@kensio/yulin 0.37.0 → 0.39.0

package/dist/service/lambda/function/invoke/sim-lambda-process-clock.js

@@ -0,0 +1,101 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { makeSimClockDate } from "../../../../util/clock/sim-clock-date.js";
+/**
+ * The clock the substitute Date reads.
+ *
+ * An invocation in progress lends its own clock; anything else in the process
+ * carries on reading the host clock, which is what keeps the substitute inert
+ * outside a sim Lambda invocation.
+ */
+class SimLambdaAmbientClock {
+    storage;
+    hostDate;
+    constructor(storage, hostDate) {
+        this.storage = storage;
+        this.hostDate = hostDate;
+    }
+    /**
+     * Get the time the code running right now should see.
+     */
+    now() {
+        const invocationClock = this.storage.getStore();
+        if (invocationClock === undefined) {
+            return new this.hostDate();
+        }
+        // Read outside the store, because a simulation's clock is itself often
+        // built on `new Date()`. Left inside it, that read would come straight
+        // back here and never terminate.
+        return this.storage.exit(() => invocationClock.now());
+    }
+}
+/**
+ * The time a sim Lambda handler function sees while it runs.
+ *
+ * A handler backed by a real in-process function is a closure over its own
+ * module scope, so it reads the global Date like any other code in the test
+ * run. Zip code has a vm sandbox with a Date of its own and needs none of
+ * this. Node.js asynchronous context tracking bridges the gap for the
+ * in-process case, exactly as it does for process.env: the invocation's clock
+ * is held in an AsyncLocalStorage store, and Date resolves to it while it is
+ * set.
+ *
+ * The store follows the invocation across await points, so concurrent
+ * invocations of functions belonging to different simulations each read their
+ * own time.
+ *
+ * What this cannot reach is a time already read. A handler module doing
+ * `const startedAt = Date.now()` at module scope is evaluated when the test
+ * file imports it, long before any invocation.
+ */
+class SimLambdaProcessClock {
+    storage = new AsyncLocalStorage();
+    hostDate = Date;
+    installed = false;
+    /**
+     * Run an invocation with the given clock as its sense of the current time.
+     */
+    async run(clock, run) {
+        this.install();
+        return await this.storage.run(clock, run);
+    }
+    /**
+     * The host Date constructor, ignoring any invocation in progress.
+     */
+    hostDateConstructor() {
+        return this.hostDate;
+    }
+    /**
+     * Replace the global Date with one backed by the invocation store.
+     *
+     * Installed on the first invocation of an in-process handler rather than at
+     * import, so a test run that never uses one is left completely alone. Date
+     * is a far busier global than process.env, and a substitute that is only
+     * ever built when something actually needs it is easier to reason about.
+     *
+     * With no invocation running the substitute reports the host time, so an
+     * installed patch behaves exactly like no patch at all. It is never removed:
+     * removing it would be unsafe while another invocation is in flight, and
+     * there is nothing to gain.
+     */
+    install() {
+        if (this.installed) {
+            return;
+        }
+        this.hostDate = Date;
+        // Defined rather than assigned, to keep Date the configurable, writable,
+        // non-enumerable global property it already was: anything else replacing
+        // it, a test framework's fake timers included, has to find what it
+        // expects.
+        Object.defineProperty(globalThis, "Date", {
+            configurable: true,
+            writable: true,
+            value: makeSimClockDate(new SimLambdaAmbientClock(this.storage, this.hostDate)),
+        });
+        this.installed = true;
+    }
+}
+/**
+ * Shared because it patches a process global: one patch, one store.
+ */
+export const simLambdaProcessClock = new SimLambdaProcessClock();
+//# sourceMappingURL=sim-lambda-process-clock.js.map

package/dist/service/lambda/function/invoke/sim-lambda-process-clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-process-clock.js","sourceRoot":"","sources":["../../../../../src/service/lambda/function/invoke/sim-lambda-process-clock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,qBAAqB;IAEN,OAAO;IACP,QAAQ;IAF3B,YACmB,OAAoC,EACpC,QAAyB;uBADzB,OAAO;wBACP,QAAQ;IACxB,CAAC;IAEJ;;OAEG;IACH,GAAG;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEhD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,iCAAiC;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,qBAAqB;IACR,OAAO,GAAG,IAAI,iBAAiB,EAAY,CAAC;IACrD,QAAQ,GAAoB,IAAI,CAAC;IACjC,SAAS,GAAG,KAAK,CAAC;IAE1B;;OAEG;IACH,KAAK,CAAC,GAAG,CAAI,KAAe,EAAE,GAAqB;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,OAAO;QACb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,yEAAyE;QACzE,yEAAyE;QACzE,mEAAmE;QACnE,WAAW;QACX,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE;YACxC,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,gBAAgB,CACrB,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CACvD;SACF,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAC"}

package/dist/service/lambda/function/sim-lambda-function.d.ts

@@ -121,6 +121,14 @@ export declare class SimLambdaFunction {
      * Runtime.* cold-start error.
      */
     invoke(event: unknown): Promise<unknown>;
+    /**
+     * Run an invocation with this simulation's time as the current time.
+     *
+     * Only code running in the host scope needs this. Zip code reads the Date
+     * its own vm sandbox was given, so a function backed by one leaves the
+     * global Date alone entirely.
+     */
+    private runWithSimulatedTime;
 }
 export {};
 //# sourceMappingURL=sim-lambda-function.d.ts.map

package/dist/service/lambda/function/sim-lambda-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-function.d.ts","sourceRoot":"","sources":["../../../../src/service/lambda/function/sim-lambda-function.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAGnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAE3E,eAAO,MAAM,kCAAkC,IAAI,CAAC;AACpD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,MAAM,MAAM,oBAAoB,GAAG,GAAG,CACpC,qBAAqB,EACrB,iBAAiB,CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAChC,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE/C;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC9B,kBAAkB,MAAM,IAAI,MAAM,aAAa,MAAM,EAAE,CAAC;AAE1D;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,wBAAwB,EAC/B,IAAI,EAAE,MAAM,GACX,oBAAoB,CAEtB;AAED;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,oBAAoB,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CACjE;AAED,UAAU,2BAA2B;IACnC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,IAAI,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3C,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC/C,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;;IAC5B,SAAgB,IAAI,EAAE,qBAAqB,CAAC;IAC5C,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,kBAAkB,EAAE,wBAAwB,CAAC;IAC7D,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,WAAW,EAAE,oBAAoB,CAAC;IAClD;;;;;;;OAOG;IACH,SAAgB,cAAc,0BAAiC;IAG/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0B;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,2BAA2B,EAoClD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,sBAAsB,CAElC;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,oBAAoB,CAE9B;IAED;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxB;IAED;;OAEG;IACH,aAAa,IAAI,8BAA8B,CAc9C;IAED;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB7C;CACF"}
+{"version":3,"file":"sim-lambda-function.d.ts","sourceRoot":"","sources":["../../../../src/service/lambda/function/sim-lambda-function.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAGnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAIjF,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAE3E,eAAO,MAAM,kCAAkC,IAAI,CAAC;AACpD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,MAAM,MAAM,oBAAoB,GAAG,GAAG,CACpC,qBAAqB,EACrB,iBAAiB,CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAChC,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE/C;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC9B,kBAAkB,MAAM,IAAI,MAAM,aAAa,MAAM,EAAE,CAAC;AAE1D;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,wBAAwB,EAC/B,IAAI,EAAE,MAAM,GACX,oBAAoB,CAEtB;AAED;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,oBAAoB,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CACjE;AAED,UAAU,2BAA2B;IACnC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,IAAI,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3C,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC/C,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;;IAC5B,SAAgB,IAAI,EAAE,qBAAqB,CAAC;IAC5C,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,kBAAkB,EAAE,wBAAwB,CAAC;IAC7D,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,WAAW,EAAE,oBAAoB,CAAC;IAClD;;;;;;;OAOG;IACH,SAAgB,cAAc,0BAAiC;IAG/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0B;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,2BAA2B,EAoClD;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,sBAAsB,CAElC;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,oBAAoB,CAE9B;IAED;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxB;IAED;;OAEG;IACH,aAAa,IAAI,8BAA8B,CAc9C;IAED;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAyB7C;IAED;;;;;;OAMG;YACW,oBAAoB;CAOnC"}

package/dist/service/lambda/function/sim-lambda-function.js

@@ -5,6 +5,7 @@ import { SimLambdaEnvironment } from "./environment/sim-lambda-environment.js";
 import { SimLambdaFunctionPolicy } from "./policy/sim-lambda-function-policy.js";
 import { SimLambdaHandlerRunner } from "./invoke/sim-lambda-handler-runner.js";
 import { SimLambdaInvokeContextBuilder } from "./invoke/sim-lambda-invoke-context-builder.js";
+import { simLambdaProcessClock } from "./invoke/sim-lambda-process-clock.js";
 import { SimRealClock } from "../../../util/clock/sim-clock.js";
 import { defaultLambdaHandler, } from "./sim-lambda-handler.type.js";
 export const DEFAULT_SIM_LAMBDA_TIMEOUT_SECONDS = 3;
@@ -126,7 +127,20 @@ export class SimLambdaFunction {
             memorySizeMb: this.memorySizeMb,
             clock: this.clock,
         });
-        return await simAwsRunAsContext.run(this.runAsOwner, { kind: "arn", arn: this.roleArn }, async () => await this.environment.runWith(async () => await this.runner.run(this.code.handlerFunction(), event, contextBuilder)));
+        return await simAwsRunAsContext.run(this.runAsOwner, { kind: "arn", arn: this.roleArn }, async () => await this.environment.runWith(async () => await this.runWithSimulatedTime(async () => await this.runner.run(this.code.handlerFunction(), event, contextBuilder))));
+    }
+    /**
+     * Run an invocation with this simulation's time as the current time.
+     *
+     * Only code running in the host scope needs this. Zip code reads the Date
+     * its own vm sandbox was given, so a function backed by one leaves the
+     * global Date alone entirely.
+     */
+    async runWithSimulatedTime(run) {
+        if (!this.code.runsInHostScope) {
+            return await run();
+        }
+        return await simLambdaProcessClock.run(this.clock, run);
     }
 }
 //# sourceMappingURL=sim-lambda-function.js.map

package/dist/service/lambda/function/sim-lambda-function.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-function.js","sourceRoot":"","sources":["../../../../src/service/lambda/function/sim-lambda-function.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AAEpG,OAAO,EAEL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAiB,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AAItC,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AACpD,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAgBrD;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA+B,EAC/B,IAAY;IAEZ,OAAO,kBAAkB,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,aAAa,IAAI,EAAE,CAAC;AAClF,CAAC;AA0CD;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACZ,IAAI,CAAwB;IAC5B,OAAO,CAAS;IAChB,kBAAkB,CAA2B;IAC7C,WAAW,CAAqB;IAChC,WAAW,CAAqB;IAChC,WAAW,CAAqB;IAChC,cAAc,CAAS;IACvB,YAAY,CAAS;IACrB,WAAW,CAAuB;IAClD;;;;;;;OAOG;IACa,cAAc,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE/D,MAAM,CAAyB;IACd,IAAI,CAA0B;IAC9B,UAAU,CAAmB;IAC7B,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACtC,KAAK,CAAW;IAEjC,YAAY,UAAuC;QACjD,MAAM,EACJ,IAAI,EACJ,OAAO,EACP,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,eAAe,GAAG,oBAAoB,EACtC,IAAI,EACJ,KAAK,GAAG,SAAS,EACjB,WAAW,EACX,WAAW,EACX,WAAW,EACX,cAAc,GAAG,kCAAkC,EACnD,YAAY,GAAG,iCAAiC,EAChD,WAAW,EACX,UAAU,GAAG,IAAI,EACjB,KAAK,GAAG,IAAI,YAAY,EAAE,GAC3B,GAAG,UAAU,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAA6B,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,6BAA6B,CAAC,eAAe,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,WAAW;YACd,WAAW;gBACX,IAAI,oBAAoB,CAAC;oBACvB,YAAY,EAAE,IAAI;oBAClB,UAAU,EAAE,kBAAkB,CAAC,UAAU;oBACzC,YAAY;iBACb,CAAC,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,IAAI,CAAC,cAAc;YAC5B,UAAU,EAAE,IAAI,CAAC,YAAY;YAC7B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,KAAc;QACzB,MAAM,cAAc,GAAG,IAAI,6BAA6B,CAAC;YACvD,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,kBAAkB,EAAE,IAAI,CAAC,GAAG;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,MAAM,kBAAkB,CAAC,GAAG,CACjC,IAAI,CAAC,UAAU,EACf,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,EAClC,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAC5B,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CACnB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAC3B,KAAK,EACL,cAAc,CACf,CACJ,CACJ,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-lambda-function.js","sourceRoot":"","sources":["../../../../src/service/lambda/function/sim-lambda-function.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AAEpG,OAAO,EAEL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAiB,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AAItC,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AACpD,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAgBrD;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA+B,EAC/B,IAAY;IAEZ,OAAO,kBAAkB,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,aAAa,IAAI,EAAE,CAAC;AAClF,CAAC;AA0CD;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACZ,IAAI,CAAwB;IAC5B,OAAO,CAAS;IAChB,kBAAkB,CAA2B;IAC7C,WAAW,CAAqB;IAChC,WAAW,CAAqB;IAChC,WAAW,CAAqB;IAChC,cAAc,CAAS;IACvB,YAAY,CAAS;IACrB,WAAW,CAAuB;IAClD;;;;;;;OAOG;IACa,cAAc,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE/D,MAAM,CAAyB;IACd,IAAI,CAA0B;IAC9B,UAAU,CAAmB;IAC7B,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACtC,KAAK,CAAW;IAEjC,YAAY,UAAuC;QACjD,MAAM,EACJ,IAAI,EACJ,OAAO,EACP,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,eAAe,GAAG,oBAAoB,EACtC,IAAI,EACJ,KAAK,GAAG,SAAS,EACjB,WAAW,EACX,WAAW,EACX,WAAW,EACX,cAAc,GAAG,kCAAkC,EACnD,YAAY,GAAG,iCAAiC,EAChD,WAAW,EACX,UAAU,GAAG,IAAI,EACjB,KAAK,GAAG,IAAI,YAAY,EAAE,GAC3B,GAAG,UAAU,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAA6B,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,6BAA6B,CAAC,eAAe,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,WAAW;YACd,WAAW;gBACX,IAAI,oBAAoB,CAAC;oBACvB,YAAY,EAAE,IAAI;oBAClB,UAAU,EAAE,kBAAkB,CAAC,UAAU;oBACzC,YAAY;iBACb,CAAC,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,IAAI,CAAC,cAAc;YAC5B,UAAU,EAAE,IAAI,CAAC,YAAY;YAC7B,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,KAAc;QACzB,MAAM,cAAc,GAAG,IAAI,6BAA6B,CAAC;YACvD,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,kBAAkB,EAAE,IAAI,CAAC,GAAG;YAC5B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,MAAM,kBAAkB,CAAC,GAAG,CACjC,IAAI,CAAC,UAAU,EACf,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,EAClC,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAC5B,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,oBAAoB,CAC7B,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CACnB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAC3B,KAAK,EACL,cAAc,CACf,CACJ,CACJ,CACJ,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,oBAAoB,CAAI,GAAqB;QACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,OAAO,MAAM,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,MAAM,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/service/lambda/serve/sim-lambda-url-router.js

@@ -19,7 +19,7 @@ export class SimLambdaUrlRouter {
     constructor(properties = {}) {
         this.simAws = properties.simAws ?? new SimAws();
         this.urlRegistry =
-            properties.urlRegistry ?? this.simAws.lambdaUrlRegistry();
+            properties.urlRegistry ?? this.simAws.serviceFactory.lambdaUrlRegistry;
     }
     /**
      * Find the Function URL and function a request target addresses.

package/dist/service/lambda/serve/sim-lambda-url-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-url-router.js","sourceRoot":"","sources":["../../../../src/service/lambda/serve/sim-lambda-url-router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAwB9C;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,WAAW,CAAuB;IAEnD,YAAY,UAAU,GAAiC,EAAE;QACvD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,WAAW;YACd,UAAU,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAsC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAElE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAExD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAE1E,wEAAwE;QACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IACxD,CAAC;CACF"}
+{"version":3,"file":"sim-lambda-url-router.js","sourceRoot":"","sources":["../../../../src/service/lambda/serve/sim-lambda-url-router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAwB9C;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,WAAW,CAAuB;IAEnD,YAAY,UAAU,GAAiC,EAAE;QACvD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,WAAW;YACd,UAAU,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAsC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAElE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAExD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAE1E,wEAAwE;QACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IACxD,CAAC;CACF"}

package/dist/service/route53/resolve/sim-r53-service-target-resolver.d.ts

@@ -40,6 +40,20 @@ export declare class SimRoute53ServiceTargetResolver {
      * labels are joined back together as the resource name.
      */
     private s3WebsiteServiceTarget;
+    /**
+     * Resolve S3 REST API endpoint hostnames.
+     *
+     * Simulated S3 REST hostnames use either of the two forms real S3 offers:
+     *
+     *   <bucket-name>.s3.<region>    virtual-hosted style
+     *   s3.<region>                  path style, naming the Bucket in the path
+     *
+     * Both are needed because the AWS SDK chooses between them for itself. A
+     * Bucket name containing dots cannot be a single host label, so the SDK falls
+     * back to path style for those, and a URL signed one way cannot be served the
+     * other.
+     */
+    private s3RestServiceTarget;
     /**
      * Resolve CloudFront distribution hostnames.
      *

package/dist/service/route53/resolve/sim-r53-service-target-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-r53-service-target-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/resolve/sim-r53-service-target-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAS/F;;;;;;;;;;;;GAYG;AACH,qBAAa,+BAA+B;IAC1C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAazD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IA8B9B;;;;;;;;;OASG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;CA0BvC"}
+{"version":3,"file":"sim-r53-service-target-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/resolve/sim-r53-service-target-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAU/F;;;;;;;;;;;;GAYG;AACH,qBAAa,+BAA+B;IAC1C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAczD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IA+B9B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;IA8B3B;;;;;;;;;OASG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;CA0BvC"}

package/dist/service/route53/resolve/sim-r53-service-target-resolver.js

@@ -2,6 +2,7 @@ import { lambdaFunctionUrlHostLabel } from "../../lambda/function/url/sim-lambda
 import { simRoute53LogicalName } from "../local-name/sim-route53-local-name.js";
 import { simRoute53DnsHostName } from "../serve/sim-route53-dns-host.js";
 const s3WebsiteServiceLabel = "s3-website";
+const s3RestServiceLabel = "s3";
 const cloudFrontServiceLabel = "cloudfront";
 /**
  * Maps Yulin-local service hostnames to simulated AWS service targets.
@@ -32,6 +33,7 @@ export class SimRoute53ServiceTargetResolver {
         }
         return (this.route53DnsServiceTarget(logicalName) ??
             this.s3WebsiteServiceTarget(logicalName) ??
+            this.s3RestServiceTarget(logicalName) ??
             this.cloudFrontServiceTarget(logicalName) ??
             this.lambdaFunctionUrlServiceTarget(logicalName));
     }
@@ -80,6 +82,42 @@ export class SimRoute53ServiceTargetResolver {
             service: "s3",
             resourceName,
             regionName,
+            endpoint: "website",
+        };
+    }
+    /**
+     * Resolve S3 REST API endpoint hostnames.
+     *
+     * Simulated S3 REST hostnames use either of the two forms real S3 offers:
+     *
+     *   <bucket-name>.s3.<region>    virtual-hosted style
+     *   s3.<region>                  path style, naming the Bucket in the path
+     *
+     * Both are needed because the AWS SDK chooses between them for itself. A
+     * Bucket name containing dots cannot be a single host label, so the SDK falls
+     * back to path style for those, and a URL signed one way cannot be served the
+     * other.
+     */
+    s3RestServiceTarget(logicalName) {
+        const labels = logicalName.split(".");
+        if (labels.length < 2) {
+            return undefined;
+        }
+        const service = labels.at(-2);
+        const regionName = labels.at(-1);
+        if (service !== s3RestServiceLabel || regionName === undefined) {
+            return undefined;
+        }
+        /* v8 ignore if -- empty labels are rejected before resolution */
+        if (regionName.length === 0) {
+            return undefined;
+        }
+        return {
+            service: "s3",
+            // Empty for path style, where the Bucket is the first path segment.
+            resourceName: labels.slice(0, -2).join("."),
+            regionName,
+            endpoint: "rest",
         };
     }
     /**

package/dist/service/route53/resolve/sim-r53-service-target-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-r53-service-target-resolver.js","sourceRoot":"","sources":["../../../../src/service/route53/resolve/sim-r53-service-target-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAC3C,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;;;;;OAMG;IACH,OAAO,CAAC,QAAgB;QACtB,MAAM,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACpD,qCAAqC;QACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CACL,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC;YACzC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YACxC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC;YACzC,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CACjD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAC7B,WAAmB;QAEnB,IAAI,WAAW,KAAK,qBAAqB,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,YAAY,EAAE,qBAAqB;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,sBAAsB,CAC5B,WAAmB;QAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAA8B,CAAC;QAE9D,IAAI,OAAO,KAAK,qBAAqB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAClE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnD,qCAAqC;QACrC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY;YACZ,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,uBAAuB,CAC7B,WAAmB;QAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,MAAM,CAAC;QAEnD,IAAI,OAAO,KAAK,sBAAsB,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,qCAAqC;QACrC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,8BAA8B,CACpC,WAAmB;QAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;QAE5C,IAAI,OAAO,KAAK,0BAA0B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,qCAAqC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,UAA2B;SACxC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-r53-service-target-resolver.js","sourceRoot":"","sources":["../../../../src/service/route53/resolve/sim-r53-service-target-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;;;;;OAMG;IACH,OAAO,CAAC,QAAgB;QACtB,MAAM,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACpD,qCAAqC;QACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CACL,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC;YACzC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YACxC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC;YACrC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC;YACzC,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CACjD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAC7B,WAAmB;QAEnB,IAAI,WAAW,KAAK,qBAAqB,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,YAAY,EAAE,qBAAqB;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,sBAAsB,CAC5B,WAAmB;QAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAA8B,CAAC;QAE9D,IAAI,OAAO,KAAK,qBAAqB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAClE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnD,qCAAqC;QACrC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY;YACZ,UAAU;YACV,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mBAAmB,CACzB,WAAmB;QAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAA8B,CAAC;QAE9D,IAAI,OAAO,KAAK,kBAAkB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,iEAAiE;QACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,oEAAoE;YACpE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,UAAU;YACV,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACK,uBAAuB,CAC7B,WAAmB;QAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,MAAM,CAAC;QAEnD,IAAI,OAAO,KAAK,sBAAsB,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,qCAAqC;QACrC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,8BAA8B,CACpC,WAAmB;QAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;QAE5C,IAAI,OAAO,KAAK,0BAA0B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,qCAAqC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,UAA2B;SACxC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-pinning-condition.d.ts

@@ -0,0 +1,7 @@
+import type { SimIamPolicyDocumentCondition } from "../../../iam/policy/sim-iam-policy.js";
+/**
+ * Whether a statement Condition constrains a wildcard Principal to fixed
+ * values, which is what stops real S3 counting the statement as public.
+ */
+export declare function simS3ConditionPinsPrincipal(condition: SimIamPolicyDocumentCondition | undefined): boolean;
+//# sourceMappingURL=sim-s3-pinning-condition.d.ts.map

package/dist/service/s3/bucket/public-access/sim-s3-pinning-condition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-pinning-condition.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-pinning-condition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,6BAA6B,EAC9B,MAAM,uCAAuC,CAAC;AAqC/C;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,6BAA6B,GAAG,SAAS,GACnD,OAAO,CAgBT"}

package/dist/service/s3/bucket/public-access/sim-s3-pinning-condition.js

@@ -0,0 +1,73 @@
+/**
+ * Condition keys that tie a wildcard Principal down to specific callers.
+ *
+ * These are the keys real S3 accepts as making an otherwise public Bucket
+ * policy non-public. `aws:SourceIp` is deliberately absent: S3 judges a CIDR
+ * range's breadth, treating anything wider than /8 as still public, and the
+ * simulator does not model that. Leaving it out means such a policy is treated
+ * as public, which errs toward refusing rather than allowing.
+ */
+const pinningConditionKeys = new Set([
+    "aws:principalorgid",
+    "aws:sourcearn",
+    "aws:sourcevpc",
+    "aws:sourcevpce",
+    "aws:sourceowner",
+    "aws:sourceaccount",
+    "aws:userid",
+    "s3:dataaccesspointarn",
+    "s3:dataaccesspointaccount",
+]);
+/**
+ * Condition operators that pin a key to a value.
+ *
+ * Negative and `IfExists` operators are absent because neither constrains who
+ * can call: an `IfExists` condition passes when the key is missing entirely.
+ */
+const pinningOperators = new Set([
+    "stringequals",
+    "stringequalsignorecase",
+    "stringlike",
+    "arnequals",
+    "arnlike",
+]);
+/**
+ * Whether a statement Condition constrains a wildcard Principal to fixed
+ * values, which is what stops real S3 counting the statement as public.
+ */
+export function simS3ConditionPinsPrincipal(condition) {
+    if (condition === undefined) {
+        return false;
+    }
+    for (const [operator, keyValues] of Object.entries(condition)) {
+        if (!pinningOperators.has(operator.toLowerCase())) {
+            continue;
+        }
+        if (pinsAnyKey(keyValues)) {
+            return true;
+        }
+    }
+    return false;
+}
+function pinsAnyKey(keyValues) {
+    for (const [conditionKey, value] of Object.entries(keyValues)) {
+        if (pinningConditionKeys.has(conditionKey.toLowerCase()) &&
+            isFixedValue(value)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * A value is fixed when it matches one caller rather than a set of them, so no
+ * wildcard characters and no unresolved IAM policy variable.
+ */
+function isFixedValue(value) {
+    const values = Array.isArray(value) ? value : [value];
+    return values.every((candidate) => typeof candidate === "string" &&
+        candidate.length > 0 &&
+        !candidate.includes("*") &&
+        !candidate.includes("?") &&
+        !candidate.includes("${"));
+}
+//# sourceMappingURL=sim-s3-pinning-condition.js.map

package/dist/service/s3/bucket/public-access/sim-s3-pinning-condition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-pinning-condition.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-pinning-condition.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,oBAAoB;IACpB,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,YAAY;IACZ,uBAAuB;IACvB,2BAA2B;CAC5B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,cAAc;IACd,wBAAwB;IACxB,YAAY;IACZ,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAoD;IAEpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CACjB,SAAyD;IAEzD,KAAK,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,IACE,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACpD,YAAY,CAAC,KAAK,CAAC,EACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAA2B;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEtD,OAAO,MAAM,CAAC,KAAK,CACjB,CAAC,SAAS,EAAE,EAAE,CACZ,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACxB,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACxB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC5B,CAAC;AACJ,CAAC"}

package/dist/service/s3/bucket/public-access/sim-s3-public-access-block.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Structural shape of an S3 PublicAccessBlockConfiguration.
+ *
+ * Matches the AWS SDK and CloudFormation property shape, so the same object can
+ * come from either.
+ */
+export interface SimS3PublicAccessBlockConfiguration {
+    readonly BlockPublicAcls?: boolean | undefined;
+    readonly IgnorePublicAcls?: boolean | undefined;
+    readonly BlockPublicPolicy?: boolean | undefined;
+    readonly RestrictPublicBuckets?: boolean | undefined;
+}
+/**
+ * A Block Public Access configuration with every setting settled.
+ *
+ * The AWS-facing shape leaves all four optional, so this is what the simulator
+ * holds once the omissions have been resolved.
+ */
+export interface SimS3PublicAccessBlockSettings {
+    readonly BlockPublicAcls: boolean;
+    readonly IgnorePublicAcls: boolean;
+    readonly BlockPublicPolicy: boolean;
+    readonly RestrictPublicBuckets: boolean;
+}
+/**
+ * The S3 Block Public Access settings of one simulated Bucket.
+ *
+ * There are two distinct states here and they are not the same. A Bucket nobody
+ * has configured blocks everything, which is what real S3 does for every new
+ * Bucket. A Bucket someone has configured has exactly what they asked for: the
+ * configuration replaces the previous one wholesale, so a setting left out of
+ * it is off rather than inherited.
+ *
+ * That second rule matters more than it looks. CDK's `BlockPublicAccess.
+ * BLOCK_ACLS` sets only `blockPublicAcls` and `ignorePublicAcls`, leaving
+ * `BlockPublicPolicy` out of the synthesized template, and pairing it with
+ * `publicReadAccess` is the standard way to build a public website Bucket.
+ * Treating the omitted setting as enabled would refuse that template, which
+ * real AWS deploys without complaint.
+ */
+export declare class SimS3PublicAccessBlock {
+    private readonly settings;
+    private constructor();
+    /**
+     * The all-blocked state a Bucket has until something configures it.
+     */
+    static blockingAll(): SimS3PublicAccessBlock;
+    /**
+     * A configuration exactly as supplied, with anything omitted turned off.
+     */
+    static fromConfiguration(configuration: SimS3PublicAccessBlockConfiguration): SimS3PublicAccessBlock;
+    /**
+     * Whether this Bucket refuses a Bucket policy that allows public access.
+     */
+    blocksPublicPolicy(): boolean;
+    /**
+     * The configuration as an AWS-shaped record, for GetPublicAccessBlock.
+     */
+    toConfiguration(): SimS3PublicAccessBlockSettings;
+}
+//# sourceMappingURL=sim-s3-public-access-block.d.ts.map

package/dist/service/s3/bucket/public-access/sim-s3-public-access-block.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-access-block.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-access-block.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAD3B,OAAO,eAEH;IAEJ;;OAEG;IACH,MAAM,CAAC,WAAW,IAAI,sBAAsB,CAO3C;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAa,EAAE,mCAAmC,GACjD,sBAAsB,CAOxB;IAED;;OAEG;IACH,kBAAkB,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,eAAe,IAAI,8BAA8B,CAEhD;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-access-block.js

@@ -0,0 +1,57 @@
+/**
+ * The S3 Block Public Access settings of one simulated Bucket.
+ *
+ * There are two distinct states here and they are not the same. A Bucket nobody
+ * has configured blocks everything, which is what real S3 does for every new
+ * Bucket. A Bucket someone has configured has exactly what they asked for: the
+ * configuration replaces the previous one wholesale, so a setting left out of
+ * it is off rather than inherited.
+ *
+ * That second rule matters more than it looks. CDK's `BlockPublicAccess.
+ * BLOCK_ACLS` sets only `blockPublicAcls` and `ignorePublicAcls`, leaving
+ * `BlockPublicPolicy` out of the synthesized template, and pairing it with
+ * `publicReadAccess` is the standard way to build a public website Bucket.
+ * Treating the omitted setting as enabled would refuse that template, which
+ * real AWS deploys without complaint.
+ */
+export class SimS3PublicAccessBlock {
+    settings;
+    constructor(settings) {
+        this.settings = settings;
+    }
+    /**
+     * The all-blocked state a Bucket has until something configures it.
+     */
+    static blockingAll() {
+        return new SimS3PublicAccessBlock({
+            BlockPublicAcls: true,
+            IgnorePublicAcls: true,
+            BlockPublicPolicy: true,
+            RestrictPublicBuckets: true,
+        });
+    }
+    /**
+     * A configuration exactly as supplied, with anything omitted turned off.
+     */
+    static fromConfiguration(configuration) {
+        return new SimS3PublicAccessBlock({
+            BlockPublicAcls: configuration.BlockPublicAcls ?? false,
+            IgnorePublicAcls: configuration.IgnorePublicAcls ?? false,
+            BlockPublicPolicy: configuration.BlockPublicPolicy ?? false,
+            RestrictPublicBuckets: configuration.RestrictPublicBuckets ?? false,
+        });
+    }
+    /**
+     * Whether this Bucket refuses a Bucket policy that allows public access.
+     */
+    blocksPublicPolicy() {
+        return this.settings.BlockPublicPolicy;
+    }
+    /**
+     * The configuration as an AWS-shaped record, for GetPublicAccessBlock.
+     */
+    toConfiguration() {
+        return { ...this.settings };
+    }
+}
+//# sourceMappingURL=sim-s3-public-access-block.js.map

package/dist/service/s3/bucket/public-access/sim-s3-public-access-block.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-access-block.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-access-block.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,sBAAsB;IAEd,QAAQ;IAD3B,YACmB,QAAwC;wBAAxC,QAAQ;IACxB,CAAC;IAEJ;;OAEG;IACH,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,sBAAsB,CAAC;YAChC,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,IAAI;YACtB,iBAAiB,EAAE,IAAI;YACvB,qBAAqB,EAAE,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAkD;QAElD,OAAO,IAAI,sBAAsB,CAAC;YAChC,eAAe,EAAE,aAAa,CAAC,eAAe,IAAI,KAAK;YACvD,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,IAAI,KAAK;YACzD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,IAAI,KAAK;YAC3D,qBAAqB,EAAE,aAAa,CAAC,qBAAqB,IAAI,KAAK;SACpE,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-policy-guard.d.ts

@@ -0,0 +1,19 @@
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+import type { SimS3Bucket } from "../sim-s3-bucket.js";
+/**
+ * Refuses a Bucket policy that the Bucket's Block Public Access settings do
+ * not allow.
+ *
+ * Real S3 applies this after deciding the caller may set a policy at all, so
+ * it refuses a policy the caller is otherwise entitled to apply. Enabling the
+ * setting later does not disturb a policy already stored: it governs what may
+ * be written, not what is already there.
+ */
+export declare class SimS3PublicPolicyGuard {
+    private readonly publicPolicy;
+    /**
+     * Throw when the Bucket blocks public policies and this document is one.
+     */
+    guard(bucket: SimS3Bucket, document: SimIamPolicyDocument): void;
+}
+//# sourceMappingURL=sim-s3-public-policy-guard.d.ts.map

package/dist/service/s3/bucket/public-access/sim-s3-public-policy-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-policy-guard.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-policy-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAElF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2B;IAExD;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAa/D;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-policy-guard.js

@@ -0,0 +1,28 @@
+import { SimS3AccessDenied } from "../../error/sim-s3.error.js";
+import { SimS3PublicPolicy } from "./sim-s3-public-policy.js";
+/**
+ * Refuses a Bucket policy that the Bucket's Block Public Access settings do
+ * not allow.
+ *
+ * Real S3 applies this after deciding the caller may set a policy at all, so
+ * it refuses a policy the caller is otherwise entitled to apply. Enabling the
+ * setting later does not disturb a policy already stored: it governs what may
+ * be written, not what is already there.
+ */
+export class SimS3PublicPolicyGuard {
+    publicPolicy = new SimS3PublicPolicy();
+    /**
+     * Throw when the Bucket blocks public policies and this document is one.
+     */
+    guard(bucket, document) {
+        if (!bucket.getPublicAccessBlock().blocksPublicPolicy()) {
+            return;
+        }
+        if (!this.publicPolicy.isPublic(document)) {
+            return;
+        }
+        throw new SimS3AccessDenied(`BlockPublicPolicy is enabled on S3 Bucket ${bucket.bucketName}, ` +
+            "so a Bucket policy allowing public access is refused");
+    }
+}
+//# sourceMappingURL=sim-s3-public-policy-guard.js.map

package/dist/service/s3/bucket/public-access/sim-s3-public-policy-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-policy-guard.js","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-policy-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAChB,YAAY,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAExD;;OAEG;IACH,KAAK,CAAC,MAAmB,EAAE,QAA8B;QACvD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,MAAM,CAAC,UAAU,IAAI;YAChE,sDAAsD,CACzD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/bucket/public-access/sim-s3-public-policy.d.ts

@@ -0,0 +1,18 @@
+import type { SimIamPolicyDocument } from "../../../iam/policy/sim-iam-policy.js";
+/**
+ * Decides whether a Bucket policy allows public access, which is what S3 Block
+ * Public Access judges a PutBucketPolicy call against.
+ *
+ * Real S3 starts by assuming a policy is public and looks for a reason it is
+ * not: a statement qualifies as non-public only when it grants access to fixed
+ * values. The simulator follows the same direction, so anything it cannot
+ * classify stays public and gets refused.
+ */
+export declare class SimS3PublicPolicy {
+    /**
+     * Whether any statement in the document grants public access.
+     */
+    isPublic(document: SimIamPolicyDocument): boolean;
+    private statementIsPublic;
+}
+//# sourceMappingURL=sim-s3-public-policy.d.ts.map

package/dist/service/s3/bucket/public-access/sim-s3-public-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-public-policy.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/bucket/public-access/sim-s3-public-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,uCAAuC,CAAC;AAI/C;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAIhD;IAED,OAAO,CAAC,iBAAiB;CAiB1B"}