@kensio/yulin 1.0.0 → 1.2.0

package/dist/service/s3/notification/destination/lambda/sim-s3-lambda-notification-destination.js

@@ -0,0 +1,40 @@
+import { SimS3InvalidArgument } from "../../../error/sim-s3.error.js";
+import { SimS3NotificationNotPermitted } from "../../../error/sim-s3-notification.error.js";
+import { simS3EventRecordsDocument } from "../../event/sim-s3-event-records.js";
+/**
+ * A simulated Lambda function as somewhere S3 sends Object events.
+ *
+ * The same question is asked twice on purpose. Real S3 checks the function's
+ * resource policy when the configuration is applied, and checks it again for
+ * every event, so a permission removed afterwards stops delivery. Nothing is
+ * remembered from the first check.
+ */
+export class SimS3LambdaNotificationDestination {
+    functions;
+    constructor(properties) {
+        this.functions = properties.functions;
+    }
+    /**
+     * Refuse a function the Bucket may not invoke.
+     *
+     * Real S3 answers InvalidArgument for a destination it could not validate,
+     * which is what a missing `AddPermission` for `s3.amazonaws.com` produces.
+     */
+    validate(request) {
+        const refusal = this.functions.invokeRefusal(request);
+        if (refusal !== undefined) {
+            throw new SimS3InvalidArgument(`Unable to validate the following destination configurations: ${refusal}`);
+        }
+    }
+    /**
+     * Invoke the function with the event, if it still admits this Bucket.
+     */
+    async deliver(request) {
+        const refusal = this.functions.invokeRefusal(request);
+        if (refusal !== undefined) {
+            throw new SimS3NotificationNotPermitted(refusal);
+        }
+        await this.functions.invoke(request, simS3EventRecordsDocument(request.event, request.configurationId));
+    }
+}
+//# sourceMappingURL=sim-s3-lambda-notification-destination.js.map

package/dist/service/s3/notification/destination/lambda/sim-s3-lambda-notification-destination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-lambda-notification-destination.js","sourceRoot":"","sources":["../../../../../../src/service/s3/notification/destination/lambda/sim-s3-lambda-notification-destination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAYhF;;;;;;;GAOG;AACH,MAAM,OAAO,kCAAkC;IAC5B,SAAS,CAA6B;IAEvD,YAAY,UAAwD;QAClE,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,OAA4C;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,oBAAoB,CAC5B,gEAAgE,OAAO,EAAE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAAyC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CACzB,OAAO,EACP,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,CAClE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/notification/destination/lambda/sim-s3-notification-function-arn.d.ts

@@ -0,0 +1,24 @@
+import type { SimAwsAccountId } from "../../../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../../../aws/sim-aws-region.js";
+/**
+ * The Lambda function ARN a notification configuration names.
+ *
+ * Lambda addresses a function with colons rather than a slash, so this reads
+ * the ARN itself rather than going through the shared ARN parser, which is
+ * built for the slash form.
+ */
+export declare class SimS3NotificationFunctionArn {
+    readonly regionName: AwsRegionName;
+    readonly accountId: SimAwsAccountId;
+    readonly functionName: string;
+    private constructor();
+    /**
+     * Read a Lambda function ARN, refusing anything else.
+     *
+     * A qualified ARN naming a version or an alias is refused rather than being
+     * read as the unqualified function, because simulated Lambda has neither and
+     * silently notifying `$LATEST` instead would be the wrong function.
+     */
+    static parse(arn: string): SimS3NotificationFunctionArn;
+}
+//# sourceMappingURL=sim-s3-notification-function-arn.d.ts.map

package/dist/service/s3/notification/destination/lambda/sim-s3-notification-function-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-function-arn.d.ts","sourceRoot":"","sources":["../../../../../../src/service/s3/notification/destination/lambda/sim-s3-notification-function-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAMvE;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,SAAgB,UAAU,EAAE,aAAa,CAAC;IAC1C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC,OAAO,eAQN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,4BAA4B,CAsCtD;CACF"}

package/dist/service/s3/notification/destination/lambda/sim-s3-notification-function-arn.js

@@ -0,0 +1,45 @@
+import { SimS3InvalidArgument, SimS3NotImplemented, } from "../../../error/sim-s3.error.js";
+/**
+ * The Lambda function ARN a notification configuration names.
+ *
+ * Lambda addresses a function with colons rather than a slash, so this reads
+ * the ARN itself rather than going through the shared ARN parser, which is
+ * built for the slash form.
+ */
+export class SimS3NotificationFunctionArn {
+    regionName;
+    accountId;
+    functionName;
+    constructor(regionName, accountId, functionName) {
+        this.regionName = regionName;
+        this.accountId = accountId;
+        this.functionName = functionName;
+    }
+    /**
+     * Read a Lambda function ARN, refusing anything else.
+     *
+     * A qualified ARN naming a version or an alias is refused rather than being
+     * read as the unqualified function, because simulated Lambda has neither and
+     * silently notifying `$LATEST` instead would be the wrong function.
+     */
+    static parse(arn) {
+        const [prefix, partition, service, region, accountId, resourceType, name, qualifier,] = arn.split(":");
+        if (prefix !== "arn" ||
+            partition !== "aws" ||
+            service !== "lambda" ||
+            resourceType !== "function" ||
+            region === undefined ||
+            accountId === undefined ||
+            name === undefined ||
+            name === "") {
+            throw new SimS3InvalidArgument(`${arn} is not a Lambda function ARN.`);
+        }
+        if (qualifier !== undefined) {
+            throw new SimS3NotImplemented(`Cannot notify ${arn}: simulated Lambda has no function versions or ` +
+                "aliases, so a qualified function ARN is refused rather than " +
+                "treated as the unqualified function.");
+        }
+        return new SimS3NotificationFunctionArn(region, accountId, name);
+    }
+}
+//# sourceMappingURL=sim-s3-notification-function-arn.js.map

package/dist/service/s3/notification/destination/lambda/sim-s3-notification-function-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-function-arn.js","sourceRoot":"","sources":["../../../../../../src/service/s3/notification/destination/lambda/sim-s3-notification-function-arn.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACvB,UAAU,CAAgB;IAC1B,SAAS,CAAkB;IAC3B,YAAY,CAAS;IAErC,YACE,UAAyB,EACzB,SAA0B,EAC1B,YAAoB;QAEpB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,GAAW;QACtB,MAAM,CACJ,MAAM,EACN,SAAS,EACT,OAAO,EACP,MAAM,EACN,SAAS,EACT,YAAY,EACZ,IAAI,EACJ,SAAS,EACV,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEnB,IACE,MAAM,KAAK,KAAK;YAChB,SAAS,KAAK,KAAK;YACnB,OAAO,KAAK,QAAQ;YACpB,YAAY,KAAK,UAAU;YAC3B,MAAM,KAAK,SAAS;YACpB,SAAS,KAAK,SAAS;YACvB,IAAI,KAAK,SAAS;YAClB,IAAI,KAAK,EAAE,EACX,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,GAAG,GAAG,gCAAgC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,GAAG,iDAAiD;gBACnE,8DAA8D;gBAC9D,sCAAsC,CACzC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,4BAA4B,CACrC,MAAuB,EACvB,SAA4B,EAC5B,IAAI,CACL,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/notification/destination/lambda/sim-s3-notification-functions.d.ts

@@ -0,0 +1,23 @@
+import type { SimS3NotificationDestinationRequest } from "../sim-s3-notification-destination.js";
+/**
+ * The narrow slice of simulated Lambda that S3 event notification needs.
+ *
+ * S3 asks two questions of a function: whether it may invoke it, and then to
+ * invoke it. Both are asked by ARN, because a notification configuration names
+ * a function by ARN and that ARN can name another Account or Region.
+ */
+export interface SimS3NotificationFunctions {
+    /**
+     * Why S3 may not invoke the function, or nothing when it may.
+     *
+     * A reason rather than a boolean, because both the configuration-time
+     * refusal and the delivery-time record repeat it back to whoever has to fix
+     * it.
+     */
+    invokeRefusal(request: SimS3NotificationDestinationRequest): string | undefined;
+    /**
+     * Invoke the function with an event document.
+     */
+    invoke(request: SimS3NotificationDestinationRequest, event: object): Promise<void>;
+}
+//# sourceMappingURL=sim-s3-notification-functions.d.ts.map

package/dist/service/s3/notification/destination/lambda/sim-s3-notification-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-functions.d.ts","sourceRoot":"","sources":["../../../../../../src/service/s3/notification/destination/lambda/sim-s3-notification-functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;OAMG;IACH,aAAa,CACX,OAAO,EAAE,mCAAmC,GAC3C,MAAM,GAAG,SAAS,CAAC;IAEtB;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,mCAAmC,EAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/service/s3/notification/destination/lambda/sim-s3-notification-functions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-s3-notification-functions.js.map

package/dist/service/s3/notification/destination/lambda/sim-s3-notification-functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-functions.js","sourceRoot":"","sources":["../../../../../../src/service/s3/notification/destination/lambda/sim-s3-notification-functions.ts"],"names":[],"mappings":""}

package/dist/service/s3/notification/destination/sim-s3-notification-destination-check.d.ts

@@ -0,0 +1,20 @@
+import type { SimS3NotificationConfiguration } from "../../bucket/notification/sim-s3-notification-configuration.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3NotificationDestinations } from "./sim-s3-notification-destination.js";
+/**
+ * Checks that a Bucket can actually reach the destinations a configuration
+ * names.
+ *
+ * Real S3 validates the destinations as part of the call that applies the
+ * configuration, so a function that does not allow `s3.amazonaws.com` to invoke
+ * it is refused there rather than accepted and never delivered to.
+ */
+export declare class SimS3NotificationDestinationCheck {
+    private readonly destinations;
+    constructor(destinations: SimS3NotificationDestinations);
+    /**
+     * Refuse a configuration naming a destination this Bucket cannot notify.
+     */
+    check(bucket: SimS3Bucket, configuration: SimS3NotificationConfiguration): void;
+}
+//# sourceMappingURL=sim-s3-notification-destination-check.d.ts.map

package/dist/service/s3/notification/destination/sim-s3-notification-destination-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-destination-check.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/notification/destination/sim-s3-notification-destination-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gEAAgE,CAAC;AACrH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAE1F;;;;;;;GAOG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAE7D,YAAY,YAAY,EAAE,6BAA6B,EAEtD;IAED;;OAEG;IACH,KAAK,CACH,MAAM,EAAE,WAAW,EACnB,aAAa,EAAE,8BAA8B,GAC5C,IAAI,CAaN;CACF"}

package/dist/service/s3/notification/destination/sim-s3-notification-destination-check.js

@@ -0,0 +1,32 @@
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+/**
+ * Checks that a Bucket can actually reach the destinations a configuration
+ * names.
+ *
+ * Real S3 validates the destinations as part of the call that applies the
+ * configuration, so a function that does not allow `s3.amazonaws.com` to invoke
+ * it is refused there rather than accepted and never delivered to.
+ */
+export class SimS3NotificationDestinationCheck {
+    destinations;
+    constructor(destinations) {
+        this.destinations = destinations;
+    }
+    /**
+     * Refuse a configuration naming a destination this Bucket cannot notify.
+     */
+    check(bucket, configuration) {
+        const scope = bucket.getAccountRegionScope();
+        const request = {
+            bucketArn: simS3BucketArn(bucket.bucketName),
+            bucketOwnerAccountId: scope.accountId,
+            bucketRegionName: scope.regionName,
+        };
+        for (const notification of configuration.all) {
+            this.destinations
+                .resolve(notification.destinationService, notification.destinationArn)
+                .validate({ ...request, destinationArn: notification.destinationArn });
+        }
+    }
+}
+//# sourceMappingURL=sim-s3-notification-destination-check.js.map

package/dist/service/s3/notification/destination/sim-s3-notification-destination-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-destination-check.js","sourceRoot":"","sources":["../../../../../src/service/s3/notification/destination/sim-s3-notification-destination-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAKnE;;;;;;;GAOG;AACH,MAAM,OAAO,iCAAiC;IAC3B,YAAY,CAAgC;IAE7D,YAAY,YAA2C;QACrD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CACH,MAAmB,EACnB,aAA6C;QAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;YAC5C,oBAAoB,EAAE,KAAK,CAAC,SAAS;YACrC,gBAAgB,EAAE,KAAK,CAAC,UAAU;SACnC,CAAC;QAEF,KAAK,MAAM,YAAY,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC;YAC7C,IAAI,CAAC,YAAY;iBACd,OAAO,CAAC,YAAY,CAAC,kBAAkB,EAAE,YAAY,CAAC,cAAc,CAAC;iBACrE,QAAQ,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF"}

package/dist/service/s3/notification/destination/sim-s3-notification-destination.d.ts

@@ -0,0 +1,68 @@
+import type { SimS3ObjectEvent } from "../event/sim-s3-object-event.js";
+/**
+ * What a destination needs to know about the Bucket asking it a question.
+ *
+ * The Bucket ARN and the owning Account are both carried because a destination
+ * decides whether S3 may reach it from the resource policy on its own side, and
+ * that policy is usually written for one Bucket in one Account.
+ */
+export interface SimS3NotificationDestinationRequest {
+    readonly destinationArn: string;
+    readonly bucketArn: string;
+    readonly bucketOwnerAccountId: string;
+    /**
+     * The Region the Bucket is in, which a queue destination has to be in too.
+     *
+     * A Bucket ARN carries no Region, so it is passed alongside rather than read
+     * out of one.
+     */
+    readonly bucketRegionName: string;
+}
+/**
+ * A destination being asked to take one event.
+ */
+export interface SimS3NotificationDeliveryRequest extends SimS3NotificationDestinationRequest {
+    readonly configurationId: string;
+    readonly event: SimS3ObjectEvent;
+}
+/**
+ * Somewhere simulated S3 can send an Object event.
+ *
+ * Validation and delivery are the same per-destination question asked at two
+ * moments, which is why one object owns both. Real S3 checks the destination
+ * when the configuration is applied and checks it again for every event, so a
+ * permission removed afterwards stops delivery rather than being remembered
+ * from configuration time.
+ */
+export interface SimS3NotificationDestination {
+    /**
+     * Refuse a destination the Bucket cannot notify, when the configuration
+     * naming it is applied.
+     */
+    validate(request: SimS3NotificationDestinationRequest): void;
+    /**
+     * Deliver one event, refusing if the destination no longer admits S3.
+     */
+    deliver(request: SimS3NotificationDeliveryRequest): Promise<void>;
+}
+/**
+ * The kinds of destination a notification configuration can name.
+ *
+ * Which one a configuration wants comes from the destination group it was
+ * declared in rather than from the service segment of its ARN, so a queue ARN
+ * under `LambdaFunctionConfigurations` is refused for not being a function
+ * rather than quietly delivered to as a queue.
+ */
+export type SimS3NotificationDestinationService = "lambda" | "sqs";
+/**
+ * The destinations one simulated S3 scope can reach.
+ */
+export interface SimS3NotificationDestinations {
+    /**
+     * The destination of a kind, refusing one this simulated S3 cannot reach.
+     *
+     * The ARN is carried for the refusal to name rather than to be read.
+     */
+    resolve(service: SimS3NotificationDestinationService, destinationArn: string): SimS3NotificationDestination;
+}
+//# sourceMappingURL=sim-s3-notification-destination.d.ts.map

package/dist/service/s3/notification/destination/sim-s3-notification-destination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-destination.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/notification/destination/sim-s3-notification-destination.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,mCAAmC;IAC3F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,mCAAmC,GAAG,IAAI,CAAC;IAE7D;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,OAAO,CACL,OAAO,EAAE,mCAAmC,EAC5C,cAAc,EAAE,MAAM,GACrB,4BAA4B,CAAC;CACjC"}

package/dist/service/s3/notification/destination/sim-s3-notification-destination.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-s3-notification-destination.js.map

package/dist/service/s3/notification/destination/sim-s3-notification-destination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-destination.js","sourceRoot":"","sources":["../../../../../src/service/s3/notification/destination/sim-s3-notification-destination.ts"],"names":[],"mappings":""}

package/dist/service/s3/notification/destination/sim-s3-service-notification-destinations.d.ts

@@ -0,0 +1,38 @@
+import type { SimS3NotificationDestination, SimS3NotificationDestinations, SimS3NotificationDestinationService } from "./sim-s3-notification-destination.js";
+interface SimS3ServiceNotificationDestinationsProperties {
+    readonly lambda: SimS3NotificationDestination;
+    readonly sqs: SimS3NotificationDestination;
+}
+/**
+ * The destinations of one simulated S3 scope, one per kind of destination.
+ *
+ * A configuration says which kind it wants by the destination group it was
+ * declared in, so nothing here reads an ARN. The ARN is the destination's own
+ * business, and each of them refuses one that does not name a resource of the
+ * kind it delivers to.
+ */
+export declare class SimS3ServiceNotificationDestinations implements SimS3NotificationDestinations {
+    private readonly lambda;
+    private readonly sqs;
+    constructor(properties: SimS3ServiceNotificationDestinationsProperties);
+    /**
+     * The destination of a kind.
+     */
+    resolve(service: SimS3NotificationDestinationService): SimS3NotificationDestination;
+}
+/**
+ * The destinations a simulated S3 built on its own has, which is none.
+ *
+ * A standalone SimS3 owns its own background scheduler, so nothing could wait
+ * for a delivery it made even if it could make one. Refusing when the
+ * configuration is applied says so at the point the mistake was made, rather
+ * than leaving a configured Bucket that never notifies anything.
+ */
+export declare class SimS3NoNotificationDestinations implements SimS3NotificationDestinations {
+    /**
+     * Refuse every destination, explaining how to get one.
+     */
+    resolve(_service: SimS3NotificationDestinationService, destinationArn: string): never;
+}
+export {};
+//# sourceMappingURL=sim-s3-service-notification-destinations.d.ts.map

package/dist/service/s3/notification/destination/sim-s3-service-notification-destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-service-notification-destinations.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/notification/destination/sim-s3-service-notification-destinations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,sCAAsC,CAAC;AAE9C,UAAU,8CAA8C;IACtD,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,4BAA4B,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,qBAAa,oCAAqC,YAAW,6BAA6B;IACxF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA+B;IAEnD,YAAY,UAAU,EAAE,8CAA8C,EAGrE;IAED;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,mCAAmC,GAC3C,4BAA4B,CAS9B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,6BAA6B;IACnF;;OAEG;IACH,OAAO,CACL,QAAQ,EAAE,mCAAmC,EAC7C,cAAc,EAAE,MAAM,GACrB,KAAK,CAOP;CACF"}

package/dist/service/s3/notification/destination/sim-s3-service-notification-destinations.js

@@ -0,0 +1,50 @@
+import { SimS3NotImplemented } from "../../error/sim-s3.error.js";
+/**
+ * The destinations of one simulated S3 scope, one per kind of destination.
+ *
+ * A configuration says which kind it wants by the destination group it was
+ * declared in, so nothing here reads an ARN. The ARN is the destination's own
+ * business, and each of them refuses one that does not name a resource of the
+ * kind it delivers to.
+ */
+export class SimS3ServiceNotificationDestinations {
+    lambda;
+    sqs;
+    constructor(properties) {
+        this.lambda = properties.lambda;
+        this.sqs = properties.sqs;
+    }
+    /**
+     * The destination of a kind.
+     */
+    resolve(service) {
+        switch (service) {
+            case "lambda": {
+                return this.lambda;
+            }
+            case "sqs": {
+                return this.sqs;
+            }
+        }
+    }
+}
+/**
+ * The destinations a simulated S3 built on its own has, which is none.
+ *
+ * A standalone SimS3 owns its own background scheduler, so nothing could wait
+ * for a delivery it made even if it could make one. Refusing when the
+ * configuration is applied says so at the point the mistake was made, rather
+ * than leaving a configured Bucket that never notifies anything.
+ */
+export class SimS3NoNotificationDestinations {
+    /**
+     * Refuse every destination, explaining how to get one.
+     */
+    resolve(_service, destinationArn) {
+        throw new SimS3NotImplemented(`Cannot notify ${destinationArn}: this SimS3 was constructed on its ` +
+            "own, so it has no other simulated services to notify and no shared " +
+            "background scheduler to deliver on. Reach simulated S3 through " +
+            "SimAws to configure Bucket event notifications.");
+    }
+}
+//# sourceMappingURL=sim-s3-service-notification-destinations.js.map

package/dist/service/s3/notification/destination/sim-s3-service-notification-destinations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-service-notification-destinations.js","sourceRoot":"","sources":["../../../../../src/service/s3/notification/destination/sim-s3-service-notification-destinations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAYlE;;;;;;;GAOG;AACH,MAAM,OAAO,oCAAoC;IAC9B,MAAM,CAA+B;IACrC,GAAG,CAA+B;IAEnD,YAAY,UAA0D;QACpE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,OAAO,CACL,OAA4C;QAE5C,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,OAAO,CACL,QAA6C,EAC7C,cAAsB;QAEtB,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,cAAc,sCAAsC;YACnE,qEAAqE;YACrE,iEAAiE;YACjE,iDAAiD,CACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/s3/notification/destination/sim-s3-service-principal.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The service principal S3 reaches a notification destination as.
+ *
+ * Every destination's resource policy is written for this, so it lives beside
+ * the destinations rather than inside one of them.
+ */
+export declare const simS3ServicePrincipal = "s3.amazonaws.com";
+//# sourceMappingURL=sim-s3-service-principal.d.ts.map

package/dist/service/s3/notification/destination/sim-s3-service-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-service-principal.d.ts","sourceRoot":"","sources":["../../../../../src/service/s3/notification/destination/sim-s3-service-principal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC"}

package/dist/service/s3/notification/destination/sim-s3-service-principal.js

@@ -0,0 +1,8 @@
+/**
+ * The service principal S3 reaches a notification destination as.
+ *
+ * Every destination's resource policy is written for this, so it lives beside
+ * the destinations rather than inside one of them.
+ */
+export const simS3ServicePrincipal = "s3.amazonaws.com";
+//# sourceMappingURL=sim-s3-service-principal.js.map

package/dist/service/s3/notification/destination/sim-s3-service-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-service-principal.js","sourceRoot":"","sources":["../../../../../src/service/s3/notification/destination/sim-s3-service-principal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC"}

package/dist/service/s3/notification/destination/sqs/sim-aws-s3-notification-queues.d.ts

@@ -0,0 +1,40 @@
+import type { SimAws } from "../../../../aws/sim-aws.js";
+import type { SimS3NotificationDestinationRequest } from "../sim-s3-notification-destination.js";
+import type { SimS3NotificationQueues } from "./sim-s3-notification-queues.js";
+interface SimAwsS3NotificationQueuesProperties {
+    readonly simAws: SimAws;
+}
+/**
+ * The simulated SQS queues of one simulated AWS instance, as S3 notification
+ * destinations.
+ *
+ * Queues are looked up when a configuration is applied or an event is
+ * delivered, never when this is built, for the same reason the Lambda
+ * destination does it that way: reaching another service while this one is
+ * being constructed is a cycle with no bottom to it.
+ *
+ * A queue in another Account is allowed, and evaluated against the IAM of the
+ * Account owning it. Real S3 asks only that the queue is in the Bucket's
+ * Region, which is why AWS's own documented destination queue policy carries an
+ * `aws:SourceAccount` guard: it would have no job if the two Accounts were
+ * always the same.
+ */
+export declare class SimAwsS3NotificationQueues implements SimS3NotificationQueues {
+    private readonly simAws;
+    constructor(properties: SimAwsS3NotificationQueuesProperties);
+    /**
+     * Why S3 may not send to the queue, or nothing when it may.
+     *
+     * The Region is this side's rule and the rest is the queue's own. What S3
+     * adds to the queue's decision is which Bucket is sending, so a policy
+     * granting one Bucket does not open the queue to another.
+     */
+    sendRefusal(request: SimS3NotificationDestinationRequest): string | undefined;
+    /**
+     * Send the event document to the queue.
+     */
+    send(request: SimS3NotificationDestinationRequest, body: string): Promise<void>;
+    private queue;
+}
+export {};
+//# sourceMappingURL=sim-aws-s3-notification-queues.d.ts.map

package/dist/service/s3/notification/destination/sqs/sim-aws-s3-notification-queues.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-s3-notification-queues.d.ts","sourceRoot":"","sources":["../../../../../../src/service/s3/notification/destination/sqs/sim-aws-s3-notification-queues.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAGjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,0BAA2B,YAAW,uBAAuB;IACxE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;;;;OAMG;IACH,WAAW,CACT,OAAO,EAAE,mCAAmC,GAC3C,MAAM,GAAG,SAAS,CAYpB;IAED;;OAEG;IACG,IAAI,CACR,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAIf;IAED,OAAO,CAAC,KAAK;CAMd"}

package/dist/service/s3/notification/destination/sqs/sim-aws-s3-notification-queues.js

@@ -0,0 +1,52 @@
+import { SimS3NotificationQueue } from "./sim-s3-notification-queue.js";
+import { SimS3NotificationQueueArn } from "./sim-s3-notification-queue-arn.js";
+/**
+ * The simulated SQS queues of one simulated AWS instance, as S3 notification
+ * destinations.
+ *
+ * Queues are looked up when a configuration is applied or an event is
+ * delivered, never when this is built, for the same reason the Lambda
+ * destination does it that way: reaching another service while this one is
+ * being constructed is a cycle with no bottom to it.
+ *
+ * A queue in another Account is allowed, and evaluated against the IAM of the
+ * Account owning it. Real S3 asks only that the queue is in the Bucket's
+ * Region, which is why AWS's own documented destination queue policy carries an
+ * `aws:SourceAccount` guard: it would have no job if the two Accounts were
+ * always the same.
+ */
+export class SimAwsS3NotificationQueues {
+    simAws;
+    constructor(properties) {
+        this.simAws = properties.simAws;
+    }
+    /**
+     * Why S3 may not send to the queue, or nothing when it may.
+     *
+     * The Region is this side's rule and the rest is the queue's own. What S3
+     * adds to the queue's decision is which Bucket is sending, so a policy
+     * granting one Bucket does not open the queue to another.
+     */
+    sendRefusal(request) {
+        const arn = SimS3NotificationQueueArn.parse(request.destinationArn);
+        if (!arn.isIn(request.bucketRegionName)) {
+            return (`${request.destinationArn} is in ${arn.regionName}, and an S3 event ` +
+                "notification destination queue must be in the Bucket's Region, " +
+                `${request.bucketRegionName}.`);
+        }
+        return this.queue(arn).sendRefusal(request);
+    }
+    /**
+     * Send the event document to the queue.
+     */
+    async send(request, body) {
+        await this.queue(SimS3NotificationQueueArn.parse(request.destinationArn)).send(request, body);
+    }
+    queue(arn) {
+        return new SimS3NotificationQueue({
+            arn,
+            scope: this.simAws.accountRegionScope(arn.accountId, arn.regionName),
+        });
+    }
+}
+//# sourceMappingURL=sim-aws-s3-notification-queues.js.map

package/dist/service/s3/notification/destination/sqs/sim-aws-s3-notification-queues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-s3-notification-queues.js","sourceRoot":"","sources":["../../../../../../src/service/s3/notification/destination/sqs/sim-aws-s3-notification-queues.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAO/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,0BAA0B;IACpB,MAAM,CAAS;IAEhC,YAAY,UAAgD;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CACT,OAA4C;QAE5C,MAAM,GAAG,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAEpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxC,OAAO,CACL,GAAG,OAAO,CAAC,cAAc,UAAU,GAAG,CAAC,UAAU,oBAAoB;gBACrE,iEAAiE;gBACjE,GAAG,OAAO,CAAC,gBAAgB,GAAG,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,OAA4C,EAC5C,IAAY;QAEZ,MAAM,IAAI,CAAC,KAAK,CACd,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CACxD,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,GAA8B;QAC1C,OAAO,IAAI,sBAAsB,CAAC;YAChC,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/s3/notification/destination/sqs/sim-s3-notification-queue-arn.d.ts

@@ -0,0 +1,33 @@
+import type { SimAwsAccountId } from "../../../../aws/sim-aws-account.js";
+import type { AwsRegionName } from "../../../../aws/sim-aws-region.js";
+/**
+ * The SQS queue ARN a notification configuration names.
+ *
+ * A queue ARN has no resource type segment, so the queue name follows the
+ * Account id directly and the shared ARN reader cannot read one.
+ */
+export declare class SimS3NotificationQueueArn {
+    readonly regionName: AwsRegionName;
+    readonly accountId: SimAwsAccountId;
+    readonly queueName: string;
+    private constructor();
+    /**
+     * Read an SQS queue ARN, refusing anything else.
+     *
+     * A FIFO queue is refused by its name, as real S3 refuses one as an event
+     * notification destination. Simulated SQS has no FIFO queues either, so
+     * without this the refusal would be that the queue does not exist, which
+     * points at the wrong thing to fix.
+     */
+    static parse(arn: string): SimS3NotificationQueueArn;
+    /**
+     * The URL an SQS request names this queue by.
+     */
+    get queueUrl(): string;
+    /**
+     * Whether this queue is in a Region, which a destination queue has to share
+     * with the Bucket notifying it.
+     */
+    isIn(regionName: string): boolean;
+}
+//# sourceMappingURL=sim-s3-notification-queue-arn.d.ts.map

package/dist/service/s3/notification/destination/sqs/sim-s3-notification-queue-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-notification-queue-arn.d.ts","sourceRoot":"","sources":["../../../../../../src/service/s3/notification/destination/sqs/sim-s3-notification-queue-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAOvE;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,UAAU,EAAE,aAAa,CAAC;IAC1C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC,OAAO,eAQN;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,yBAAyB,CA+BnD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,CAMrB;IAED;;;OAGG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEhC;CACF"}

package/dist/service/s3/notification/destination/sqs/sim-s3-notification-queue-arn.js

@@ -0,0 +1,64 @@
+import { sqsQueueUrl } from "../../../../sqs/queue/sim-sqs-queue-arn.js";
+import { SimS3InvalidArgument, SimS3NotImplemented, } from "../../../error/sim-s3.error.js";
+/**
+ * The SQS queue ARN a notification configuration names.
+ *
+ * A queue ARN has no resource type segment, so the queue name follows the
+ * Account id directly and the shared ARN reader cannot read one.
+ */
+export class SimS3NotificationQueueArn {
+    regionName;
+    accountId;
+    queueName;
+    constructor(regionName, accountId, queueName) {
+        this.regionName = regionName;
+        this.accountId = accountId;
+        this.queueName = queueName;
+    }
+    /**
+     * Read an SQS queue ARN, refusing anything else.
+     *
+     * A FIFO queue is refused by its name, as real S3 refuses one as an event
+     * notification destination. Simulated SQS has no FIFO queues either, so
+     * without this the refusal would be that the queue does not exist, which
+     * points at the wrong thing to fix.
+     */
+    static parse(arn) {
+        const [prefix, partition, service, region, accountId, name, extra] = arn.split(":");
+        if (prefix !== "arn" ||
+            partition !== "aws" ||
+            service !== "sqs" ||
+            region === undefined ||
+            region === "" ||
+            accountId === undefined ||
+            accountId === "" ||
+            name === undefined ||
+            name === "" ||
+            extra !== undefined) {
+            throw new SimS3InvalidArgument(`${arn} is not an SQS queue ARN.`);
+        }
+        if (name.endsWith(".fifo")) {
+            throw new SimS3NotImplemented(`Cannot notify ${arn}: a FIFO queue is not a valid S3 event ` +
+                "notification destination, and simulated SQS has no FIFO queues.");
+        }
+        return new SimS3NotificationQueueArn(region, accountId, name);
+    }
+    /**
+     * The URL an SQS request names this queue by.
+     */
+    get queueUrl() {
+        return sqsQueueUrl({
+            regionName: this.regionName,
+            accountId: this.accountId,
+            name: this.queueName,
+        });
+    }
+    /**
+     * Whether this queue is in a Region, which a destination queue has to share
+     * with the Bucket notifying it.
+     */
+    isIn(regionName) {
+        return this.regionName === regionName;
+    }
+}
+//# sourceMappingURL=sim-s3-notification-queue-arn.js.map