@kensio/yulin 1.21.0 → 1.21.2

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-configuration.js

@@ -1,4 +1,4 @@
-import { simS3LifecycleReached, simS3ObjectExpiryInstant, simS3UploadAbortInstant, } from "./sim-s3-lifecycle-expiry.js";
+import { simS3LifecycleReached, simS3NoncurrentExpiryInstant, simS3ObjectExpiryInstant, simS3UploadAbortInstant, } from "./sim-s3-lifecycle-expiry.js";
 import { simS3LifecycleRuleSelects } from "./sim-s3-lifecycle-selection.js";
 /**
  * The lifecycle configuration of one simulated S3 Bucket.
@@ -64,6 +64,36 @@ export class SimS3LifecycleConfiguration {
             simS3LifecycleRuleSelects(rule, object) &&
             simS3LifecycleReached(simS3ObjectExpiryInstant(rule.Expiration, object.lastModified), now));
     }
+    /**
+     * Whether an enabled rule has expired a noncurrent version by the given
+     * instant.
+     *
+     * `NewerNoncurrentVersions` holds that many of the most recent noncurrent
+     * versions back from the rule, whatever their age, so a rule keeping two
+     * reaches the third and everything older.
+     */
+    expiresNoncurrent(version, now) {
+        return this.enabledRules().some((rule) => {
+            const expiration = rule.NoncurrentVersionExpiration;
+            return (expiration !== undefined &&
+                version.newerVersionsAhead >=
+                    (expiration.NewerNoncurrentVersions ?? 0) &&
+                simS3LifecycleRuleSelects(rule, version) &&
+                simS3LifecycleReached(simS3NoncurrentExpiryInstant(expiration, version.noncurrentSince), now));
+        });
+    }
+    /**
+     * Whether an enabled rule removes a delete marker with nothing left under
+     * it.
+     *
+     * Real S3 calls that an expired object delete marker and takes it away on
+     * its next pass, with no period to wait out. The marker is what keeps the
+     * key in a listing once its last version has gone.
+     */
+    expiresDeleteMarker(key) {
+        return this.enabledRules().some((rule) => rule.Expiration?.ExpiredObjectDeleteMarker === true &&
+            simS3LifecycleRuleSelects(rule, { key }));
+    }
     /**
      * Whether an enabled rule has abandoned a multipart upload by the given
      * instant.

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-expiry.d.ts

@@ -1,4 +1,4 @@
-import type { SimS3LifecycleAbortIncompleteMultipartUpload, SimS3LifecycleExpiration } from "../../command/put-bucket-lifecycle-configuration/put-bucket-lifecycle-configuration.command.js";
+import type { SimS3LifecycleAbortIncompleteMultipartUpload, SimS3LifecycleExpiration, SimS3LifecycleNoncurrentVersionExpiration } from "../../command/put-bucket-lifecycle-configuration/put-bucket-lifecycle-configuration.command.js";
 /**
  * The instant an `Expiration` puts an Object written at a given time past.
  *
@@ -9,9 +9,20 @@ import type { SimS3LifecycleAbortIncompleteMultipartUpload, SimS3LifecycleExpira
  *
  * `Days` wins over `Date` when a rule carries both, though real S3 refuses to
  * store such a rule. An `Expiration` carrying only `ExpiredObjectDeleteMarker`
- * has no boundary at all, since Object versions are left out.
+ * has no boundary at all, because it names a delete marker to remove rather
+ * than a period to wait out.
  */
 export declare function simS3ObjectExpiryInstant(expiration: SimS3LifecycleExpiration, writtenAt: Date): Date | undefined;
+/**
+ * The instant a `NoncurrentVersionExpiration` puts a version past, counted
+ * from when that version stopped being the current one.
+ *
+ * A version that is still current has no such instant, and neither has one
+ * under a rule stating only `NewerNoncurrentVersions`. Real S3 requires
+ * `NoncurrentDays` alongside that count, and a rule without it names no period
+ * to measure.
+ */
+export declare function simS3NoncurrentExpiryInstant(expiration: SimS3LifecycleNoncurrentVersionExpiration, noncurrentSince: Date | undefined): Date | undefined;
 /**
  * The instant an `AbortIncompleteMultipartUpload` abandons an upload started
  * at a given time.

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-expiry.js

@@ -9,7 +9,8 @@ const millisecondsPerDay = 24 * 60 * 60 * 1000;
  *
  * `Days` wins over `Date` when a rule carries both, though real S3 refuses to
  * store such a rule. An `Expiration` carrying only `ExpiredObjectDeleteMarker`
- * has no boundary at all, since Object versions are left out.
+ * has no boundary at all, because it names a delete marker to remove rather
+ * than a period to wait out.
  */
 export function simS3ObjectExpiryInstant(expiration, writtenAt) {
     if (expiration.Days !== undefined) {
@@ -20,6 +21,22 @@ export function simS3ObjectExpiryInstant(expiration, writtenAt) {
     }
     return undefined;
 }
+/**
+ * The instant a `NoncurrentVersionExpiration` puts a version past, counted
+ * from when that version stopped being the current one.
+ *
+ * A version that is still current has no such instant, and neither has one
+ * under a rule stating only `NewerNoncurrentVersions`. Real S3 requires
+ * `NoncurrentDays` alongside that count, and a rule without it names no period
+ * to measure.
+ */
+export function simS3NoncurrentExpiryInstant(expiration, noncurrentSince) {
+    if (noncurrentSince === undefined ||
+        expiration.NoncurrentDays === undefined) {
+        return undefined;
+    }
+    return afterDays(noncurrentSince, expiration.NoncurrentDays);
+}
 /**
  * The instant an `AbortIncompleteMultipartUpload` abandons an upload started
  * at a given time.

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-sweep.d.ts

@@ -1,5 +1,6 @@
 import type { SimS3Object } from "../../object/s3-object.js";
 import type { SimS3BucketStorage } from "../../storage/s3-bucket-storage.js";
+import type { SimS3BucketVersions } from "../versioning/sim-s3-bucket-versions.js";
 import type { SimS3LifecycleConfiguration } from "./sim-s3-lifecycle-configuration.js";
 /**
  * One pass over what a Bucket's lifecycle rules have expired.
@@ -15,12 +16,19 @@ import type { SimS3LifecycleConfiguration } from "./sim-s3-lifecycle-configurati
  *
  * Nothing is announced. Real S3 raises `s3:LifecycleExpiration:Delete` for an
  * expiry, and that event family is among the ones simulated S3 leaves out.
+ *
+ * What an expiry does depends on whether the Bucket keeps versions. Real S3
+ * expires the current version of a key on a versioned Bucket by writing a
+ * delete marker over it, leaving the version itself for a
+ * `NoncurrentVersionExpiration` rule to remove later, so that is what happens
+ * here too. A Bucket keeping no versions loses the Object outright.
  */
 export declare class SimS3LifecycleSweep {
     private readonly storage;
     private readonly lifecycle;
     private readonly now;
-    constructor(storage: SimS3BucketStorage, lifecycle: SimS3LifecycleConfiguration, now: Date);
+    private readonly versions;
+    constructor(storage: SimS3BucketStorage, lifecycle: SimS3LifecycleConfiguration, now: Date, versions: SimS3BucketVersions);
     /**
      * Remove one Object if the rules have expired it.
      *
@@ -33,5 +41,13 @@ export declare class SimS3LifecycleSweep {
      * ones still there.
      */
     objects(objects: readonly SimS3Object[]): Promise<SimS3Object[]>;
+    /**
+     * Take one expired key out of what a read of the Bucket can see.
+     *
+     * A versioned Bucket keeps the bytes and hides them behind a marker, which
+     * is what leaves the version there for `NoncurrentVersionExpiration` to
+     * find. Everything else loses the Object.
+     */
+    private expire;
     private expires;
 }

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-sweep.js

@@ -12,15 +12,23 @@
  *
  * Nothing is announced. Real S3 raises `s3:LifecycleExpiration:Delete` for an
  * expiry, and that event family is among the ones simulated S3 leaves out.
+ *
+ * What an expiry does depends on whether the Bucket keeps versions. Real S3
+ * expires the current version of a key on a versioned Bucket by writing a
+ * delete marker over it, leaving the version itself for a
+ * `NoncurrentVersionExpiration` rule to remove later, so that is what happens
+ * here too. A Bucket keeping no versions loses the Object outright.
  */
 export class SimS3LifecycleSweep {
     storage;
     lifecycle;
     now;
-    constructor(storage, lifecycle, now) {
+    versions;
+    constructor(storage, lifecycle, now, versions) {
         this.storage = storage;
         this.lifecycle = lifecycle;
         this.now = now;
+        this.versions = versions;
     }
     /**
      * Remove one Object if the rules have expired it.
@@ -32,7 +40,7 @@ export class SimS3LifecycleSweep {
         if (object === undefined || !this.expires(object)) {
             return object;
         }
-        await this.storage.deleteObject(object.key);
+        await this.expire(object.key);
         return undefined;
     }
     /**
@@ -44,9 +52,25 @@ export class SimS3LifecycleSweep {
             return [...objects];
         }
         const expiredKeys = new Set(objects.filter((object) => this.expires(object)).map(({ key }) => key));
-        await Promise.all(expiredKeys.values().map(async (key) => this.storage.deleteObject(key)));
+        await Promise.all(expiredKeys.values().map(async (key) => {
+            await this.expire(key);
+        }));
         return objects.filter((object) => !expiredKeys.has(object.key));
     }
+    /**
+     * Take one expired key out of what a read of the Bucket can see.
+     *
+     * A versioned Bucket keeps the bytes and hides them behind a marker, which
+     * is what leaves the version there for `NoncurrentVersionExpiration` to
+     * find. Everything else loses the Object.
+     */
+    async expire(key) {
+        if (this.versions.keepsVersions) {
+            await this.versions.markDeleted(this.storage, key, this.now);
+            return;
+        }
+        await this.storage.deleteObject(key);
+    }
     expires(object) {
         return (!this.lifecycle.isEmpty &&
             this.lifecycle.expires(lifecycleObject(object), this.now));

package/dist/service/s3/bucket/lifecycle/sim-s3-noncurrent-sweep.d.ts

@@ -0,0 +1,45 @@
+import type { SimS3BucketVersions } from "../versioning/sim-s3-bucket-versions.js";
+import type { SimS3LifecycleConfiguration } from "./sim-s3-lifecycle-configuration.js";
+/**
+ * One pass over what a Bucket's rules have expired in its version history.
+ *
+ * The Object sweep works on storage, which holds the current Object under each
+ * key and nothing else. Everything a `NoncurrentVersionExpiration` reaches is
+ * therefore invisible to it, and so is the delete marker an
+ * `ExpiredObjectDeleteMarker` removes. Both live in the history alone, which
+ * is why removing them touches no storage and this pass is synchronous where
+ * the Object sweep cannot be.
+ *
+ * A Bucket is swept when its versions are read, the way an Object is swept
+ * when it is. Nothing runs on a schedule.
+ */
+export declare class SimS3NoncurrentSweep {
+    private readonly lifecycle;
+    private readonly now;
+    constructor(lifecycle: SimS3LifecycleConfiguration, now: Date);
+    /**
+     * Remove what the rules have expired from a Bucket's history.
+     */
+    sweep(versions: SimS3BucketVersions): void;
+    /**
+     * Remove what the rules have expired of one key.
+     *
+     * The noncurrent versions go first and a delete marker left bare goes
+     * second, so a marker whose last version went in this same pass goes with
+     * it. Real S3 orders the two the same way.
+     *
+     * The head of the list is the current version and no rule for noncurrent
+     * ones reaches it, however old it is. Everything after it is counted from
+     * the newest, which is the count `NewerNoncurrentVersions` holds back.
+     */
+    private sweepKey;
+    /**
+     * Remove a delete marker the rules have expired, which is one left with no
+     * version under it at all.
+     *
+     * That takes the key out of `ListObjectVersions` altogether, since the
+     * marker was the only thing left holding the key there.
+     */
+    private sweepDeleteMarker;
+    private expires;
+}

package/dist/service/s3/bucket/lifecycle/sim-s3-noncurrent-sweep.js

@@ -0,0 +1,90 @@
+/**
+ * One pass over what a Bucket's rules have expired in its version history.
+ *
+ * The Object sweep works on storage, which holds the current Object under each
+ * key and nothing else. Everything a `NoncurrentVersionExpiration` reaches is
+ * therefore invisible to it, and so is the delete marker an
+ * `ExpiredObjectDeleteMarker` removes. Both live in the history alone, which
+ * is why removing them touches no storage and this pass is synchronous where
+ * the Object sweep cannot be.
+ *
+ * A Bucket is swept when its versions are read, the way an Object is swept
+ * when it is. Nothing runs on a schedule.
+ */
+export class SimS3NoncurrentSweep {
+    lifecycle;
+    now;
+    constructor(lifecycle, now) {
+        this.lifecycle = lifecycle;
+        this.now = now;
+    }
+    /**
+     * Remove what the rules have expired from a Bucket's history.
+     */
+    sweep(versions) {
+        if (this.lifecycle.isEmpty || !versions.keepsVersions) {
+            return;
+        }
+        for (const held of byKey(versions.list()).values()) {
+            this.sweepKey(versions, held);
+        }
+    }
+    /**
+     * Remove what the rules have expired of one key.
+     *
+     * The noncurrent versions go first and a delete marker left bare goes
+     * second, so a marker whose last version went in this same pass goes with
+     * it. Real S3 orders the two the same way.
+     *
+     * The head of the list is the current version and no rule for noncurrent
+     * ones reaches it, however old it is. Everything after it is counted from
+     * the newest, which is the count `NewerNoncurrentVersions` holds back.
+     */
+    sweepKey(versions, held) {
+        const kept = [];
+        for (const [index, version] of held.entries()) {
+            if (index === 0 || !this.expires(version, index - 1)) {
+                kept.push(version);
+                continue;
+            }
+            versions.removeExpired(version.key, version.versionId);
+        }
+        this.sweepDeleteMarker(versions, kept);
+    }
+    /**
+     * Remove a delete marker the rules have expired, which is one left with no
+     * version under it at all.
+     *
+     * That takes the key out of `ListObjectVersions` altogether, since the
+     * marker was the only thing left holding the key there.
+     */
+    sweepDeleteMarker(versions, kept) {
+        const marker = kept[0];
+        if (kept.length === 1 &&
+            marker?.isDeleteMarker === true &&
+            this.lifecycle.expiresDeleteMarker(marker.key)) {
+            versions.removeExpired(marker.key, marker.versionId);
+        }
+    }
+    expires(version, ahead) {
+        return this.lifecycle.expiresNoncurrent({
+            key: version.key,
+            size: version.isDeleteMarker ? 0 : version.object.body.length,
+            noncurrentSince: version.noncurrentSince,
+            newerVersionsAhead: ahead,
+        }, this.now);
+    }
+}
+/**
+ * The versions of one Bucket, gathered under the key each belongs to.
+ *
+ * A listing already holds each key's versions together and newest first, so
+ * this keeps that order and only groups them.
+ */
+function byKey(listed) {
+    const grouped = new Map();
+    for (const version of listed) {
+        grouped.set(version.key, [...(grouped.get(version.key) ?? []), version]);
+    }
+    return grouped;
+}

package/dist/service/s3/bucket/lock/sim-s3-bucket-object-lock.d.ts

@@ -0,0 +1,42 @@
+import type { SimS3ObjectVersion } from "../versioning/sim-s3-object-version.js";
+import type { SimS3ObjectLockConfiguration } from "./sim-s3-object-lock-configuration.js";
+/**
+ * The Object Lock of one simulated S3 Bucket.
+ *
+ * It holds the configuration and applies it, which is two jobs a Bucket needs
+ * doing in two different places. A write asks it what retention the new
+ * version starts with, and a delete asks it whether the version may go.
+ */
+export declare class SimS3BucketObjectLock {
+    private locking;
+    /** How this Bucket is locked, or nothing where it has never been. */
+    get configuration(): SimS3ObjectLockConfiguration | undefined;
+    /** Whether Object Lock is on. */
+    get isEnabled(): boolean;
+    /**
+     * Turn Object Lock on, or replace the default retention it carries.
+     *
+     * Real S3 has no request that turns it off, so this only ever arrives at a
+     * configuration with it on.
+     */
+    configure(configuration: SimS3ObjectLockConfiguration): void;
+    /**
+     * Give a newly written version the Bucket's default retention, if it has
+     * one, and hand the version back.
+     *
+     * The period is counted from the write, so two versions of one key written a
+     * day apart are retained until two different instants. A Bucket keeping no
+     * versions wrote none, and gets nothing back.
+     */
+    withDefaultRetention(version: SimS3ObjectVersion | undefined, writtenAt: Date): SimS3ObjectVersion | undefined;
+    /**
+     * Refuse a delete Object Lock is holding a version against.
+     *
+     * Real S3 answers this with `AccessDenied`, the same code it answers a
+     * caller with no permission with. The reason says which of the two things
+     * holding the version is doing it, since a legal hold and a retention period
+     * are got past in different ways. A version that is not there is held
+     * against nothing, and the delete goes on to report it missing.
+     */
+    assertDeletable(version: SimS3ObjectVersion | undefined, instant: Date, bypassed: boolean): void;
+}

package/dist/service/s3/bucket/lock/sim-s3-bucket-object-lock.js

@@ -0,0 +1,59 @@
+import { SimS3AccessDenied } from "../../error/sim-s3.error.js";
+/**
+ * The Object Lock of one simulated S3 Bucket.
+ *
+ * It holds the configuration and applies it, which is two jobs a Bucket needs
+ * doing in two different places. A write asks it what retention the new
+ * version starts with, and a delete asks it whether the version may go.
+ */
+export class SimS3BucketObjectLock {
+    locking;
+    /** How this Bucket is locked, or nothing where it has never been. */
+    get configuration() {
+        return this.locking;
+    }
+    /** Whether Object Lock is on. */
+    get isEnabled() {
+        return this.locking !== undefined;
+    }
+    /**
+     * Turn Object Lock on, or replace the default retention it carries.
+     *
+     * Real S3 has no request that turns it off, so this only ever arrives at a
+     * configuration with it on.
+     */
+    configure(configuration) {
+        this.locking = configuration;
+    }
+    /**
+     * Give a newly written version the Bucket's default retention, if it has
+     * one, and hand the version back.
+     *
+     * The period is counted from the write, so two versions of one key written a
+     * day apart are retained until two different instants. A Bucket keeping no
+     * versions wrote none, and gets nothing back.
+     */
+    withDefaultRetention(version, writtenAt) {
+        const retention = this.locking?.retentionAt(writtenAt);
+        if (version !== undefined && retention !== undefined) {
+            version.lock.setDefaultRetention(retention);
+        }
+        return version;
+    }
+    /**
+     * Refuse a delete Object Lock is holding a version against.
+     *
+     * Real S3 answers this with `AccessDenied`, the same code it answers a
+     * caller with no permission with. The reason says which of the two things
+     * holding the version is doing it, since a legal hold and a retention period
+     * are got past in different ways. A version that is not there is held
+     * against nothing, and the delete goes on to report it missing.
+     */
+    assertDeletable(version, instant, bypassed) {
+        const refusal = version?.lock.refusesDeleteAt(instant, bypassed);
+        if (version !== undefined && refusal !== undefined) {
+            throw new SimS3AccessDenied(`Version ${version.versionId} of S3 Object ${version.key} cannot be ` +
+                `deleted because ${refusal}`);
+        }
+    }
+}

package/dist/service/s3/bucket/lock/sim-s3-default-retention.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Read the mode of a default retention, refusing one real S3 refuses.
+ *
+ * The same two modes a per-version retention takes. They are read here rather
+ * than through `SimS3ObjectRetention.parse`, because a default carries a
+ * length where a retention carries an instant.
+ */
+export declare function simS3RetentionMode(mode: string | undefined): string;

package/dist/service/s3/bucket/lock/sim-s3-default-retention.js

@@ -0,0 +1,15 @@
+import { SimS3InvalidRequest } from "../../error/sim-s3.error.js";
+import { simS3ComplianceMode, simS3GovernanceMode, simS3RetentionModeNames, } from "./sim-s3-object-retention.js";
+/**
+ * Read the mode of a default retention, refusing one real S3 refuses.
+ *
+ * The same two modes a per-version retention takes. They are read here rather
+ * than through `SimS3ObjectRetention.parse`, because a default carries a
+ * length where a retention carries an instant.
+ */
+export function simS3RetentionMode(mode) {
+    if (mode === simS3GovernanceMode || mode === simS3ComplianceMode) {
+        return mode;
+    }
+    throw new SimS3InvalidRequest(`Object Lock DefaultRetention Mode has to be ${simS3RetentionModeNames}`);
+}

package/dist/service/s3/bucket/lock/sim-s3-object-lock-configuration.d.ts

@@ -0,0 +1,49 @@
+import { SimS3ObjectRetention } from "./sim-s3-object-retention.js";
+/** The one value `ObjectLockEnabled` takes. Real S3 has no way to turn it off. */
+export declare const simS3ObjectLockEnabled = "Enabled";
+/**
+ * Structural shape of an S3 ObjectLockConfiguration.
+ *
+ * Matches the AWS SDK and CloudFormation property shape, so the same object
+ * can come from either.
+ */
+export interface SimS3ObjectLockConfigurationInput {
+    readonly ObjectLockEnabled?: string | undefined;
+    readonly Rule?: {
+        readonly DefaultRetention?: {
+            readonly Mode?: string | undefined;
+            readonly Days?: number | undefined;
+            readonly Years?: number | undefined;
+        } | undefined;
+    } | undefined;
+}
+/**
+ * How one simulated S3 Bucket is locked, and for how long by default.
+ *
+ * A Bucket either has Object Lock turned on or has never had it. Real S3 has
+ * no request that turns it off again, which is what lets a reader's history be
+ * promised rather than merely configured.
+ *
+ * The default retention is optional. A Bucket with Object Lock on and no
+ * default locks nothing on its own, and every version it holds is retained
+ * only by the requests that name it. A Bucket with one retains every version
+ * written after it, counted from the write.
+ */
+export declare class SimS3ObjectLockConfiguration {
+    private readonly defaults;
+    private constructor();
+    /**
+     * Read a configuration a request is setting, refusing one real S3 refuses.
+     */
+    static parse(input: SimS3ObjectLockConfigurationInput): SimS3ObjectLockConfiguration;
+    /**
+     * The retention a version written at an instant is given.
+     *
+     * Real S3 counts a default retention from the write rather than from the
+     * configuration, so two versions of one key written a day apart are retained
+     * until two different instants.
+     */
+    retentionAt(instant: Date): SimS3ObjectRetention | undefined;
+    /** What GetObjectLockConfiguration answers with. */
+    get reported(): SimS3ObjectLockConfigurationInput;
+}

package/dist/service/s3/bucket/lock/sim-s3-object-lock-configuration.js

@@ -0,0 +1,102 @@
+import { SimS3InvalidRequest } from "../../error/sim-s3.error.js";
+import { SimS3ObjectRetention } from "./sim-s3-object-retention.js";
+import { simS3RetentionMode } from "./sim-s3-default-retention.js";
+const millisecondsPerDay = 86_400_000;
+const daysPerYear = 365;
+/**
+ * The longest default retention real S3 takes, which is a hundred years.
+ *
+ * An unbounded one would compute a `RetainUntilDate` past the range a
+ * JavaScript Date holds, and a version retained until an instant that reads
+ * back as `NaN` is a version nothing is holding at all.
+ */
+const maximumRetentionDays = 100 * daysPerYear;
+/** The one value `ObjectLockEnabled` takes. Real S3 has no way to turn it off. */
+export const simS3ObjectLockEnabled = "Enabled";
+/**
+ * How one simulated S3 Bucket is locked, and for how long by default.
+ *
+ * A Bucket either has Object Lock turned on or has never had it. Real S3 has
+ * no request that turns it off again, which is what lets a reader's history be
+ * promised rather than merely configured.
+ *
+ * The default retention is optional. A Bucket with Object Lock on and no
+ * default locks nothing on its own, and every version it holds is retained
+ * only by the requests that name it. A Bucket with one retains every version
+ * written after it, counted from the write.
+ */
+export class SimS3ObjectLockConfiguration {
+    defaults;
+    constructor(defaults) {
+        this.defaults = defaults;
+    }
+    /**
+     * Read a configuration a request is setting, refusing one real S3 refuses.
+     */
+    static parse(input) {
+        if (input.ObjectLockEnabled !== simS3ObjectLockEnabled) {
+            throw new SimS3InvalidRequest(`ObjectLockEnabled has to be ${simS3ObjectLockEnabled}`);
+        }
+        const declared = input.Rule?.DefaultRetention;
+        if (declared === undefined) {
+            return new SimS3ObjectLockConfiguration();
+        }
+        return new SimS3ObjectLockConfiguration({
+            mode: simS3RetentionMode(declared.Mode),
+            days: simS3DefaultRetentionDays(declared),
+        });
+    }
+    /**
+     * The retention a version written at an instant is given.
+     *
+     * Real S3 counts a default retention from the write rather than from the
+     * configuration, so two versions of one key written a day apart are retained
+     * until two different instants.
+     */
+    retentionAt(instant) {
+        const defaults = this.defaults;
+        if (defaults === undefined) {
+            return undefined;
+        }
+        return new SimS3ObjectRetention({
+            mode: defaults.mode,
+            retainUntil: new Date(instant.getTime() + defaults.days * millisecondsPerDay),
+        });
+    }
+    /** What GetObjectLockConfiguration answers with. */
+    get reported() {
+        const defaults = this.defaults;
+        return {
+            ObjectLockEnabled: simS3ObjectLockEnabled,
+            ...(defaults !== undefined && {
+                Rule: {
+                    DefaultRetention: { Mode: defaults.mode, Days: defaults.days },
+                },
+            }),
+        };
+    }
+}
+/**
+ * The length of a default retention, in days.
+ *
+ * Real S3 takes it as either `Days` or `Years` and refuses both together. A
+ * year is 365 days here, which is what S3 documents its own arithmetic as.
+ */
+function simS3DefaultRetentionDays(declared) {
+    const { Days, Years } = declared;
+    if ((Days === undefined) === (Years === undefined)) {
+        throw new SimS3InvalidRequest("Object Lock DefaultRetention requires either Days or Years, and " +
+            "refuses both together");
+    }
+    const period = Days ?? Years;
+    if (period === undefined || period < 1 || !Number.isSafeInteger(period)) {
+        throw new SimS3InvalidRequest(`Object Lock DefaultRetention period ${String(period)} has to be a ` +
+            `whole number of at least 1`);
+    }
+    const days = Days === undefined ? period * daysPerYear : period;
+    if (days > maximumRetentionDays) {
+        throw new SimS3InvalidRequest(`Object Lock DefaultRetention period ${String(period)} is longer than ` +
+            `the hundred years real S3 retains a version for`);
+    }
+    return days;
+}

package/dist/service/s3/bucket/lock/sim-s3-object-lock-output.d.ts

@@ -0,0 +1,14 @@
+/**
+ * What a read of an Object says about the Object Lock holding it.
+ *
+ * `GetObject` and `HeadObject` both report these, and a version nothing is
+ * holding leaves all three out rather than reporting them empty.
+ */
+export interface SimS3ObjectLockOutput {
+    /** The mode of the retention period on the version, if it has one. */
+    readonly ObjectLockMode?: string;
+    /** When that period lapses. */
+    readonly ObjectLockRetainUntilDate?: Date;
+    /** `ON` while a legal hold is on the version, and absent otherwise. */
+    readonly ObjectLockLegalHoldStatus?: string;
+}

package/dist/service/s3/bucket/lock/sim-s3-object-lock-output.js

@@ -0,0 +1 @@
+export {};