@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/s3/command/sim-s3-command.types.d.ts

@@ -16,7 +16,10 @@ export type { SimDeletePublicAccessBlockCommand, SimDeletePublicAccessBlockComma
 export type { SimDeleteBucketLifecycleCommand, SimDeleteBucketLifecycleCommandOutput, } from "./delete-bucket-lifecycle/delete-bucket-lifecycle.command.js";
 export type { SimGetBucketLifecycleConfigurationCommand, SimGetBucketLifecycleConfigurationCommandOutput, } from "./get-bucket-lifecycle-configuration/get-bucket-lifecycle-configuration.command.js";
 export type { SimPutBucketLifecycleConfigurationCommand, SimPutBucketLifecycleConfigurationCommandOutput, SimS3LifecycleConfiguration, SimS3LifecycleRule, } from "./put-bucket-lifecycle-configuration/put-bucket-lifecycle-configuration.command.js";
+export type { SimDeleteBucketEncryptionCommand, SimDeleteBucketEncryptionCommandOutput, } from "./delete-bucket-encryption/delete-bucket-encryption.command.js";
+export type { SimGetBucketEncryptionCommand, SimGetBucketEncryptionCommandOutput, } from "./get-bucket-encryption/get-bucket-encryption.command.js";
 export type { SimGetBucketVersioningCommand, SimGetBucketVersioningCommandOutput, } from "./get-bucket-versioning/get-bucket-versioning.command.js";
+export type { SimPutBucketEncryptionCommand, SimPutBucketEncryptionCommandOutput, } from "./put-bucket-encryption/put-bucket-encryption.command.js";
 export type { SimPutBucketVersioningCommand, SimPutBucketVersioningCommandOutput, } from "./put-bucket-versioning/put-bucket-versioning.command.js";
 export type { SimListObjectVersionsCommand, SimListObjectVersionsCommandOutput, SimS3DeleteMarkerSummary, SimS3ObjectVersionSummary, } from "./list-object-versions/list-object-versions.command.js";
 export type { SimGetBucketPolicyCommand, SimGetBucketPolicyCommandOutput, } from "./get-bucket-policy/get-bucket-policy.command.js";
@@ -41,3 +44,6 @@ export type { SimPutObjectLockConfigurationCommand, SimPutObjectLockConfiguratio
 export type { SimGetObjectLockConfigurationCommand, SimGetObjectLockConfigurationCommandInput, SimGetObjectLockConfigurationCommandOutput, } from "./get-object-lock-configuration/get-object-lock-configuration.command.js";
 export type { SimPutObjectRetentionCommand, SimPutObjectRetentionCommandInput, SimPutObjectRetentionCommandOutput, } from "./put-object-retention/put-object-retention.command.js";
 export type { SimPutObjectLegalHoldCommand, SimPutObjectLegalHoldCommandInput, SimPutObjectLegalHoldCommandOutput, } from "./put-object-legal-hold/put-object-legal-hold.command.js";
+export type { SimPutObjectTaggingCommand, SimPutObjectTaggingCommandInput, SimPutObjectTaggingCommandOutput, SimS3TaggingInput, } from "./put-object-tagging/put-object-tagging.command.js";
+export type { SimGetObjectTaggingCommand, SimGetObjectTaggingCommandInput, SimGetObjectTaggingCommandOutput, } from "./get-object-tagging/get-object-tagging.command.js";
+export type { SimDeleteObjectTaggingCommand, SimDeleteObjectTaggingCommandInput, SimDeleteObjectTaggingCommandOutput, } from "./delete-object-tagging/delete-object-tagging.command.js";

package/dist/service/s3/command/tagging/sim-s3-object-tagging-access.d.ts

@@ -0,0 +1,61 @@
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3TaggableObject } from "../../bucket/tagging/sim-s3-taggable-object.js";
+import type { SimS3ObjectNotifier } from "../../notification/sim-s3-object-notifier.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import { type SimS3ObjectTaggingAction } from "./sim-s3-object-tagging-authorizer.js";
+export interface SimS3ObjectTaggingAccessProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+    readonly notifications: SimS3ObjectNotifier;
+}
+/**
+ * The members every tagging request states, alongside the IAM action it is
+ * granted by and the command name to report a missing member against.
+ */
+export interface SimS3TaggingRequest {
+    readonly commandName: string;
+    readonly action: SimS3ObjectTaggingAction;
+    readonly input: {
+        readonly Bucket?: string | undefined;
+        readonly Key?: string | undefined;
+        readonly VersionId?: string | undefined;
+    };
+}
+/**
+ * What a tagging request names once it has been allowed.
+ */
+interface SimS3ReachedObject {
+    readonly bucket: SimS3Bucket;
+    readonly taggable: SimS3TaggableObject;
+    readonly caller: SimAwsResolvedCaller;
+}
+/**
+ * Getting at the tags on an Object, with permission.
+ *
+ * The three tagging operations share the whole of their preamble: read the
+ * Bucket and key the request has to state, find the Bucket or answer
+ * NoSuchBucket, let the background scheduler order the request, authorize it
+ * under the action that operation is granted by, and find the Object or the
+ * version it names. Holding that here leaves each handler with the one thing it
+ * actually does to the tags.
+ */
+export declare class SimS3ObjectTaggingAccess {
+    readonly notifications: SimS3ObjectNotifier;
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: SimS3ObjectTaggingAccessProperties);
+    /**
+     * Find and authorize the Object a tagging request names.
+     *
+     * The Bucket is looked up before authorization so a request against a Bucket
+     * that is not there keeps S3's error, and the Object is read after it, which
+     * leaves a refused caller knowing nothing about which keys exist.
+     */
+    reach(request: SimS3TaggingRequest, options?: SimS3RequestOptions): Promise<SimS3ReachedObject>;
+}
+export {};

package/dist/service/s3/command/tagging/sim-s3-object-tagging-access.js

@@ -0,0 +1,49 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+import { SimS3ObjectTaggingAuthorizer, } from "./sim-s3-object-tagging-authorizer.js";
+/**
+ * Getting at the tags on an Object, with permission.
+ *
+ * The three tagging operations share the whole of their preamble: read the
+ * Bucket and key the request has to state, find the Bucket or answer
+ * NoSuchBucket, let the background scheduler order the request, authorize it
+ * under the action that operation is granted by, and find the Object or the
+ * version it names. Holding that here leaves each handler with the one thing it
+ * actually does to the tags.
+ */
+export class SimS3ObjectTaggingAccess {
+    notifications;
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3ObjectTaggingAuthorizer({ iam });
+        this.background = background;
+        this.notifications = properties.notifications;
+    }
+    /**
+     * Find and authorize the Object a tagging request names.
+     *
+     * The Bucket is looked up before authorization so a request against a Bucket
+     * that is not there keeps S3's error, and the Object is read after it, which
+     * leaves a refused caller knowing nothing about which keys exist.
+     */
+    async reach(request, options) {
+        const { Bucket, Key, VersionId } = request.input;
+        assertDefined(Bucket, `${request.commandName}.input.Bucket`);
+        assertDefined(Key, `${request.commandName}.input.Key`);
+        const bucket = requireSimS3Bucket(this.buckets, Bucket);
+        // Allow for potential non-deterministic sequencing of async events.
+        await this.background.sequence();
+        const caller = this.authorizer.authorize(request.action, bucket, Key, options);
+        return {
+            bucket,
+            taggable: await bucket.taggableObject(Key, VersionId),
+            caller,
+        };
+    }
+}

package/dist/service/s3/command/tagging/sim-s3-object-tagging-authorizer.d.ts

@@ -0,0 +1,30 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+/**
+ * The IAM action one of the three tagging commands is granted by.
+ *
+ * Real S3 grants them separately, so a policy can let a caller read the tags on
+ * an Object it may not retag, and `s3:PutObject` grants none of them.
+ */
+export type SimS3ObjectTaggingAction = "s3:GetObjectTagging" | "s3:PutObjectTagging" | "s3:DeleteObjectTagging";
+interface SimS3ObjectTaggingAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to the S3 Object tagging commands.
+ *
+ * All three are authorized against the Object ARN, because tags belong to the
+ * Object rather than to the Bucket holding it.
+ */
+export declare class SimS3ObjectTaggingAuthorizer {
+    private readonly iam;
+    constructor(properties: SimS3ObjectTaggingAuthorizerProperties);
+    /**
+     * Ensure the caller may take this tagging action on an Object, answering the
+     * principal it turned out to be.
+     */
+    authorize(action: SimS3ObjectTaggingAction, bucket: SimS3Bucket, key: string, options?: SimS3RequestOptions): SimAwsResolvedCaller;
+}
+export {};

package/dist/service/s3/command/tagging/sim-s3-object-tagging-authorizer.js

@@ -0,0 +1,27 @@
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+import { simS3AuthorizeAction } from "../authorize/sim-s3-authorize-action.js";
+/**
+ * Applies IAM authorization to the S3 Object tagging commands.
+ *
+ * All three are authorized against the Object ARN, because tags belong to the
+ * Object rather than to the Bucket holding it.
+ */
+export class SimS3ObjectTaggingAuthorizer {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may take this tagging action on an Object, answering the
+     * principal it turned out to be.
+     */
+    authorize(action, bucket, key, options) {
+        return simS3AuthorizeAction({
+            iam: this.iam,
+            action,
+            resource: `${simS3BucketArn(bucket.bucketName)}/${key}`,
+            bucket,
+            options,
+        });
+    }
+}

package/dist/service/s3/command/tagging/sim-s3-object-tagging-commands.d.ts

@@ -0,0 +1,26 @@
+import type { SimS3BucketCommandState } from "../sim-s3-bucket-command-state.js";
+import type * as simS3Commands from "../sim-s3-command.types.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+/**
+ * The Object tagging commands of one simulated S3 scope.
+ *
+ * Real S3 holds tags against an Object without rewriting it, and grants each of
+ * the three a permission of its own, which is why they are an area rather than
+ * three more Object commands.
+ */
+export declare class SimS3ObjectTaggingCommands {
+    private readonly state;
+    constructor(state: SimS3BucketCommandState);
+    /**
+     * Replace the tags on an Object.
+     */
+    put(command: simS3Commands.SimPutObjectTaggingCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimPutObjectTaggingCommandOutput>;
+    /**
+     * Read the tags on an Object.
+     */
+    get(command: simS3Commands.SimGetObjectTaggingCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimGetObjectTaggingCommandOutput>;
+    /**
+     * Take every tag off an Object.
+     */
+    delete(command: simS3Commands.SimDeleteObjectTaggingCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimDeleteObjectTaggingCommandOutput>;
+}

package/dist/service/s3/command/tagging/sim-s3-object-tagging-commands.js

@@ -0,0 +1,34 @@
+import { DeleteObjectTaggingCommandHandler } from "../delete-object-tagging/delete-object-tagging.handler.js";
+import { GetObjectTaggingCommandHandler } from "../get-object-tagging/get-object-tagging.handler.js";
+import { PutObjectTaggingCommandHandler } from "../put-object-tagging/put-object-tagging.handler.js";
+/**
+ * The Object tagging commands of one simulated S3 scope.
+ *
+ * Real S3 holds tags against an Object without rewriting it, and grants each of
+ * the three a permission of its own, which is why they are an area rather than
+ * three more Object commands.
+ */
+export class SimS3ObjectTaggingCommands {
+    state;
+    constructor(state) {
+        this.state = state;
+    }
+    /**
+     * Replace the tags on an Object.
+     */
+    async put(command, options) {
+        return await new PutObjectTaggingCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Read the tags on an Object.
+     */
+    async get(command, options) {
+        return await new GetObjectTaggingCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Take every tag off an Object.
+     */
+    async delete(command, options) {
+        return await new DeleteObjectTaggingCommandHandler(this.state).handle(command, options);
+    }
+}

package/dist/service/s3/error/sim-s3-upload.error.d.ts

@@ -0,0 +1,41 @@
+import { SimS3Error } from "./sim-s3.error.js";
+/**
+ * The errors a multipart upload answers with.
+ *
+ * An upload is the one S3 operation made of several requests, so these are
+ * about the upload as a whole rather than about one Object or one Bucket.
+ */
+/**
+ * Simulated S3 NoSuchUpload error.
+ *
+ * What real S3 answers when a request names a multipart upload id it did not
+ * issue, or one belonging to an upload that has since been completed or
+ * aborted.
+ */
+export declare class SimS3NoSuchUpload extends SimS3Error {
+    readonly name = "NoSuchUpload";
+    constructor(message: string);
+}
+/**
+ * Simulated S3 InvalidPart error.
+ *
+ * A completion naming a part that was never uploaded, or naming an ETag other
+ * than the one that part was stored under. Real S3 refuses rather than
+ * assembling what it can, because a caller that lost a part should not end up
+ * with an Object silently missing its middle.
+ */
+export declare class SimS3InvalidPart extends SimS3Error {
+    readonly name = "InvalidPart";
+    constructor(message: string);
+}
+/**
+ * Simulated S3 InvalidPartOrder error.
+ *
+ * A completion listing its parts in an order other than ascending part number.
+ * The parts themselves can be uploaded in any order; it is the list in the
+ * completion request that real S3 requires to be sorted.
+ */
+export declare class SimS3InvalidPartOrder extends SimS3Error {
+    readonly name = "InvalidPartOrder";
+    constructor(message: string);
+}

package/dist/service/s3/error/sim-s3-upload.error.js

@@ -0,0 +1,47 @@
+import { SimS3Error } from "./sim-s3.error.js";
+/**
+ * The errors a multipart upload answers with.
+ *
+ * An upload is the one S3 operation made of several requests, so these are
+ * about the upload as a whole rather than about one Object or one Bucket.
+ */
+/**
+ * Simulated S3 NoSuchUpload error.
+ *
+ * What real S3 answers when a request names a multipart upload id it did not
+ * issue, or one belonging to an upload that has since been completed or
+ * aborted.
+ */
+export class SimS3NoSuchUpload extends SimS3Error {
+    name = "NoSuchUpload";
+    constructor(message) {
+        super(message, { httpStatusCode: 404 });
+    }
+}
+/**
+ * Simulated S3 InvalidPart error.
+ *
+ * A completion naming a part that was never uploaded, or naming an ETag other
+ * than the one that part was stored under. Real S3 refuses rather than
+ * assembling what it can, because a caller that lost a part should not end up
+ * with an Object silently missing its middle.
+ */
+export class SimS3InvalidPart extends SimS3Error {
+    name = "InvalidPart";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated S3 InvalidPartOrder error.
+ *
+ * A completion listing its parts in an order other than ascending part number.
+ * The parts themselves can be uploaded in any order; it is the list in the
+ * completion request that real S3 requires to be sorted.
+ */
+export class SimS3InvalidPartOrder extends SimS3Error {
+    name = "InvalidPartOrder";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}

package/dist/service/s3/error/sim-s3.error.d.ts

@@ -136,6 +136,16 @@ export declare class SimS3InvalidArgument extends SimS3Error {
     readonly name = "InvalidArgument";
     constructor(message: string);
 }
+/**
+ * Simulated S3 InvalidStorageClass error.
+ *
+ * Real S3 answers this for a write naming a storage class it has no such class
+ * for, and refuses the write rather than storing the Object in the default one.
+ */
+export declare class SimS3InvalidStorageClass extends SimS3Error {
+    readonly name = "InvalidStorageClass";
+    constructor(message: string);
+}
 /**
  * Simulated S3 NotImplemented error.
  *
@@ -153,40 +163,6 @@ export declare class SimS3InvalidBucketName extends SimS3Error {
     readonly name = "InvalidBucketName";
     constructor(message: string);
 }
-/**
- * Simulated S3 NoSuchUpload error.
- *
- * What real S3 answers when a request names a multipart upload id it did not
- * issue, or one belonging to an upload that has since been completed or
- * aborted.
- */
-export declare class SimS3NoSuchUpload extends SimS3Error {
-    readonly name = "NoSuchUpload";
-    constructor(message: string);
-}
-/**
- * Simulated S3 InvalidPart error.
- *
- * A completion naming a part that was never uploaded, or naming an ETag other
- * than the one that part was stored under. Real S3 refuses rather than
- * assembling what it can, because a caller that lost a part should not end up
- * with an Object silently missing its middle.
- */
-export declare class SimS3InvalidPart extends SimS3Error {
-    readonly name = "InvalidPart";
-    constructor(message: string);
-}
-/**
- * Simulated S3 InvalidPartOrder error.
- *
- * A completion listing its parts in an order other than ascending part number.
- * The parts themselves can be uploaded in any order; it is the list in the
- * completion request that real S3 requires to be sorted.
- */
-export declare class SimS3InvalidPartOrder extends SimS3Error {
-    readonly name = "InvalidPartOrder";
-    constructor(message: string);
-}
 /**
  * Simulated S3 InvalidRange error.
  *
@@ -211,3 +187,15 @@ export declare class SimS3InvalidRequest extends SimS3Error {
     readonly name = "InvalidRequest";
     constructor(message: string);
 }
+/**
+ * Simulated S3 InvalidTag error.
+ *
+ * Real S3 answers this for a tag set it will not hold against an Object: more
+ * than ten tags, or two tags under one key. The write is refused rather than
+ * partly applied, so a caller that sent eleven tags does not find ten of them
+ * on the Object.
+ */
+export declare class SimS3InvalidTag extends SimS3Error {
+    readonly name = "InvalidTag";
+    constructor(message: string);
+}

package/dist/service/s3/error/sim-s3.error.js

@@ -159,6 +159,18 @@ export class SimS3InvalidArgument extends SimS3Error {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated S3 InvalidStorageClass error.
+ *
+ * Real S3 answers this for a write naming a storage class it has no such class
+ * for, and refuses the write rather than storing the Object in the default one.
+ */
+export class SimS3InvalidStorageClass extends SimS3Error {
+    name = "InvalidStorageClass";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
 /**
  * Simulated S3 NotImplemented error.
  *
@@ -180,46 +192,6 @@ export class SimS3InvalidBucketName extends SimS3Error {
         super(message, { httpStatusCode: 400 });
     }
 }
-/**
- * Simulated S3 NoSuchUpload error.
- *
- * What real S3 answers when a request names a multipart upload id it did not
- * issue, or one belonging to an upload that has since been completed or
- * aborted.
- */
-export class SimS3NoSuchUpload extends SimS3Error {
-    name = "NoSuchUpload";
-    constructor(message) {
-        super(message, { httpStatusCode: 404 });
-    }
-}
-/**
- * Simulated S3 InvalidPart error.
- *
- * A completion naming a part that was never uploaded, or naming an ETag other
- * than the one that part was stored under. Real S3 refuses rather than
- * assembling what it can, because a caller that lost a part should not end up
- * with an Object silently missing its middle.
- */
-export class SimS3InvalidPart extends SimS3Error {
-    name = "InvalidPart";
-    constructor(message) {
-        super(message, { httpStatusCode: 400 });
-    }
-}
-/**
- * Simulated S3 InvalidPartOrder error.
- *
- * A completion listing its parts in an order other than ascending part number.
- * The parts themselves can be uploaded in any order; it is the list in the
- * completion request that real S3 requires to be sorted.
- */
-export class SimS3InvalidPartOrder extends SimS3Error {
-    name = "InvalidPartOrder";
-    constructor(message) {
-        super(message, { httpStatusCode: 400 });
-    }
-}
 /**
  * Simulated S3 InvalidRange error.
  *
@@ -248,3 +220,17 @@ export class SimS3InvalidRequest extends SimS3Error {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated S3 InvalidTag error.
+ *
+ * Real S3 answers this for a tag set it will not hold against an Object: more
+ * than ten tags, or two tags under one key. The write is refused rather than
+ * partly applied, so a caller that sent eleven tags does not find ten of them
+ * on the Object.
+ */
+export class SimS3InvalidTag extends SimS3Error {
+    name = "InvalidTag";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}

package/dist/service/s3/mount/sim-s3-mount.type.d.ts

@@ -28,6 +28,16 @@ export interface SimS3MountFilesystemOptions {
      * build one reload. The default suits a generator writing its output.
      */
     readonly settleMs?: number | undefined;
+    /**
+     * Let a DeleteObject remove the file behind an Object key.
+     *
+     * A mounted Bucket refuses a delete by default, because the files under the
+     * directory are the user's own and a test that empties a Bucket would empty
+     * their build output with it. A mount that says so gets the deletion an
+     * in-memory Bucket performs, event notification included, within the same
+     * key and extension checks a read goes through.
+     */
+    readonly allowDelete?: boolean | undefined;
     /**
      * File extensions to serve in addition to the usual web ones.
      *

package/dist/service/s3/notification/event/sim-s3-event-records.d.ts

@@ -45,7 +45,8 @@ export declare function simS3EventRequestId(): string;
 /**
  * The object key as a record carries it.
  *
- * Real S3 form-URL-encodes the key, so a space becomes a plus sign, while the
- * slashes that make up a key prefix stay as they are.
+ * A record carries the key encoded, the same way a listing asked for one does,
+ * so a function reading a record has to decode it before the key names an
+ * Object.
  */
 export declare function simS3EventObjectKey(key: string): string;

package/dist/service/s3/notification/event/sim-s3-event-records.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { simS3EncodedKey } from "../../object/s3-key-encoding.js";
 /**
  * The event structure version this simulator emits.
  *
@@ -84,9 +85,10 @@ export function simS3EventRequestId() {
 /**
  * The object key as a record carries it.
  *
- * Real S3 form-URL-encodes the key, so a space becomes a plus sign, while the
- * slashes that make up a key prefix stay as they are.
+ * A record carries the key encoded, the same way a listing asked for one does,
+ * so a function reading a record has to decode it before the key names an
+ * Object.
  */
 export function simS3EventObjectKey(key) {
-    return encodeURIComponent(key).replaceAll("%20", "+").replaceAll("%2F", "/");
+    return simS3EncodedKey(key);
 }

package/dist/service/s3/notification/event/sim-s3-object-event-builder.d.ts

@@ -5,25 +5,40 @@ import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
 import type { SimS3Object } from "../../object/s3-object.js";
 import { SimS3ObjectEvent } from "./sim-s3-object-event.js";
 /**
- * An Object a command has just stored.
+ * An Object a command has just written, in whatever sense.
+ *
+ * Storing the bytes and retagging them are both writes to an Object that
+ * exists, so both events describe the same thing: the Object as it now stands.
+ * The event name is what tells the two apart.
  */
-export interface SimS3ObjectCreatedInput {
+interface SimS3WrittenObjectInput<Event extends SimS3NotificationEvent> {
     readonly bucket: SimS3Bucket;
     readonly object: SimS3Object;
     readonly caller: SimAwsResolvedCaller;
-    /**
-     * How the Object came to be there, which real S3 distinguishes: an Object
-     * assembled from parts arrives as `s3:ObjectCreated:CompleteMultipartUpload`
-     * rather than as a Put.
-     */
-    readonly eventName: SimS3ObjectCreatedEvent;
+    readonly eventName: Event;
     /** The version the write was given, on a Bucket keeping versions. */
     readonly versionId?: string | undefined;
 }
+/**
+ * An Object a command has just stored.
+ *
+ * The event name says how the Object came to be there, which real S3
+ * distinguishes: an Object assembled from parts arrives as
+ * `s3:ObjectCreated:CompleteMultipartUpload` rather than as a Put.
+ */
+export type SimS3ObjectCreatedInput = SimS3WrittenObjectInput<SimS3ObjectCreatedEvent>;
+/**
+ * An Object whose tags a command has just replaced.
+ */
+export type SimS3ObjectTaggedInput = SimS3WrittenObjectInput<SimS3ObjectTaggingEvent>;
 /**
  * The ways an Object can be created that simulated S3 raises an event for.
  */
 export type SimS3ObjectCreatedEvent = Extract<SimS3NotificationEvent, `s3:ObjectCreated:${string}`>;
+/**
+ * The ways an Object's tags can change that simulated S3 raises an event for.
+ */
+type SimS3ObjectTaggingEvent = Extract<SimS3NotificationEvent, `s3:ObjectTagging:${string}`>;
 /**
  * The ways an Object can be removed that simulated S3 raises an event for.
  */
@@ -77,11 +92,21 @@ export declare class SimS3ObjectEventBuilder {
      * size and ETag.
      */
     forCreated(input: SimS3ObjectCreatedInput): SimS3ObjectEvent;
+    /**
+     * Build the event for an Object whose tags were replaced, which carries the
+     * same size and ETag a creation does.
+     *
+     * Real S3 describes the Object the tags now sit on, and tagging changes
+     * neither of those, so a tagging record and the creation record before it
+     * report the same bytes.
+     */
+    forTagged(input: SimS3ObjectTaggedInput): SimS3ObjectEvent;
     /**
      * Build the event for an Object that was removed, which carries neither size
      * nor ETag, because the Object they described is gone.
      */
     forRemoved(input: SimS3ObjectRemovedInput): SimS3ObjectEvent;
+    private forWritten;
     private build;
 }
 export {};

package/dist/service/s3/notification/event/sim-s3-object-event-builder.js

@@ -21,15 +21,18 @@ export class SimS3ObjectEventBuilder {
      * size and ETag.
      */
     forCreated(input) {
-        return this.build({
-            bucket: input.bucket,
-            eventName: input.eventName,
-            key: input.object.key,
-            caller: input.caller,
-            size: input.object.body.length,
-            eTag: input.object.etag,
-            versionId: input.versionId,
-        });
+        return this.forWritten(input);
+    }
+    /**
+     * Build the event for an Object whose tags were replaced, which carries the
+     * same size and ETag a creation does.
+     *
+     * Real S3 describes the Object the tags now sit on, and tagging changes
+     * neither of those, so a tagging record and the creation record before it
+     * report the same bytes.
+     */
+    forTagged(input) {
+        return this.forWritten(input);
     }
     /**
      * Build the event for an Object that was removed, which carries neither size
@@ -44,6 +47,17 @@ export class SimS3ObjectEventBuilder {
             versionId: input.versionId,
         });
     }
+    forWritten(input) {
+        return this.build({
+            bucket: input.bucket,
+            eventName: input.eventName,
+            key: input.object.key,
+            caller: input.caller,
+            size: input.object.body.length,
+            eTag: input.object.etag,
+            versionId: input.versionId,
+        });
+    }
     build(raised) {
         const scope = raised.bucket.getAccountRegionScope();
         const bucketName = raised.bucket.bucketName;