block.command.js.map

package/dist/service/s3/command/put-public-access-block/put-public-access-block.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-public-access-block.command.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-public-access-block/put-public-access-block.command.ts"],"names":[],"mappings":""}

package/dist/service/s3/command/put-public-access-block/put-public-access-block.handler.d.ts

@@ -0,0 +1,33 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimPutPublicAccessBlockCommand, SimPutPublicAccessBlockCommandOutput } from "./put-public-access-block.command.js";
+interface PutPublicAccessBlockCommandHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+interface PutPublicAccessBlockCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Simulated S3 PutPublicAccessBlockCommand handler.
+ */
+export declare class PutPublicAccessBlockCommandHandler implements CommandHandler<SimPutPublicAccessBlockCommand, SimPutPublicAccessBlockCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: PutPublicAccessBlockCommandHandlerProperties);
+    /**
+     * Authorize and replace a Bucket's Block Public Access settings.
+     *
+     * The supplied configuration replaces the previous one wholesale, so a
+     * setting it leaves out is turned off rather than kept from whatever the
+     * Bucket had before.
+     */
+    handle(command: SimPutPublicAccessBlockCommand, options?: PutPublicAccessBlockCommandHandlerOptions): Promise<SimPutPublicAccessBlockCommandOutput>;
+}
+export {};
+//# sourceMappingURL=put-public-access-block.handler.d.ts.map

package/dist/service/s3/command/put-public-access-block/put-public-access-block.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-public-access-block.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-public-access-block/put-public-access-block.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,EACrC,MAAM,sCAAsC,CAAC;AAE9C,UAAU,4CAA4C;IACpD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,kCAAmC,YAAW,cAAc,CACvE,8BAA8B,EAC9B,oCAAoC,CACrC;IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,4CAA4C,EAUnE;IAED;;;;;;OAMG;IACG,MAAM,CACV,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,yCAAyC,GAClD,OAAO,CAAC,oCAAoC,CAAC,CA0B/C;CACF"}

package/dist/service/s3/command/put-public-access-block/put-public-access-block.handler.js

@@ -0,0 +1,40 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3PublicAccessBlock } from "../../bucket/public-access/sim-s3-public-access-block.js";
+import { SimS3PublicAccessBlockAuthorizer } from "../public-access-block/sim-s3-public-access-block-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 PutPublicAccessBlockCommand handler.
+ */
+export class PutPublicAccessBlockCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3PublicAccessBlockAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and replace a Bucket's Block Public Access settings.
+     *
+     * The supplied configuration replaces the previous one wholesale, so a
+     * setting it leaves out is turned off rather than kept from whatever the
+     * Bucket had before.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "PutPublicAccessBlockCommand.input.Bucket");
+        assertDefined(command.input.PublicAccessBlockConfiguration, "PutPublicAccessBlockCommand.input.PublicAccessBlockConfiguration");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeWrite(bucket, options?.caller);
+        bucket.configurePublicAccessBlock(SimS3PublicAccessBlock.fromConfiguration(command.input.PublicAccessBlockConfiguration));
+        return {
+            $metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=put-public-access-block.handler.js.map

package/dist/service/s3/command/put-public-access-block/put-public-access-block.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-public-access-block.handler.js","sourceRoot":"","sources":["../../../../../src/service/s3/command/put-public-access-block/put-public-access-block.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAKlG,OAAO,EAAE,gCAAgC,EAAE,MAAM,iEAAiE,CAAC;AACnH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAgBjE;;GAEG;AACH,MAAM,OAAO,kCAAkC;IAI5B,OAAO,CAAoC;IAC3C,UAAU,CAAmC;IAC7C,UAAU,CAAsB;IAEjD,YAAY,UAAwD;QAClE,MAAM,EACJ,OAAO,EACP,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,OAAuC,EACvC,OAAmD;QAEnD,aAAa,CACX,OAAO,CAAC,KAAK,CAAC,MAAM,EACpB,0CAA0C,CAC3C,CAAC;QACF,aAAa,CACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAC5C,kEAAkE,CACnE,CAAC;QAEF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAyB,CAAC;QAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAExD,MAAM,CAAC,0BAA0B,CAC/B,sBAAsB,CAAC,iBAAiB,CACtC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAC7C,CACF,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/command/require-sim-s3-bucket.d.ts

@@ -0,0 +1,10 @@
+import type { SimS3Bucket, SimS3BucketName } from "../bucket/sim-s3-bucket.js";
+/**
+ * Get a Bucket from the scope's Bucket state, or raise S3's missing-Bucket
+ * error.
+ *
+ * Every Bucket-scoped command starts this way, and real S3 answers NoSuchBucket
+ * before it considers anything else about the request.
+ */
+export declare function requireSimS3Bucket(buckets: Map<SimS3BucketName, SimS3Bucket>, bucketName: SimS3BucketName): SimS3Bucket;
+//# sourceMappingURL=require-sim-s3-bucket.d.ts.map

package/dist/service/s3/command/require-sim-s3-bucket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-sim-s3-bucket.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/command/require-sim-s3-bucket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAG/E;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,EAC1C,UAAU,EAAE,eAAe,GAC1B,WAAW,CAQb"}

package/dist/service/s3/command/require-sim-s3-bucket.js

@@ -0,0 +1,16 @@
+import { SimS3NoSuchBucket } from "../error/sim-s3.error.js";
+/**
+ * Get a Bucket from the scope's Bucket state, or raise S3's missing-Bucket
+ * error.
+ *
+ * Every Bucket-scoped command starts this way, and real S3 answers NoSuchBucket
+ * before it considers anything else about the request.
+ */
+export function requireSimS3Bucket(buckets, bucketName) {
+    const bucket = buckets.get(bucketName);
+    if (bucket === undefined) {
+        throw new SimS3NoSuchBucket(`No S3 Bucket named ${bucketName}`);
+    }
+    return bucket;
+}
+//# sourceMappingURL=require-sim-s3-bucket.js.map

package/dist/service/s3/command/require-sim-s3-bucket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-sim-s3-bucket.js","sourceRoot":"","sources":["../../../../src/service/s3/command/require-sim-s3-bucket.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA0C,EAC1C,UAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/service/s3/command/sim-s3-command-handlers.d.ts

@@ -0,0 +1,91 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../bucket/sim-s3-bucket.js";
+import type { SimS3GlobalRegistry } from "../sim-s3-global-registry.js";
+import type { SimS3RequestOptions } from "../sim-s3.js";
+import type { SimCreateBucketCommand, SimCreateBucketCommandOutput } from "./create-bucket/create-bucket.command.js";
+import type { SimDeleteBucketPolicyCommand, SimDeleteBucketPolicyCommandOutput } from "./delete-bucket-policy/delete-bucket-policy.command.js";
+import type { SimGetBucketPolicyCommand, SimGetBucketPolicyCommandOutput } from "./get-bucket-policy/get-bucket-policy.command.js";
+import type { SimGetObjectCommand, SimGetObjectCommandOutput } from "./get-object/get-object.command.js";
+import type { SimListBucketsCommand, SimListBucketsCommandOutput } from "./list-buckets/list-buckets.command.js";
+import type { SimListObjectsCommand, SimListObjectsCommandOutput } from "./list-objects/list-objects.command.js";
+import type { SimPutBucketPolicyCommand, SimPutBucketPolicyCommandOutput } from "./put-bucket-policy/put-bucket-policy.command.js";
+import type { SimPutBucketWebsiteCommand, SimPutBucketWebsiteCommandOutput } from "./put-bucket-website/put-bucket-website.command.js";
+import type { SimPutPublicAccessBlockCommand, SimPutPublicAccessBlockCommandOutput } from "./put-public-access-block/put-public-access-block.command.js";
+import type { SimGetPublicAccessBlockCommand, SimGetPublicAccessBlockCommandOutput } from "./get-public-access-block/get-public-access-block.command.js";
+import type { SimDeletePublicAccessBlockCommand, SimDeletePublicAccessBlockCommandOutput } from "./delete-public-access-block/delete-public-access-block.command.js";
+import type { SimPutObjectCommand, SimPutObjectCommandOutput } from "./put-object/put-object.command.js";
+interface SimS3CommandHandlersProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly s3GlobalRegistry: SimS3GlobalRegistry;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * The command handlers of one simulated S3 account/Region scope.
+ *
+ * Every handler authorizes against the same IAM and mutates the same Bucket
+ * state, so the wiring lives here rather than being repeated once per command
+ * in the service facade. That keeps SimS3 what it should be: state plus
+ * delegation.
+ */
+export declare class SimS3CommandHandlers {
+    private readonly properties;
+    constructor(properties: SimS3CommandHandlersProperties);
+    /**
+     * Create a Bucket in this scope and register it globally.
+     */
+    createBucket(command: SimCreateBucketCommand, options?: SimS3RequestOptions): Promise<SimCreateBucketCommandOutput>;
+    /**
+     * Replace a Bucket's resource policy.
+     */
+    putBucketPolicy(command: SimPutBucketPolicyCommand, options?: SimS3RequestOptions): Promise<SimPutBucketPolicyCommandOutput>;
+    /**
+     * Read a Bucket's resource policy.
+     */
+    getBucketPolicy(command: SimGetBucketPolicyCommand, options?: SimS3RequestOptions): Promise<SimGetBucketPolicyCommandOutput>;
+    /**
+     * Remove a Bucket's resource policy.
+     */
+    deleteBucketPolicy(command: SimDeleteBucketPolicyCommand, options?: SimS3RequestOptions): Promise<SimDeleteBucketPolicyCommandOutput>;
+    /**
+     * Replace a Bucket's Block Public Access settings.
+     */
+    putPublicAccessBlock(command: SimPutPublicAccessBlockCommand, options?: SimS3RequestOptions): Promise<SimPutPublicAccessBlockCommandOutput>;
+    /**
+     * Read a Bucket's Block Public Access settings.
+     */
+    getPublicAccessBlock(command: SimGetPublicAccessBlockCommand, options?: SimS3RequestOptions): Promise<SimGetPublicAccessBlockCommandOutput>;
+    /**
+     * Remove a Bucket's Block Public Access settings.
+     */
+    deletePublicAccessBlock(command: SimDeletePublicAccessBlockCommand, options?: SimS3RequestOptions): Promise<SimDeletePublicAccessBlockCommandOutput>;
+    /**
+     * Configure static website hosting on a Bucket.
+     */
+    putBucketWebsite(command: SimPutBucketWebsiteCommand, options?: SimS3RequestOptions): Promise<SimPutBucketWebsiteCommandOutput>;
+    /**
+     * List the Buckets this scope owns.
+     */
+    listBuckets(command: SimListBucketsCommand, options?: SimS3RequestOptions): Promise<SimListBucketsCommandOutput>;
+    /**
+     * Store an Object in a Bucket.
+     */
+    putObject(command: SimPutObjectCommand, options?: SimS3RequestOptions): Promise<SimPutObjectCommandOutput>;
+    /**
+     * Read an Object from a Bucket.
+     */
+    getObject(command: SimGetObjectCommand, options?: SimS3RequestOptions): Promise<SimGetObjectCommandOutput>;
+    /**
+     * List the Objects in a Bucket.
+     */
+    listObjects(command: SimListObjectsCommand, options?: SimS3RequestOptions): Promise<SimListObjectsCommandOutput>;
+    /**
+     * The state and collaborators every Bucket-scoped handler is built with.
+     */
+    private bucketState;
+}
+export {};
+//# sourceMappingURL=sim-s3-command-handlers.d.ts.map

package/dist/service/s3/command/sim-s3-command-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-command-handlers.d.ts","sourceRoot":"","sources":["../../../../src/service/s3/command/sim-s3-command-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC7B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,kDAAkD,CAAC;AAE1D,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,kDAAkD,CAAC;AAE1D,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,EACrC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,EACrC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,KAAK,EACV,iCAAiC,EACjC,uCAAuC,EACxC,MAAM,oEAAoE,CAAC;AAC5E,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,oCAAoC,CAAC;AAE5C,UAAU,8BAA8B;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;IAC/C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAE5D,YAAY,UAAU,EAAE,8BAA8B,EAErD;IAED;;OAEG;IACG,YAAY,CAChB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,4BAA4B,CAAC,CAQvC;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,+BAA+B,CAAC,CAK1C;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,+BAA+B,CAAC,CAK1C;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kCAAkC,CAAC,CAI7C;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,oCAAoC,CAAC,CAI/C;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,oCAAoC,CAAC,CAI/C;IAED;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,iCAAiC,EAC1C,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,uCAAuC,CAAC,CAIlD;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,gCAAgC,CAAC,CAK3C;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,2BAA2B,CAAC,CAKtC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,yBAAyB,CAAC,CAKpC;IAED;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,yBAAyB,CAAC,CAKpC;IAED;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,2BAA2B,CAAC,CAKtC;IAED;;OAEG;IACH,OAAO,CAAC,WAAW;CAWpB"}