@kensio/yulin 1.21.0 → 1.21.2

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-names.js

@@ -4,8 +4,11 @@
 export const simulatedPropertyNames = new Set([
     "BucketName",
     "LifecycleConfiguration",
+    "ObjectLockConfiguration",
+    "ObjectLockEnabled",
     "NotificationConfiguration",
     "PublicAccessBlockConfiguration",
+    "VersioningConfiguration",
     "WebsiteConfiguration",
 ]);
 /**
@@ -21,15 +24,19 @@ export const inertPropertyNames = new Set([
     "BucketEncryption",
     "Tags",
 ]);
+import { validateSimCfnS3BucketReplication } from "./replication/sim-cfn-s3-bucket-replication-rules.js";
 /**
  * Real AWS::S3::Bucket properties this simulation does not model, with what
  * each of them would have changed.
  *
  * The Bucket is created without them and each one is recorded against the
- * Resource. A versioned Bucket, for instance, answers a delete with a delete
- * marker and an `ObjectRemoved:DeleteMarkerCreated` event, where this simulator
- * removes the Object and raises `ObjectRemoved:Delete`, so a test written
- * against versioning needs to find out that it was never configured.
+ * Resource. A Bucket declaring replication, for instance, copies nothing to
+ * the Bucket it names, so a test expecting an Object to arrive there needs to
+ * find out that nothing was ever going to send it.
+ *
+ * A property whose value real S3 answers with a 400 states what it has to
+ * satisfy here as well. Nothing acts on the value either way, and reading it
+ * this far is what keeps a template AWS refuses from deploying.
  */
 export const unsimulatedPropertyReasons = new Map([
     ["AbacStatus", "attribute-based access control is not simulated"],
@@ -55,19 +62,12 @@ export const unsimulatedPropertyReasons = new Map([
     ["MetadataConfiguration", "Bucket metadata tables are not simulated"],
     ["MetadataTableConfiguration", "Bucket metadata tables are not simulated"],
     ["MetricsConfigurations", "CloudWatch request metrics are not simulated"],
-    [
-        "ObjectLockConfiguration",
-        "Object Lock is not simulated, so a retained Object can still be deleted",
-    ],
-    [
-        "ObjectLockEnabled",
-        "Object Lock is not simulated, so a retained Object can still be deleted",
-    ],
     ["OwnershipControls", "Object ownership and ACLs are not simulated"],
-    ["ReplicationConfiguration", "Bucket replication is not simulated"],
     [
-        "VersioningConfiguration",
-        "Object versions are not simulated, so a delete removes the Object and " +
-            "raises ObjectRemoved:Delete rather than creating a delete marker",
+        "ReplicationConfiguration",
+        {
+            reason: "Bucket replication is not simulated",
+            constraint: validateSimCfnS3BucketReplication,
+        },
     ],
 ]);

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-rules.d.ts

@@ -10,9 +10,12 @@ interface SimCfnS3BucketPropertyRulesProperties {
  *
  * Simulated CloudFormation deploys what it can, so a property this simulation
  * cannot act on does not stop the Bucket being created. It is left out and
- * recorded against the Resource, where a test can find it. Refusing is kept for
- * the one case where there is nothing coherent to create: a BucketName that is
- * not a name.
+ * recorded against the Resource, where a test can find it.
+ *
+ * Refusing is kept for two cases. There is nothing coherent to create, as a
+ * BucketName that is not a name leaves. Or the value is one real S3 answers
+ * with a 400, which a skipped property can carry as readily as a simulated
+ * one, and deploying it here would report a template AWS refuses as working.
  *
  * A property this simulation has never heard of is treated the same way. It may
  * be a typo, or a property AWS added since this list was written, and a Bucket
@@ -23,10 +26,11 @@ export declare class SimCfnS3BucketPropertyRules {
     private readonly logicalId;
     private readonly properties;
     private readonly ignorer;
+    private readonly skipped;
     constructor(properties: SimCfnS3BucketPropertyRulesProperties);
     /**
-     * Record everything about this Resource that is not simulated, refusing only
-     * what leaves nothing to create.
+     * Record everything about this Resource that is not simulated, refusing
+     * what leaves nothing to create and what real S3 answers with a 400.
      */
     apply(): void;
     /**

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-rules.js

@@ -1,3 +1,4 @@
+import { SimCfnSkippedProperties } from "../../../cloudformation/resource/ignore/sim-cfn-skipped-properties.js";
 import { s3BucketResourceError } from "./error/sim-cfn-s3-bucket-error.js";
 import { inertPropertyNames, simulatedPropertyNames, unsimulatedPropertyReasons, } from "./sim-cfn-s3-bucket-property-names.js";
 /**
@@ -5,9 +6,12 @@ import { inertPropertyNames, simulatedPropertyNames, unsimulatedPropertyReasons,
  *
  * Simulated CloudFormation deploys what it can, so a property this simulation
  * cannot act on does not stop the Bucket being created. It is left out and
- * recorded against the Resource, where a test can find it. Refusing is kept for
- * the one case where there is nothing coherent to create: a BucketName that is
- * not a name.
+ * recorded against the Resource, where a test can find it.
+ *
+ * Refusing is kept for two cases. There is nothing coherent to create, as a
+ * BucketName that is not a name leaves. Or the value is one real S3 answers
+ * with a 400, which a skipped property can carry as readily as a simulated
+ * one, and deploying it here would report a template AWS refuses as working.
  *
  * A property this simulation has never heard of is treated the same way. It may
  * be a typo, or a property AWS added since this list was written, and a Bucket
@@ -18,17 +22,24 @@ export class SimCfnS3BucketPropertyRules {
     logicalId;
     properties;
     ignorer;
+    skipped;
     constructor(properties) {
         this.logicalId = properties.logicalId;
         this.properties = properties.properties;
         this.ignorer = properties.ignorer;
+        this.skipped = new SimCfnSkippedProperties({
+            rules: unsimulatedPropertyReasons,
+            properties: this.properties,
+            error: (reason) => s3BucketResourceError(this.logicalId, reason),
+        });
     }
     /**
-     * Record everything about this Resource that is not simulated, refusing only
-     * what leaves nothing to create.
+     * Record everything about this Resource that is not simulated, refusing
+     * what leaves nothing to create and what real S3 answers with a 400.
      */
     apply() {
         this.refuseUnusableBucketName();
+        this.skipped.assertConstraints();
         for (const name of Object.keys(this.properties)) {
             this.applyToProperty(name);
         }
@@ -52,7 +63,7 @@ export class SimCfnS3BucketPropertyRules {
         if (simulatedPropertyNames.has(name) || inertPropertyNames.has(name)) {
             return;
         }
-        const unsimulatedReason = unsimulatedPropertyReasons.get(name);
+        const unsimulatedReason = this.skipped.reasonFor(name);
         if (unsimulatedReason !== undefined) {
             this.ignorer.ignoreProperty(name, `${name} is a real AWS::S3::Bucket property simulated S3 does not ` +
                 `act on: ${unsimulatedReason}`);

package/dist/service/s3/cfn/bucket/versioning/sim-cfn-s3-bucket-versioning-configuration.d.ts

@@ -0,0 +1,19 @@
+import type { SimCfnTemplateValueRecord } from "../../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3VersioningConfiguration } from "../../../bucket/versioning/sim-s3-bucket-versioning.js";
+/**
+ * Reads the `VersioningConfiguration` property of an AWS::S3::Bucket Resource.
+ *
+ * CloudFormation names the status exactly as PutBucketVersioning does, so the
+ * property is handed to the command rather than translated here. The command
+ * is also what refuses a status S3 does not take, which keeps a template and
+ * an SDK caller answering alike.
+ */
+export declare class SimCfnS3BucketVersioningConfiguration {
+    private readonly properties;
+    private readonly shape;
+    constructor(logicalId: string, properties: SimCfnTemplateValueRecord);
+    /**
+     * The configuration to apply, or nothing when the Resource declares none.
+     */
+    read(): SimS3VersioningConfiguration | undefined;
+}

package/dist/service/s3/cfn/bucket/versioning/sim-cfn-s3-bucket-versioning-configuration.js

@@ -0,0 +1,28 @@
+import { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
+import { s3BucketResourceError } from "../error/sim-cfn-s3-bucket-error.js";
+/**
+ * Reads the `VersioningConfiguration` property of an AWS::S3::Bucket Resource.
+ *
+ * CloudFormation names the status exactly as PutBucketVersioning does, so the
+ * property is handed to the command rather than translated here. The command
+ * is also what refuses a status S3 does not take, which keeps a template and
+ * an SDK caller answering alike.
+ */
+export class SimCfnS3BucketVersioningConfiguration {
+    properties;
+    shape;
+    constructor(logicalId, properties) {
+        this.properties = properties;
+        this.shape = new SimCfnValueShape((reason) => s3BucketResourceError(logicalId, reason));
+    }
+    /**
+     * The configuration to apply, or nothing when the Resource declares none.
+     */
+    read() {
+        const declared = this.properties["VersioningConfiguration"];
+        if (declared === undefined) {
+            return undefined;
+        }
+        return this.shape.record(declared, "VersioningConfiguration");
+    }
+}

package/dist/service/s3/command/authorize/sim-s3-authorize-action.d.ts

@@ -0,0 +1,24 @@
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+/** One S3 request, as the decision to allow it is asked for. */
+export interface SimS3AuthorizedAction {
+    readonly iam: SimIamInterServiceAuthZ;
+    /** The real IAM action, such as `s3:PutObjectRetention`. */
+    readonly action: string;
+    /** The Bucket ARN or the Object ARN, whichever the action is granted on. */
+    readonly resource: string;
+    /** The Bucket whose own policy is part of the decision. */
+    readonly bucket: SimS3Bucket;
+    readonly options: SimS3RequestOptions | undefined;
+}
+/**
+ * Ensure one caller may take one action on one S3 resource.
+ *
+ * The Bucket's own policy is part of every decision, alongside whatever the
+ * caller's identity policies say, and the request's source ARN and Account are
+ * supplied as the condition keys a Bucket policy is usually written against.
+ * An omitted caller is passed through to sim IAM, so Account root fallback
+ * stays owned by IAM.
+ */
+export declare function simS3AuthorizeAction(request: SimS3AuthorizedAction): void;

package/dist/service/s3/command/authorize/sim-s3-authorize-action.js

@@ -0,0 +1,30 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simS3BucketResourcePolicies } from "./sim-s3-bucket-resource-policies.js";
+import { simS3ConditionContext } from "./sim-s3-condition-context.js";
+/**
+ * Ensure one caller may take one action on one S3 resource.
+ *
+ * The Bucket's own policy is part of every decision, alongside whatever the
+ * caller's identity policies say, and the request's source ARN and Account are
+ * supplied as the condition keys a Bucket policy is usually written against.
+ * An omitted caller is passed through to sim IAM, so Account root fallback
+ * stays owned by IAM.
+ */
+export function simS3AuthorizeAction(request) {
+    const { iam, action, resource, bucket, options } = request;
+    const decision = iam.authorize({
+        action,
+        resource,
+        caller: options?.caller,
+        conditionContext: simS3ConditionContext(options),
+        resourcePolicies: simS3BucketResourcePolicies(bucket),
+    });
+    if (decision.isDenied) {
+        throw new SimIamAccessDenied({
+            principal: decision.caller.principal,
+            reason: decision.denialReason,
+            action,
+            resource,
+        });
+    }
+}

package/dist/service/s3/command/complete-multipart-upload/complete-multipart-upload.command.d.ts

@@ -37,5 +37,7 @@ export interface SimCompleteMultipartUploadCommandOutput {
     readonly Bucket?: string;
     readonly Key?: string;
     readonly ETag?: string;
+    /** The version the assembled Object was written as, if the Bucket keeps them. */
+    readonly VersionId?: string | undefined;
     readonly $metadata: SimResponseMetadata;
 }

package/dist/service/s3/command/complete-multipart-upload/complete-multipart-upload.handler.js

@@ -34,19 +34,21 @@ export class CompleteMultipartUploadCommandHandler {
             parts: namedParts(command.input.MultipartUpload?.Parts ?? []),
             completedAt: this.access.now(),
         });
-        await bucket.putObject(object);
+        const version = await bucket.putObject(object);
         bucket.getMultipartUploads().discard(UploadId);
         this.notifications.objectCreated({
             bucket,
             object,
             caller,
             eventName: "s3:ObjectCreated:CompleteMultipartUpload",
+            versionId: version?.versionId,
         });
         return {
             Location: new URL(object.key, uploadedTo(bucket)).href,
             Bucket: bucket.bucketName,
             Key: object.key,
             ETag: simS3QuotedETag(object.etag),
+            ...(version !== undefined && { VersionId: version.versionId }),
             $metadata: {},
         };
     }

package/dist/service/s3/command/copy-object/copy-object.command.d.ts

@@ -25,10 +25,12 @@ export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata {
  *
  * The copy's own ETag and write time arrive nested in `CopyObjectResult`
  * rather than at the top level, because real S3 sends them in the response
- * body and the top-level headers describe the request.
+ * body and the top-level headers describe the request. `VersionId` is the
+ * version the copy was written as, on a Bucket keeping versions.
  */
 export interface SimCopyObjectCommandOutput {
     readonly CopyObjectResult?: SimCopyObjectResult;
+    readonly VersionId?: string | undefined;
     readonly $metadata: SimResponseMetadata;
 }
 /**

package/dist/service/s3/command/copy-object/copy-object.handler.js

@@ -57,18 +57,20 @@ export class CopyObjectCommandHandler {
         const caller = this.destinationAuthorizer.authorize(destination, key, options);
         const stored = await simS3CopySourceObject(source, from.key);
         const object = this.objectBuilder.build(command.input, key, stored);
-        await destination.putObject(object);
+        const version = await destination.putObject(object);
         this.notifications.objectCreated({
             bucket: destination,
             object,
             caller,
             eventName: "s3:ObjectCreated:Copy",
+            versionId: version?.versionId,
         });
         return {
             CopyObjectResult: {
                 ETag: simS3QuotedETag(object.etag),
                 LastModified: object.lastModified,
             },
+            ...(version !== undefined && { VersionId: version.versionId }),
             $metadata: {},
         };
     }

package/dist/service/s3/command/delete-object/delete-object-version-removal.d.ts

@@ -0,0 +1,50 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3ObjectNotifier } from "../../notification/sim-s3-object-notifier.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimDeleteObjectCommandOutput } from "./delete-object.command.js";
+interface DeleteObjectVersionRemovalProperties {
+    readonly notifications: SimS3ObjectNotifier;
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * One request to remove one named version.
+ */
+export interface SimS3VersionRemoval {
+    readonly bucket: SimS3Bucket;
+    readonly key: string;
+    readonly versionId: string;
+    readonly caller: SimAwsResolvedCaller;
+    readonly bypassGovernance: boolean | undefined;
+    readonly options: SimS3RequestOptions | undefined;
+}
+/**
+ * Removes one named version of a key for good.
+ *
+ * Separate from the request-level delete because the two answer differently.
+ * A delete without a version id writes a marker over the current version and
+ * leaves the bytes where they are. This one takes a version away, and only
+ * this one can leave a key with nothing under it on a versioned Bucket. It is
+ * also the only one Object Lock has anything to say about.
+ */
+export declare class DeleteObjectVersionRemoval {
+    private readonly notifications;
+    private readonly objectLock;
+    constructor(properties: DeleteObjectVersionRemovalProperties);
+    /**
+     * Remove the named version, reporting what went.
+     *
+     * Real S3 answers a version that was never there the same way it answers one
+     * it removed, so a version id nothing matches is reported back rather than
+     * raised. Removing a delete marker is reported as such, which is how a
+     * caller undoing a delete knows the marker was what went.
+     *
+     * A version Object Lock is holding is refused with `AccessDenied` before
+     * anything is removed. Naming `BypassGovernanceRetention` gets past a
+     * governance period, and needs `s3:BypassGovernanceRetention` as well as the
+     * `s3:DeleteObject` the request already needed.
+     */
+    remove(request: SimS3VersionRemoval): Promise<SimDeleteObjectCommandOutput>;
+}
+export {};

package/dist/service/s3/command/delete-object/delete-object-version-removal.js

@@ -0,0 +1,52 @@
+import { SimS3ObjectLockAuthorizer } from "../object-lock/sim-s3-object-lock-authorizer.js";
+/**
+ * Removes one named version of a key for good.
+ *
+ * Separate from the request-level delete because the two answer differently.
+ * A delete without a version id writes a marker over the current version and
+ * leaves the bytes where they are. This one takes a version away, and only
+ * this one can leave a key with nothing under it on a versioned Bucket. It is
+ * also the only one Object Lock has anything to say about.
+ */
+export class DeleteObjectVersionRemoval {
+    notifications;
+    objectLock;
+    constructor(properties) {
+        this.notifications = properties.notifications;
+        this.objectLock = new SimS3ObjectLockAuthorizer({ iam: properties.iam });
+    }
+    /**
+     * Remove the named version, reporting what went.
+     *
+     * Real S3 answers a version that was never there the same way it answers one
+     * it removed, so a version id nothing matches is reported back rather than
+     * raised. Removing a delete marker is reported as such, which is how a
+     * caller undoing a delete knows the marker was what went.
+     *
+     * A version Object Lock is holding is refused with `AccessDenied` before
+     * anything is removed. Naming `BypassGovernanceRetention` gets past a
+     * governance period, and needs `s3:BypassGovernanceRetention` as well as the
+     * `s3:DeleteObject` the request already needed.
+     */
+    async remove(request) {
+        const { bucket, key, versionId, caller } = request;
+        const bypassed = this.objectLock.authorizeBypass(bucket, key, request.bypassGovernance, request.options);
+        const removed = await bucket.deleteObjectVersion(key, versionId, bypassed);
+        if (removed !== undefined && !removed.isDeleteMarker) {
+            this.notifications.objectRemoved({
+                bucket,
+                key,
+                caller,
+                eventName: "s3:ObjectRemoved:Delete",
+                // A Bucket keeping no versions raises a record without one, as real S3
+                // does, even where the request named the null version to get here.
+                ...(bucket.getVersions().keepsVersions && { versionId }),
+            });
+        }
+        return {
+            ...(removed?.isDeleteMarker === true && { DeleteMarker: true }),
+            VersionId: versionId,
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/delete-object/delete-object.command.d.ts

@@ -11,13 +11,30 @@ export interface SimDeleteObjectCommand {
 export interface SimDeleteObjectCommandInput {
     readonly Bucket?: string | undefined;
     readonly Key?: string | undefined;
+    /**
+     * The version to remove permanently.
+     *
+     * A request naming none asks for the current version, which a versioned
+     * Bucket answers by writing a delete marker rather than removing anything.
+     */
+    readonly VersionId?: string | undefined;
+    /**
+     * Whether to get past a governance retention period holding the named
+     * version, which the caller also needs `s3:BypassGovernanceRetention` for.
+     *
+     * A compliance period and a legal hold have no bypass, so this changes
+     * nothing for either.
+     */
+    readonly BypassGovernanceRetention?: boolean | undefined;
 }
 /**
  * Minimal structural sim S3 DeleteObject output.
  *
- * Real S3 reports `DeleteMarker` and `VersionId` on a versioned Bucket. Sim S3
- * does not model versioning, so neither appears here.
+ * `DeleteMarker` and `VersionId` describe what a versioned Bucket did. A
+ * Bucket without versioning carries neither, as real S3 does.
  */
 export interface SimDeleteObjectCommandOutput {
+    readonly DeleteMarker?: boolean | undefined;
+    readonly VersionId?: string | undefined;
     readonly $metadata: SimResponseMetadata;
 }

package/dist/service/s3/command/delete-object/delete-object.handler.d.ts

@@ -21,13 +21,19 @@ export declare class DeleteObjectCommandHandler implements CommandHandler<SimDel
     private readonly authorizer;
     private readonly background;
     private readonly notifications;
+    private readonly versionRemoval;
     constructor(properties: DeleteObjectCommandHandlerProperties);
     /**
      * Authorize and remove an Object from a Bucket.
      *
-     * A missing Bucket is reported, but a missing key is not: real S3 answers a
+     * A missing Bucket is reported, but a missing key is not. Real S3 answers a
      * deletion the same way whether or not the Object was there, so code that
      * deletes something twice sees the same success both times.
+     *
+     * A `VersionId` asks for that one version and removes it for good. A request
+     * without one asks for the current version, which a versioned Bucket answers
+     * by writing a delete marker over it. Object Lock holds a named version and
+     * never the marker, since a marker hides an Object without losing it.
      */
     handle(command: SimDeleteObjectCommand, options?: SimS3RequestOptions): Promise<SimDeleteObjectCommandOutput>;
 }

package/dist/service/s3/command/delete-object/delete-object.handler.js

@@ -3,6 +3,8 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
 import { DeleteObjectAuthorizer } from "./delete-object-authorizer.js";
+import { DeleteObjectVersionRemoval } from "./delete-object-version-removal.js";
+import { simS3NotifyDeleted } from "./sim-s3-notify-deleted.js";
 /**
  * Simulated S3 DeleteObjectCommand handler.
  *
@@ -13,40 +15,50 @@ export class DeleteObjectCommandHandler {
     authorizer;
     background;
     notifications;
+    versionRemoval;
     constructor(properties) {
         const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
         this.buckets = buckets;
         this.authorizer = new DeleteObjectAuthorizer({ iam });
         this.background = background;
         this.notifications = properties.notifications;
+        this.versionRemoval = new DeleteObjectVersionRemoval({
+            notifications: properties.notifications,
+            iam,
+        });
     }
     /**
      * Authorize and remove an Object from a Bucket.
      *
-     * A missing Bucket is reported, but a missing key is not: real S3 answers a
+     * A missing Bucket is reported, but a missing key is not. Real S3 answers a
      * deletion the same way whether or not the Object was there, so code that
      * deletes something twice sees the same success both times.
+     *
+     * A `VersionId` asks for that one version and removes it for good. A request
+     * without one asks for the current version, which a versioned Bucket answers
+     * by writing a delete marker over it. Object Lock holds a named version and
+     * never the marker, since a marker hides an Object without losing it.
      */
     async handle(command, options) {
-        assertDefined(command.input.Bucket, "DeleteObjectCommand.input.Bucket");
-        assertDefined(command.input.Key, "DeleteObjectCommand.input.Key");
-        const bucketName = command.input.Bucket;
-        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        const { Bucket, Key, VersionId, BypassGovernanceRetention } = command.input;
+        assertDefined(Bucket, "DeleteObjectCommand.input.Bucket");
+        assertDefined(Key, "DeleteObjectCommand.input.Key");
+        const bucket = requireSimS3Bucket(this.buckets, Bucket);
         await this.background.sequence();
-        const caller = this.authorizer.authorize(bucket, command.input.Key, options);
-        const removed = await bucket.deleteObject(command.input.Key);
-        // A deletion that removed nothing is not an event: real S3 raises
-        // ObjectRemoved for an Object that was deleted, not for a request to
-        // delete one.
-        if (removed) {
-            this.notifications.objectRemoved({
+        const caller = this.authorizer.authorize(bucket, Key, options);
+        if (VersionId !== undefined) {
+            return await this.versionRemoval.remove({
                 bucket,
-                key: command.input.Key,
+                key: Key,
+                versionId: VersionId,
                 caller,
+                bypassGovernance: BypassGovernanceRetention,
+                options,
             });
         }
-        return {
-            $metadata: {},
-        };
+        const deletion = await bucket.deleteObject(Key);
+        const notifications = this.notifications;
+        simS3NotifyDeleted({ notifications, bucket, key: Key, caller, deletion });
+        return { ...deletion.reported, $metadata: {} };
     }
 }

package/dist/service/s3/command/delete-object/sim-s3-notify-deleted.d.ts

@@ -0,0 +1,24 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3ObjectDeletion } from "../../bucket/sim-s3-object-deletion.js";
+import type { SimS3ObjectNotifier } from "../../notification/sim-s3-object-notifier.js";
+interface SimS3NotifyDeletedProperties {
+    readonly notifications: SimS3ObjectNotifier;
+    readonly bucket: SimS3Bucket;
+    readonly key: string;
+    readonly caller: SimAwsResolvedCaller;
+    readonly deletion: SimS3ObjectDeletion;
+}
+/**
+ * Raise the event a delete earned, if it earned one.
+ *
+ * Three outcomes and three different events, which is why every delete path
+ * comes through here rather than deciding for itself. A versioned Bucket wrote
+ * a marker, so the event is `s3:ObjectRemoved:DeleteMarkerCreated` and carries
+ * the marker's version id. A Bucket without versioning lost the Object, so it
+ * is `s3:ObjectRemoved:Delete`. A delete that removed nothing raises neither,
+ * because real S3 raises ObjectRemoved for an Object that was deleted rather
+ * than for a request to delete one.
+ */
+export declare function simS3NotifyDeleted(properties: SimS3NotifyDeletedProperties): void;
+export {};

package/dist/service/s3/command/delete-object/sim-s3-notify-deleted.js

@@ -0,0 +1,32 @@
+/**
+ * Raise the event a delete earned, if it earned one.
+ *
+ * Three outcomes and three different events, which is why every delete path
+ * comes through here rather than deciding for itself. A versioned Bucket wrote
+ * a marker, so the event is `s3:ObjectRemoved:DeleteMarkerCreated` and carries
+ * the marker's version id. A Bucket without versioning lost the Object, so it
+ * is `s3:ObjectRemoved:Delete`. A delete that removed nothing raises neither,
+ * because real S3 raises ObjectRemoved for an Object that was deleted rather
+ * than for a request to delete one.
+ */
+export function simS3NotifyDeleted(properties) {
+    const { notifications, bucket, key, caller, deletion } = properties;
+    if (deletion.deleteMarker !== undefined) {
+        notifications.objectRemoved({
+            bucket,
+            key,
+            caller,
+            eventName: "s3:ObjectRemoved:DeleteMarkerCreated",
+            versionId: deletion.deleteMarker.versionId,
+        });
+        return;
+    }
+    if (deletion.removedObject) {
+        notifications.objectRemoved({
+            bucket,
+            key,
+            caller,
+            eventName: "s3:ObjectRemoved:Delete",
+        });
+    }
+}

package/dist/service/s3/command/delete-objects/delete-object-attempt.d.ts

@@ -1,11 +1,15 @@
+import type { SimS3ObjectVersion } from "../../bucket/versioning/sim-s3-object-version.js";
 /**
  * What one key of a DeleteObjects request came to.
  *
  * A batch deletion carries on past a key it could not remove, so the failure
- * travels with the key it belongs to rather than being raised.
+ * travels with the key it belongs to rather than being raised. So does the
+ * delete marker, which a versioned Bucket reports per key alongside the id it
+ * was written under.
  */
 export declare class DeleteObjectAttempt {
     readonly key: string;
     readonly error: unknown;
-    constructor(key: string, error?: unknown);
+    readonly deleteMarker: SimS3ObjectVersion | undefined;
+    constructor(key: string, error?: unknown, deleteMarker?: SimS3ObjectVersion);
 }