@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-fields.js

@@ -5,10 +5,11 @@
  * timing after it, where the request nests both. It carries the noncurrent
  * expiry both ways, as the nested object the request takes and as the older
  * `NoncurrentVersionExpirationInDays` beside it, which is what CDK's
- * `noncurrentVersionExpiration` synthesises. Everything absent from here,
- * `Status`, `Prefix`, `AbortIncompleteMultipartUpload`, `TagFilters` and the
- * object size bounds among them, is spelled the same way in both and goes
- * through untouched.
+ * `noncurrentVersionExpiration` synthesises. It also puts the tags a rule
+ * filters on beside the rule's `Prefix`, where the request holds both inside a
+ * `Filter`. Everything absent from here, `Status`,
+ * `AbortIncompleteMultipartUpload` and the object size bounds among them, is
+ * spelled the same way in both and goes through untouched.
  */
 export const simCfnS3TranslatedLifecycleFields = new Set([
     "Id",
@@ -17,6 +18,7 @@ export const simCfnS3TranslatedLifecycleFields = new Set([
     "ExpiredObjectDeleteMarker",
     "NoncurrentVersionExpiration",
     "NoncurrentVersionExpirationInDays",
+    "TagFilters",
     "Transition",
     "Transitions",
 ]);
@@ -50,7 +52,12 @@ export function simCfnS3StatedFields(fields) {
  * acts on anyway.
  */
 export function simCfnS3CarriedRuleFields(rule) {
-    return Object.fromEntries(Object.entries(rule).filter(([name]) => !simCfnS3TranslatedLifecycleFields.has(name)));
+    // A rule filtering on tags carries its prefix inside the `Filter` built from
+    // them, and real S3 refuses a rule stating a `Prefix` alongside one.
+    const translated = rule["TagFilters"] === undefined
+        ? simCfnS3TranslatedLifecycleFields
+        : new Set([...simCfnS3TranslatedLifecycleFields, "Prefix"]);
+    return Object.fromEntries(Object.entries(rule).filter(([name]) => !translated.has(name)));
 }
 /**
  * The three flattened expiry fields, gathered under the one the request

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-filter.d.ts

@@ -0,0 +1,21 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
+interface SimCfnS3LifecycleFilterProperties {
+    readonly shape: SimCfnValueShape;
+    readonly rule: SimCfnTemplateValueRecord;
+    readonly path: string;
+}
+/**
+ * The `Filter` a rule's `TagFilters` states.
+ *
+ * CloudFormation puts the tags a rule filters on beside its `Prefix`, where the
+ * request holds both inside a `Filter`, so a rule stating tags is read into the
+ * shape the request takes. One tag and no prefix becomes a bare `Tag`, and
+ * anything more an `And` holding the prefix and the tags together, which is
+ * what real S3 requires of a rule scoped by more than one condition.
+ *
+ * A rule stating no tags keeps its `Prefix` where CloudFormation put it, and
+ * gets no `Filter` at all.
+ */
+export declare function readSimCfnS3LifecycleFilter(properties: SimCfnS3LifecycleFilterProperties): SimCfnTemplateValue | undefined;
+export {};

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-filter.js

@@ -0,0 +1,30 @@
+/**
+ * The `Filter` a rule's `TagFilters` states.
+ *
+ * CloudFormation puts the tags a rule filters on beside its `Prefix`, where the
+ * request holds both inside a `Filter`, so a rule stating tags is read into the
+ * shape the request takes. One tag and no prefix becomes a bare `Tag`, and
+ * anything more an `And` holding the prefix and the tags together, which is
+ * what real S3 requires of a rule scoped by more than one condition.
+ *
+ * A rule stating no tags keeps its `Prefix` where CloudFormation put it, and
+ * gets no `Filter` at all.
+ */
+export function readSimCfnS3LifecycleFilter(properties) {
+    const { shape, rule, path } = properties;
+    const declared = rule["TagFilters"];
+    if (declared === undefined) {
+        return undefined;
+    }
+    const tags = shape
+        .list(declared, `${path} TagFilters`)
+        .map((tag, index) => shape.record(tag, `${path} TagFilters[${index}]`));
+    const prefix = rule["Prefix"];
+    const only = tags.length === 1 ? tags[0] : undefined;
+    if (prefix === undefined && only !== undefined) {
+        return { Tag: only };
+    }
+    return {
+        And: { ...(prefix !== undefined && { Prefix: prefix }), Tags: tags },
+    };
+}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-configurator.js

@@ -43,6 +43,7 @@ export class SimCfnS3BucketConfigurator {
         await this.declared.applyVersioning();
         await this.declared.applyObjectLock();
         await this.declared.applyLifecycle();
+        await this.declared.applyEncryption();
         await this.configureNotifications();
     }
     /**

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-declared-configurations.d.ts

@@ -12,7 +12,7 @@ interface SimCfnS3BucketDeclaredConfigurationsProperties {
  * The AWS::S3::Bucket properties that are read straight off the Resource and
  * handed to a command.
  *
- * Five properties with one shape between them. Each is read from the Resource,
+ * Six properties with one shape between them. Each is read from the Resource,
  * left alone where the Resource omitted it, and otherwise applied through the
  * command an SDK caller would reach, so a template and an SDK caller are
  * validated identically. The event notification configuration is the one that
@@ -51,6 +51,19 @@ export declare class SimCfnS3BucketDeclaredConfigurations {
      * Apply the lifecycle rules the Resource declares.
      */
     applyLifecycle(): Promise<void>;
+    /**
+     * Apply the default encryption the Resource declares.
+     */
+    applyEncryption(): Promise<void>;
+    /**
+     * Apply one declared property, or leave the Bucket alone where the Resource
+     * omitted it.
+     *
+     * The one absence check for all six of them lives here. Each property is
+     * otherwise the same shape: read it off the Resource, and hand it to the
+     * command an SDK caller would reach.
+     */
+    private applyDeclared;
     /**
      * Read one declared property, or nothing where the Resource omitted it.
      *

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-declared-configurations.js

@@ -1,3 +1,4 @@
+import { SimCfnS3BucketEncryption } from "./encryption/sim-cfn-s3-bucket-encryption.js";
 import { SimCfnS3BucketLifecycleConfiguration } from "./lifecycle/sim-cfn-s3-bucket-lifecycle-configuration.js";
 import { SimCfnS3BucketObjectLockConfiguration } from "./lock/sim-cfn-s3-bucket-object-lock-configuration.js";
 import { SimCfnS3BucketPublicAccessConfiguration } from "./public-access/sim-cfn-s3-bucket-public-access-configuration.js";
@@ -7,7 +8,7 @@ import { SimCfnS3BucketWebsiteConfiguration } from "./website/sim-cfn-s3-bucket-
  * The AWS::S3::Bucket properties that are read straight off the Resource and
  * handed to a command.
  *
- * Five properties with one shape between them. Each is read from the Resource,
+ * Six properties with one shape between them. Each is read from the Resource,
  * left alone where the Resource omitted it, and otherwise applied through the
  * command an SDK caller would reach, so a template and an SDK caller are
  * validated identically. The event notification configuration is the one that
@@ -31,28 +32,27 @@ export class SimCfnS3BucketDeclaredConfigurations {
      * Apply the website configuration the Resource declares.
      */
     async applyWebsite() {
-        const WebsiteConfiguration = this.read(SimCfnS3BucketWebsiteConfiguration);
-        if (WebsiteConfiguration !== undefined) {
+        await this.applyDeclared(SimCfnS3BucketWebsiteConfiguration, async (WebsiteConfiguration) => {
             await this.simS3.putBucketWebsite({ input: { Bucket: this.bucketName, WebsiteConfiguration } }, this.options);
-        }
+        });
     }
     /**
      * Apply the Block Public Access settings the Resource declares.
      */
     async applyPublicAccess() {
-        const PublicAccessBlockConfiguration = this.read(SimCfnS3BucketPublicAccessConfiguration);
-        if (PublicAccessBlockConfiguration !== undefined) {
-            await this.simS3.putPublicAccessBlock({ input: { Bucket: this.bucketName, PublicAccessBlockConfiguration } }, this.options);
-        }
+        await this.applyDeclared(SimCfnS3BucketPublicAccessConfiguration, async (PublicAccessBlockConfiguration) => {
+            await this.simS3.putPublicAccessBlock({
+                input: { Bucket: this.bucketName, PublicAccessBlockConfiguration },
+            }, this.options);
+        });
     }
     /**
      * Apply the versioning configuration the Resource declares.
      */
     async applyVersioning() {
-        const VersioningConfiguration = this.read(SimCfnS3BucketVersioningConfiguration);
-        if (VersioningConfiguration !== undefined) {
+        await this.applyDeclared(SimCfnS3BucketVersioningConfiguration, async (VersioningConfiguration) => {
             await this.simS3.putBucketVersioning({ input: { Bucket: this.bucketName, VersioningConfiguration } }, this.options);
-        }
+        });
     }
     /**
      * Apply the Object Lock configuration the Resource declares.
@@ -63,18 +63,43 @@ export class SimCfnS3BucketDeclaredConfigurations {
      * the words an SDK caller is refused in.
      */
     async applyObjectLock() {
-        const ObjectLockConfiguration = this.read(SimCfnS3BucketObjectLockConfiguration);
-        if (ObjectLockConfiguration !== undefined) {
+        await this.applyDeclared(SimCfnS3BucketObjectLockConfiguration, async (ObjectLockConfiguration) => {
             await this.simS3.putObjectLockConfiguration({ input: { Bucket: this.bucketName, ObjectLockConfiguration } }, this.options);
-        }
+        });
     }
     /**
      * Apply the lifecycle rules the Resource declares.
      */
     async applyLifecycle() {
-        const LifecycleConfiguration = this.read(SimCfnS3BucketLifecycleConfiguration);
-        if (LifecycleConfiguration !== undefined) {
+        await this.applyDeclared(SimCfnS3BucketLifecycleConfiguration, async (LifecycleConfiguration) => {
             await this.simS3.putBucketLifecycleConfiguration({ input: { Bucket: this.bucketName, LifecycleConfiguration } }, this.options);
+        });
+    }
+    /**
+     * Apply the default encryption the Resource declares.
+     */
+    async applyEncryption() {
+        await this.applyDeclared(SimCfnS3BucketEncryption, async (ServerSideEncryptionConfiguration) => {
+            await this.simS3.putBucketEncryption({
+                input: {
+                    Bucket: this.bucketName,
+                    ServerSideEncryptionConfiguration,
+                },
+            }, this.options);
+        });
+    }
+    /**
+     * Apply one declared property, or leave the Bucket alone where the Resource
+     * omitted it.
+     *
+     * The one absence check for all six of them lives here. Each property is
+     * otherwise the same shape: read it off the Resource, and hand it to the
+     * command an SDK caller would reach.
+     */
+    async applyDeclared(Reader, apply) {
+        const declared = this.read(Reader);
+        if (declared !== undefined) {
+            await apply(declared);
         }
     }
     /**

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-names.d.ts

@@ -5,11 +5,9 @@ export declare const simulatedPropertyNames: ReadonlySet<string>;
 /**
  * Real AWS::S3::Bucket properties this simulation reads and does nothing with.
  *
- * Nothing this simulator models can tell the difference. There is no simulated
- * KMS and Object bytes are stored as they arrive, so an encrypted Bucket and an
- * unencrypted one answer every simulated command identically, and no simulated
- * service reads a Bucket tag. So these are not recorded as ignored either: a
- * report of differences that make no difference is one nobody can read.
+ * Nothing this simulator models can tell the difference. No simulated service
+ * reads a Bucket tag, so this is not recorded as ignored either: a report of
+ * differences that make no difference is one nobody can read.
  */
 export declare const inertPropertyNames: ReadonlySet<string>;
 import type { SimCfnSkippedPropertyRules } from "../../../cloudformation/resource/ignore/sim-cfn-skipped-property.type.js";

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-names.js

@@ -2,6 +2,7 @@
  * The AWS::S3::Bucket properties this simulation acts on.
  */
 export const simulatedPropertyNames = new Set([
+    "BucketEncryption",
     "BucketName",
     "LifecycleConfiguration",
     "ObjectLockConfiguration",
@@ -14,16 +15,11 @@ export const simulatedPropertyNames = new Set([
 /**
  * Real AWS::S3::Bucket properties this simulation reads and does nothing with.
  *
- * Nothing this simulator models can tell the difference. There is no simulated
- * KMS and Object bytes are stored as they arrive, so an encrypted Bucket and an
- * unencrypted one answer every simulated command identically, and no simulated
- * service reads a Bucket tag. So these are not recorded as ignored either: a
- * report of differences that make no difference is one nobody can read.
+ * Nothing this simulator models can tell the difference. No simulated service
+ * reads a Bucket tag, so this is not recorded as ignored either: a report of
+ * differences that make no difference is one nobody can read.
  */
-export const inertPropertyNames = new Set([
-    "BucketEncryption",
-    "Tags",
-]);
+export const inertPropertyNames = new Set(["Tags"]);
 import { validateSimCfnS3BucketReplication } from "./replication/sim-cfn-s3-bucket-replication-rules.js";
 /**
  * Real AWS::S3::Bucket properties this simulation does not model, with what
@@ -55,7 +51,8 @@ export const unsimulatedPropertyReasons = new Map([
     ],
     [
         "IntelligentTieringConfigurations",
-        "storage classes are not simulated, so nothing transitions between them",
+        "Objects are not moved between storage classes by access pattern, and " +
+            "only a lifecycle rule transitions one",
     ],
     ["InventoryConfigurations", "Bucket inventory reports are not simulated"],
     ["LoggingConfiguration", "server access logging is not simulated"],

package/dist/service/s3/command/authorize/sim-s3-authorize-action.d.ts

@@ -1,3 +1,4 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
 import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
@@ -20,5 +21,9 @@ export interface SimS3AuthorizedAction {
  * supplied as the condition keys a Bucket policy is usually written against.
  * An omitted caller is passed through to sim IAM, so Account root fallback
  * stays owned by IAM.
+ *
+ * The resolved caller is answered rather than discarded, because this is the
+ * only point in a request where the principal has been worked out, and an
+ * Object event notification has to say who caused it.
  */
-export declare function simS3AuthorizeAction(request: SimS3AuthorizedAction): void;
+export declare function simS3AuthorizeAction(request: SimS3AuthorizedAction): SimAwsResolvedCaller;

package/dist/service/s3/command/authorize/sim-s3-authorize-action.js

@@ -9,6 +9,10 @@ import { simS3ConditionContext } from "./sim-s3-condition-context.js";
  * supplied as the condition keys a Bucket policy is usually written against.
  * An omitted caller is passed through to sim IAM, so Account root fallback
  * stays owned by IAM.
+ *
+ * The resolved caller is answered rather than discarded, because this is the
+ * only point in a request where the principal has been worked out, and an
+ * Object event notification has to say who caused it.
  */
 export function simS3AuthorizeAction(request) {
     const { iam, action, resource, bucket, options } = request;
@@ -27,4 +31,5 @@ export function simS3AuthorizeAction(request) {
             resource,
         });
     }
+    return decision.caller;
 }

package/dist/service/s3/command/copy-object/copy-object-builder.d.ts

@@ -1,5 +1,6 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import { SimS3Object } from "../../object/s3-object.js";
+import type { SimS3ServerSideEncryption } from "../../object/s3-server-side-encryption.js";
 import type { SimCopyObjectCommandInput } from "./copy-object.command.js";
 interface CopyObjectBuilderProperties {
     readonly clock: SimClock;
@@ -27,7 +28,15 @@ export declare class CopyObjectBuilder {
      * its own to carry. An Object uploaded in parts keeps the multipart ETag it
      * was given, and real S3 rewrites a copy of one as a single part. The copy's
      * ETag is therefore the plain digest of its bytes.
+     *
+     * The storage class and the encryption come from the request and the
+     * destination Bucket. Real S3 stores a copy in the default class where the
+     * request names none, whatever class the source was in.
+     *
+     * The tags come from the source unless the request asked to replace them,
+     * which is the other way round from the metadata: real S3 copies tags by
+     * default and takes `TaggingDirective: REPLACE` to be told otherwise.
      */
-    build(input: SimCopyObjectCommandInput, key: string, source: SimS3Object): SimS3Object;
+    build(input: SimCopyObjectCommandInput, key: string, source: SimS3Object, destinationEncryption: SimS3ServerSideEncryption): SimS3Object;
 }
 export {};

package/dist/service/s3/command/copy-object/copy-object-builder.js

@@ -1,5 +1,7 @@
 import { SimS3Object } from "../../object/s3-object.js";
 import { simS3WriteMetadata } from "../../object/s3-write-metadata.js";
+import { simS3WriteEncryption, simS3WriteStorageClass, } from "../../object/s3-write-storage.js";
+import { simS3WriteTags } from "../../object/s3-write-tagging.js";
 /**
  * Builds the Object a copy stores at its destination.
  *
@@ -25,15 +27,29 @@ export class CopyObjectBuilder {
      * its own to carry. An Object uploaded in parts keeps the multipart ETag it
      * was given, and real S3 rewrites a copy of one as a single part. The copy's
      * ETag is therefore the plain digest of its bytes.
+     *
+     * The storage class and the encryption come from the request and the
+     * destination Bucket. Real S3 stores a copy in the default class where the
+     * request names none, whatever class the source was in.
+     *
+     * The tags come from the source unless the request asked to replace them,
+     * which is the other way round from the metadata: real S3 copies tags by
+     * default and takes `TaggingDirective: REPLACE` to be told otherwise.
      */
-    build(input, key, source) {
+    build(input, key, source, destinationEncryption) {
+        const storageClass = simS3WriteStorageClass(input, "CopyObjectCommand");
         return new SimS3Object({
             key,
             body: Buffer.from(source.body),
             metadata: input.MetadataDirective === "REPLACE"
                 ? simS3WriteMetadata(input)
                 : source.metadata,
+            tags: input.TaggingDirective === "REPLACE"
+                ? simS3WriteTags(input, "CopyObjectCommand")
+                : source.tags,
             lastModified: this.clock.now(),
+            ...(storageClass !== undefined && { storageClass }),
+            serverSideEncryption: simS3WriteEncryption(input, destinationEncryption, "CopyObjectCommand"),
         });
     }
 }

package/dist/service/s3/command/copy-object/copy-object.command.d.ts

@@ -1,5 +1,7 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimS3ObjectWriteMetadata } from "../../object/s3-write-metadata.js";
+import type { SimS3ObjectWriteStorage } from "../../object/s3-write-storage.js";
+import type { SimS3ObjectWriteTagging } from "../../object/s3-write-tagging.js";
 /**
  * Minimal structural sim S3 CopyObject command.
  */
@@ -13,12 +15,18 @@ export interface SimCopyObjectCommand {
  * apply to the destination Object under `MetadataDirective: REPLACE`. Under
  * the default `COPY` they are ignored, as real S3 ignores them.
  */
-export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata {
+export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging {
     readonly Bucket?: string | undefined;
     readonly Key?: string | undefined;
     /** The source Object, as `sourceBucket/sourceKey`, URL-encoded. */
     readonly CopySource?: string | undefined;
     readonly MetadataDirective?: string | undefined;
+    /**
+     * Whether the copy carries the source Object's tags or the request's own.
+     * `REPLACE` takes the request's `Tagging`, and anything else leaves the copy
+     * carrying what the source carried.
+     */
+    readonly TaggingDirective?: string | undefined;
 }
 /**
  * Minimal structural sim S3 CopyObject output.
@@ -31,6 +39,8 @@ export interface SimCopyObjectCommandInput extends SimS3ObjectWriteMetadata {
 export interface SimCopyObjectCommandOutput {
     readonly CopyObjectResult?: SimCopyObjectResult;
     readonly VersionId?: string | undefined;
+    /** The encryption S3 stamped on the copy it stored. */
+    readonly ServerSideEncryption?: string | undefined;
     readonly $metadata: SimResponseMetadata;
 }
 /**

package/dist/service/s3/command/copy-object/copy-object.handler.js

@@ -56,7 +56,7 @@ export class CopyObjectCommandHandler {
         this.sourceAuthorizer.authorize(source, from.key, options);
         const caller = this.destinationAuthorizer.authorize(destination, key, options);
         const stored = await simS3CopySourceObject(source, from.key);
-        const object = this.objectBuilder.build(command.input, key, stored);
+        const object = this.objectBuilder.build(command.input, key, stored, destination.getEncryption().algorithm);
         const version = await destination.putObject(object);
         this.notifications.objectCreated({
             bucket: destination,
@@ -71,6 +71,7 @@ export class CopyObjectCommandHandler {
                 LastModified: object.lastModified,
             },
             ...(version !== undefined && { VersionId: version.versionId }),
+            ServerSideEncryption: object.serverSideEncryption,
             $metadata: {},
         };
     }

package/dist/service/s3/command/create-multipart-upload/create-multipart-upload.command.d.ts

@@ -1,5 +1,7 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimS3ObjectWriteMetadata } from "../../object/s3-write-metadata.js";
+import type { SimS3ObjectWriteStorage } from "../../object/s3-write-storage.js";
+import type { SimS3ObjectWriteTagging } from "../../object/s3-write-tagging.js";
 /**
  * Minimal structural sim S3 CreateMultipartUpload command.
  */
@@ -12,7 +14,7 @@ export interface SimCreateMultipartUploadCommand {
  * This is the request that says what the Object will be, so it carries the same
  * metadata members a `PutObject` does. None of the Object's bytes arrive here.
  */
-export interface SimCreateMultipartUploadCommandInput extends SimS3ObjectWriteMetadata {
+export interface SimCreateMultipartUploadCommandInput extends SimS3ObjectWriteMetadata, SimS3ObjectWriteStorage, SimS3ObjectWriteTagging {
     readonly Bucket?: string | undefined;
     readonly Key?: string | undefined;
 }
@@ -23,6 +25,8 @@ export interface SimCreateMultipartUploadCommandInput extends SimS3ObjectWriteMe
  */
 export interface SimCreateMultipartUploadCommandOutput {
     readonly Bucket?: string;
+    /** The encryption S3 will stamp on the Object the upload completes into. */
+    readonly ServerSideEncryption?: string | undefined;
     readonly Key?: string;
     readonly UploadId?: string;
     readonly $metadata: SimResponseMetadata;

package/dist/service/s3/command/create-multipart-upload/create-multipart-upload.handler.js

@@ -1,5 +1,7 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { simS3WriteMetadata } from "../../object/s3-write-metadata.js";
+import { simS3WriteEncryption, simS3WriteStorageClass, } from "../../object/s3-write-storage.js";
+import { simS3WriteTags } from "../../object/s3-write-tagging.js";
 import { SimS3MultipartAccess, } from "../multipart/sim-s3-multipart-access.js";
 /**
  * Simulated S3 CreateMultipartUploadCommand handler.
@@ -22,15 +24,20 @@ export class CreateMultipartUploadCommandHandler {
         assertDefined(Bucket, "CreateMultipartUploadCommand.input.Bucket");
         assertDefined(Key, "CreateMultipartUploadCommand.input.Key");
         const { bucket } = await this.access.reach(Bucket, Key, options);
+        const storageClass = simS3WriteStorageClass(command.input, "CreateMultipartUploadCommand");
         const upload = bucket.getMultipartUploads().start({
             key: Key,
             metadata: simS3WriteMetadata(command.input),
+            tags: simS3WriteTags(command.input, "CreateMultipartUploadCommand"),
             initiated: this.access.now(),
+            ...(storageClass !== undefined && { storageClass }),
+            serverSideEncryption: simS3WriteEncryption(command.input, bucket.getEncryption().algorithm, "CreateMultipartUploadCommand"),
         });
         return {
             Bucket: bucket.bucketName,
             Key: upload.key,
             UploadId: upload.uploadId,
+            ServerSideEncryption: upload.serverSideEncryption,
             $metadata: {},
         };
     }

package/dist/service/s3/command/delete-bucket-encryption/delete-bucket-encryption.command.d.ts

@@ -0,0 +1,19 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim S3 DeleteBucketEncryption command.
+ */
+export interface SimDeleteBucketEncryptionCommand {
+    readonly input: SimDeleteBucketEncryptionCommandInput;
+}
+/**
+ * Minimal structural sim S3 DeleteBucketEncryption input.
+ */
+export interface SimDeleteBucketEncryptionCommandInput {
+    readonly Bucket?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 DeleteBucketEncryption output.
+ */
+export interface SimDeleteBucketEncryptionCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/delete-bucket-encryption/delete-bucket-encryption.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/delete-bucket-encryption/delete-bucket-encryption.handler.d.ts

@@ -0,0 +1,30 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimDeleteBucketEncryptionCommand, SimDeleteBucketEncryptionCommandOutput } from "./delete-bucket-encryption.command.js";
+interface DeleteBucketEncryptionHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated S3 DeleteBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteBucketEncryptionCommand/
+ */
+export declare class DeleteBucketEncryptionCommandHandler implements CommandHandler<SimDeleteBucketEncryptionCommand, SimDeleteBucketEncryptionCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: DeleteBucketEncryptionHandlerProperties);
+    /**
+     * Authorize and put a Bucket back to the encryption every Bucket has.
+     *
+     * Real S3 leaves the Bucket SSE-S3 encrypted rather than unencrypted, and
+     * the request is idempotent, so this reports nothing about what was there.
+     */
+    handle(command: SimDeleteBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<SimDeleteBucketEncryptionCommandOutput>;
+}
+export {};

package/dist/service/s3/command/delete-bucket-encryption/delete-bucket-encryption.handler.js

@@ -0,0 +1,38 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3EncryptionAuthorizer } from "../encryption/sim-s3-encryption-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 DeleteBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteBucketEncryptionCommand/
+ */
+export class DeleteBucketEncryptionCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3EncryptionAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and put a Bucket back to the encryption every Bucket has.
+     *
+     * Real S3 leaves the Bucket SSE-S3 encrypted rather than unencrypted, and
+     * the request is idempotent, so this reports nothing about what was there.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "DeleteBucketEncryptionCommand.input.Bucket");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeWrite(bucket, options);
+        bucket.deleteEncryption();
+        return {
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/delete-object-tagging/delete-object-tagging.command.d.ts

@@ -0,0 +1,23 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim S3 DeleteObjectTagging command.
+ */
+export interface SimDeleteObjectTaggingCommand {
+    readonly input: SimDeleteObjectTaggingCommandInput;
+}
+/**
+ * Minimal structural sim S3 DeleteObjectTagging input.
+ */
+export interface SimDeleteObjectTaggingCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly Key?: string | undefined;
+    /** The version to untag. A request naming none untags the current one. */
+    readonly VersionId?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 DeleteObjectTagging output.
+ */
+export interface SimDeleteObjectTaggingCommandOutput {
+    readonly VersionId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/delete-object-tagging/delete-object-tagging.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/delete-object-tagging/delete-object-tagging.handler.d.ts

@@ -0,0 +1,22 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type SimS3ObjectTaggingAccessProperties } from "../tagging/sim-s3-object-tagging-access.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimDeleteObjectTaggingCommand, SimDeleteObjectTaggingCommandOutput } from "./delete-object-tagging.command.js";
+/**
+ * Simulated S3 DeleteObjectTaggingCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteObjectTaggingCommand/
+ */
+export declare class DeleteObjectTaggingCommandHandler implements CommandHandler<SimDeleteObjectTaggingCommand, SimDeleteObjectTaggingCommandOutput> {
+    private readonly access;
+    constructor(properties: SimS3ObjectTaggingAccessProperties);
+    /**
+     * Take every tag off an Object, or off the version the request named.
+     *
+     * Real S3 removes the whole tag set and answers the same way whether or not
+     * the Object was carrying one, so an Object nobody had tagged is not an
+     * error. The event is raised either way, because the request is what real S3
+     * raises it for.
+     */
+    handle(command: SimDeleteObjectTaggingCommand, options?: SimS3RequestOptions): Promise<SimDeleteObjectTaggingCommandOutput>;
+}