@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/s3/object/s3-object.js

@@ -1,4 +1,6 @@
 import { simS3ObjectETag } from "./s3-object-etag.js";
+import { SimS3ObjectTagSet } from "./s3-object-tags.js";
+import { simS3DefaultStorageClass, } from "./s3-storage-class.js";
 import { simS3SystemMetadataOutput, simS3UserDefinedMetadata, } from "./s3-system-metadata-read.js";
 /**
  * Simulated S3 object metadata.
@@ -33,16 +35,45 @@ export class SimS3Object {
     key;
     body;
     metadata;
+    storageClass;
+    serverSideEncryption;
+    tags;
     writtenAt;
     givenETag;
     constructor(properties = {}) {
-        const { key = "object.json", body = Buffer.alloc(0), metadata = new SimS3ObjectMetadata(), lastModified = new Date(), } = properties;
+        const { key = "object.json", body = Buffer.alloc(0), metadata = new SimS3ObjectMetadata(), lastModified = new Date(), storageClass = simS3DefaultStorageClass, tags = SimS3ObjectTagSet.empty(), } = properties;
         this.key = key;
         this.body = body;
         this.metadata = metadata;
+        this.storageClass = storageClass;
+        this.serverSideEncryption = properties.serverSideEncryption;
+        this.tags = tags;
         this.writtenAt = new Date(lastModified);
         this.givenETag = properties.etag;
     }
+    /**
+     * The same Object in another storage class, for a lifecycle rule that has
+     * transitioned it.
+     *
+     * The bytes are shared with the Object this came from. A transition moves
+     * where S3 keeps an Object and leaves the Object itself alone, so its ETag,
+     * its metadata, its tags and the instant it was last written all carry over.
+     */
+    withStorageClass(storageClass) {
+        return this.with({ storageClass });
+    }
+    /**
+     * The same Object under another tag set, for a tagging request that has
+     * replaced the one it carried.
+     *
+     * Real S3 holds tags against an Object without rewriting it, so nothing else
+     * about it changes: the bytes, the ETag and the instant it was last written
+     * are the ones it already had. A read after tagging reports the same
+     * `LastModified` as a read before it.
+     */
+    withTags(tags) {
+        return this.with({ tags });
+    }
     /**
      * When S3 last wrote these bytes.
      *
@@ -74,4 +105,24 @@ export class SimS3Object {
     get etag() {
         return this.givenETag ?? simS3ObjectETag(this.body);
     }
+    /**
+     * The same Object with one thing about it replaced.
+     *
+     * Everything S3 remembers is carried over by hand rather than by copying the
+     * instance, because an Object holds its write time and its given ETag
+     * privately and a spread would lose both.
+     */
+    with(changed) {
+        return new SimS3Object({
+            key: this.key,
+            body: this.body,
+            metadata: this.metadata,
+            lastModified: this.writtenAt,
+            storageClass: this.storageClass,
+            serverSideEncryption: this.serverSideEncryption,
+            tags: this.tags,
+            ...(this.givenETag !== undefined && { etag: this.givenETag }),
+            ...changed,
+        });
+    }
 }

package/dist/service/s3/object/s3-server-side-encryption.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The server-side encryption algorithms S3 applies to an Object.
+ *
+ * https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html
+ */
+export declare const simS3ServerSideEncryptionAlgorithms: readonly ["AES256", "aws:kms", "aws:kms:dsse"];
+/**
+ * One server-side encryption algorithm.
+ */
+export type SimS3ServerSideEncryption = (typeof simS3ServerSideEncryptionAlgorithms)[number];
+/**
+ * The encryption every Bucket applies to an Object whose write named none.
+ *
+ * Real S3 has encrypted every new Object with SSE-S3 since January 2023, and
+ * reports `AES256` for one written into a Bucket carrying no default of its
+ * own. Nothing is encrypted here. The bytes are stored as they arrive, and this
+ * is what a read says about them.
+ */
+export declare const simS3DefaultServerSideEncryption: SimS3ServerSideEncryption;
+/**
+ * Read the encryption a request or a Bucket configuration named, refusing an
+ * algorithm S3 does not apply.
+ *
+ * Real S3 answers `InvalidArgument` for an unsupported algorithm on a write.
+ */
+export declare function simS3ServerSideEncryptionFrom(value: string | undefined, context: string): SimS3ServerSideEncryption | undefined;
+/**
+ * Whether a value names a server-side encryption algorithm.
+ */
+export declare function isSimS3ServerSideEncryption(value: string): value is SimS3ServerSideEncryption;

package/dist/service/s3/object/s3-server-side-encryption.js

@@ -0,0 +1,42 @@
+import { SimS3InvalidArgument } from "../error/sim-s3.error.js";
+/**
+ * The server-side encryption algorithms S3 applies to an Object.
+ *
+ * https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html
+ */
+export const simS3ServerSideEncryptionAlgorithms = [
+    "AES256",
+    "aws:kms",
+    "aws:kms:dsse",
+];
+/**
+ * The encryption every Bucket applies to an Object whose write named none.
+ *
+ * Real S3 has encrypted every new Object with SSE-S3 since January 2023, and
+ * reports `AES256` for one written into a Bucket carrying no default of its
+ * own. Nothing is encrypted here. The bytes are stored as they arrive, and this
+ * is what a read says about them.
+ */
+export const simS3DefaultServerSideEncryption = "AES256";
+/**
+ * Read the encryption a request or a Bucket configuration named, refusing an
+ * algorithm S3 does not apply.
+ *
+ * Real S3 answers `InvalidArgument` for an unsupported algorithm on a write.
+ */
+export function simS3ServerSideEncryptionFrom(value, context) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!isSimS3ServerSideEncryption(value)) {
+        throw new SimS3InvalidArgument(`${value} is not a server-side encryption algorithm for ${context}. ` +
+            `It is one of ${simS3ServerSideEncryptionAlgorithms.join(", ")}.`);
+    }
+    return value;
+}
+/**
+ * Whether a value names a server-side encryption algorithm.
+ */
+export function isSimS3ServerSideEncryption(value) {
+    return simS3ServerSideEncryptionAlgorithms.includes(value);
+}

package/dist/service/s3/object/s3-storage-class.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The storage class S3 puts an Object in when the write names none.
+ *
+ * Reported rather than omitted from a listing, because a listing that leaves it
+ * out reads as an Object of unknown class. Real S3 answers `STANDARD` there and
+ * leaves the `x-amz-storage-class` header off a read of one, which is what
+ * `simS3ReportedStorageClass` is for.
+ */
+export declare const simS3DefaultStorageClass = "STANDARD";
+/**
+ * The storage classes an Object can be in.
+ *
+ * These are the ones a write can name or a lifecycle rule can transition to.
+ * Nothing here changes what a read costs or how long it takes, so the class is
+ * a fact about the Object that S3 reports and applies its rules to.
+ *
+ * https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html
+ */
+export declare const simS3StorageClasses: readonly ["STANDARD", "REDUCED_REDUNDANCY", "STANDARD_IA", "ONEZONE_IA", "INTELLIGENT_TIERING", "GLACIER_IR", "GLACIER", "DEEP_ARCHIVE", "EXPRESS_ONEZONE", "OUTPOSTS", "SNOW"];
+/**
+ * One storage class an Object can be in.
+ */
+export type SimS3StorageClass = (typeof simS3StorageClasses)[number];
+/**
+ * Read the storage class a request named, refusing one S3 has no such class
+ * for.
+ *
+ * A request naming none leaves the Object in the default class. Real S3
+ * answers `InvalidStorageClass` for a name it does not know, and does it
+ * before storing anything.
+ */
+export declare function simS3StorageClassFrom(value: string | undefined, context: string): SimS3StorageClass | undefined;
+/**
+ * The storage class a read of an Object reports, which is nothing for one in
+ * the default class.
+ *
+ * Real S3 leaves `x-amz-storage-class` off a `GetObject` or a `HeadObject`
+ * response for a Standard Object, and sets it for every other class. A listing
+ * is the other way around and always carries one.
+ */
+export declare function simS3ReportedStorageClass(storageClass: SimS3StorageClass): SimS3StorageClass | undefined;
+/**
+ * Whether a value names a storage class.
+ */
+export declare function isSimS3StorageClass(value: string): value is SimS3StorageClass;

package/dist/service/s3/object/s3-storage-class.js

@@ -0,0 +1,67 @@
+import { SimS3InvalidStorageClass } from "../error/sim-s3.error.js";
+/**
+ * The storage class S3 puts an Object in when the write names none.
+ *
+ * Reported rather than omitted from a listing, because a listing that leaves it
+ * out reads as an Object of unknown class. Real S3 answers `STANDARD` there and
+ * leaves the `x-amz-storage-class` header off a read of one, which is what
+ * `simS3ReportedStorageClass` is for.
+ */
+export const simS3DefaultStorageClass = "STANDARD";
+/**
+ * The storage classes an Object can be in.
+ *
+ * These are the ones a write can name or a lifecycle rule can transition to.
+ * Nothing here changes what a read costs or how long it takes, so the class is
+ * a fact about the Object that S3 reports and applies its rules to.
+ *
+ * https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html
+ */
+export const simS3StorageClasses = [
+    simS3DefaultStorageClass,
+    "REDUCED_REDUNDANCY",
+    "STANDARD_IA",
+    "ONEZONE_IA",
+    "INTELLIGENT_TIERING",
+    "GLACIER_IR",
+    "GLACIER",
+    "DEEP_ARCHIVE",
+    "EXPRESS_ONEZONE",
+    "OUTPOSTS",
+    "SNOW",
+];
+/**
+ * Read the storage class a request named, refusing one S3 has no such class
+ * for.
+ *
+ * A request naming none leaves the Object in the default class. Real S3
+ * answers `InvalidStorageClass` for a name it does not know, and does it
+ * before storing anything.
+ */
+export function simS3StorageClassFrom(value, context) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!isSimS3StorageClass(value)) {
+        throw new SimS3InvalidStorageClass(`${value} is not an S3 storage class for ${context}. It is one of ` +
+            `${simS3StorageClasses.join(", ")}.`);
+    }
+    return value;
+}
+/**
+ * The storage class a read of an Object reports, which is nothing for one in
+ * the default class.
+ *
+ * Real S3 leaves `x-amz-storage-class` off a `GetObject` or a `HeadObject`
+ * response for a Standard Object, and sets it for every other class. A listing
+ * is the other way around and always carries one.
+ */
+export function simS3ReportedStorageClass(storageClass) {
+    return storageClass === simS3DefaultStorageClass ? undefined : storageClass;
+}
+/**
+ * Whether a value names a storage class.
+ */
+export function isSimS3StorageClass(value) {
+    return simS3StorageClasses.includes(value);
+}

package/dist/service/s3/object/s3-write-metadata.d.ts

@@ -8,8 +8,9 @@ import { SimS3ObjectMetadata } from "./s3-object.js";
  * headers S3 remembers about an Object and returns on a read. There is one for
  * every entry in `simS3SystemMetadataHeaders`, which is what the conversion
  * below reads them by, so a header added to that list without a field here
- * fails to compile. `Expires` is a `Date` because the SDK takes one and formats
- * it as an HTTP date.
+ * fails to compile. `Expires` is a `Date` where the SDK takes one and formats
+ * it as an HTTP date, and the formatted string itself where the write arrived
+ * over HTTP with the date already written out.
  */
 export interface SimS3ObjectWriteMetadata {
     readonly Metadata?: Record<string, string> | undefined;
@@ -18,7 +19,7 @@ export interface SimS3ObjectWriteMetadata {
     readonly ContentEncoding?: string | undefined;
     readonly ContentLanguage?: string | undefined;
     readonly ContentType?: string | undefined;
-    readonly Expires?: Date | undefined;
+    readonly Expires?: Date | string | undefined;
 }
 /**
  * Convert the metadata members of a write into what an Object stores.
@@ -34,3 +35,16 @@ export interface SimS3ObjectWriteMetadata {
  * write named it or not.
  */
 export declare function simS3WriteMetadata(input: SimS3ObjectWriteMetadata): SimS3ObjectMetadata;
+/**
+ * Read the metadata headers of an upload into the members a write carries.
+ *
+ * A request arriving over HTTP states its metadata in the headers real S3
+ * carries it in, which is the form a `PutObjectCommand` is serialized into by
+ * the SDK. Reading them by the same list a write and a read agree on is what
+ * keeps an upload over an endpoint describing an Object exactly as an
+ * in-process one does.
+ *
+ * Every value stays a string, expiry included, because it arrives as the HTTP
+ * date S3 stores rather than as a `Date` waiting to be formatted.
+ */
+export declare function simS3WriteMetadataHeaders(headers: Headers): SimS3ObjectWriteMetadata;

package/dist/service/s3/object/s3-write-metadata.js

@@ -41,3 +41,46 @@ function metadataValue(value) {
     }
     return value;
 }
+/**
+ * Read the metadata headers of an upload into the members a write carries.
+ *
+ * A request arriving over HTTP states its metadata in the headers real S3
+ * carries it in, which is the form a `PutObjectCommand` is serialized into by
+ * the SDK. Reading them by the same list a write and a read agree on is what
+ * keeps an upload over an endpoint describing an Object exactly as an
+ * in-process one does.
+ *
+ * Every value stays a string, expiry included, because it arrives as the HTTP
+ * date S3 stores rather than as a `Date` waiting to be formatted.
+ */
+export function simS3WriteMetadataHeaders(headers) {
+    const written = {};
+    for (const header of simS3SystemMetadataHeaders) {
+        const value = headers.get(header.name);
+        if (value !== null) {
+            written[header.field] = value;
+        }
+    }
+    const attached = simS3AttachedMetadata(headers);
+    return attached === undefined ? written : { ...written, Metadata: attached };
+}
+/**
+ * The user-defined metadata an upload attached, or nothing where it attached
+ * none.
+ *
+ * S3 sends each entry as its own `x-amz-meta-` header and answers a read with
+ * the keys without the prefix, which is the form a write states them in. An
+ * upload that attached nothing leaves `Metadata` absent rather than empty, so
+ * a copy carrying the source's metadata is not handed an empty object to
+ * copy over it.
+ */
+function simS3AttachedMetadata(headers) {
+    const attached = {};
+    for (const [name, value] of headers) {
+        if (name.toLowerCase().startsWith(simS3UserMetadataPrefix)) {
+            attached[name.slice(simS3UserMetadataPrefix.length).toLowerCase()] =
+                value;
+        }
+    }
+    return Object.keys(attached).length === 0 ? undefined : attached;
+}

package/dist/service/s3/object/s3-write-storage.d.ts

@@ -0,0 +1,27 @@
+import { type SimS3ServerSideEncryption } from "./s3-server-side-encryption.js";
+import { type SimS3StorageClass } from "./s3-storage-class.js";
+/**
+ * The members of a request that say where and how S3 keeps an Object.
+ *
+ * `PutObject`, `CopyObject` and `CreateMultipartUpload` all carry these
+ * alongside the metadata that says what the Object is. Both are read before
+ * anything is stored, because real S3 refuses a write naming a storage class
+ * or an algorithm it has no such thing for.
+ */
+export interface SimS3ObjectWriteStorage {
+    readonly StorageClass?: string | undefined;
+    readonly ServerSideEncryption?: string | undefined;
+}
+/**
+ * The storage class a write asks for, or nothing where it asks for none.
+ */
+export declare function simS3WriteStorageClass(input: SimS3ObjectWriteStorage, context: string): SimS3StorageClass | undefined;
+/**
+ * The encryption S3 stamps on the Object a write is storing.
+ *
+ * The write has the last word, the Bucket's default configuration comes next,
+ * and an Object written into a Bucket carrying neither is SSE-S3 encrypted.
+ * Real S3 has encrypted every new Object that way since January 2023, so
+ * `AES256` is what a read reports for one nobody configured anything for.
+ */
+export declare function simS3WriteEncryption(input: SimS3ObjectWriteStorage, bucketDefault: SimS3ServerSideEncryption | undefined, context: string): SimS3ServerSideEncryption;

package/dist/service/s3/object/s3-write-storage.js

@@ -0,0 +1,21 @@
+import { simS3DefaultServerSideEncryption, simS3ServerSideEncryptionFrom, } from "./s3-server-side-encryption.js";
+import { simS3StorageClassFrom, } from "./s3-storage-class.js";
+/**
+ * The storage class a write asks for, or nothing where it asks for none.
+ */
+export function simS3WriteStorageClass(input, context) {
+    return simS3StorageClassFrom(input.StorageClass, context);
+}
+/**
+ * The encryption S3 stamps on the Object a write is storing.
+ *
+ * The write has the last word, the Bucket's default configuration comes next,
+ * and an Object written into a Bucket carrying neither is SSE-S3 encrypted.
+ * Real S3 has encrypted every new Object that way since January 2023, so
+ * `AES256` is what a read reports for one nobody configured anything for.
+ */
+export function simS3WriteEncryption(input, bucketDefault, context) {
+    return (simS3ServerSideEncryptionFrom(input.ServerSideEncryption, context) ??
+        bucketDefault ??
+        simS3DefaultServerSideEncryption);
+}

package/dist/service/s3/object/s3-write-tagging.d.ts

@@ -0,0 +1,24 @@
+import { SimS3ObjectTagSet } from "./s3-object-tags.js";
+/**
+ * The tagging members of a request that stores an Object.
+ *
+ * `PutObject`, `CopyObject` and `CreateMultipartUpload` all carry `Tagging`,
+ * and only a copy carries a directive, because only a copy has a source tag set
+ * to choose between.
+ */
+export interface SimS3ObjectWriteTagging {
+    /**
+     * The tags to put on the Object, as the URL query string real S3 takes them
+     * in: `department=finance&retention=long`.
+     */
+    readonly Tagging?: string | undefined;
+}
+/**
+ * The tags a write asks S3 to put on the Object it is storing.
+ *
+ * Real S3 sends a tag set on a write as a query string rather than as a list,
+ * because it travels in the `x-amz-tagging` header where a list has nowhere to
+ * go. It is read the same way here, so an SDK caller and an HTTP one produce
+ * the same tag set. A write naming no tags stores an untagged Object.
+ */
+export declare function simS3WriteTags(input: SimS3ObjectWriteTagging, context: string): SimS3ObjectTagSet;

package/dist/service/s3/object/s3-write-tagging.js

@@ -0,0 +1,19 @@
+import { SimS3ObjectTagSet } from "./s3-object-tags.js";
+/**
+ * The tags a write asks S3 to put on the Object it is storing.
+ *
+ * Real S3 sends a tag set on a write as a query string rather than as a list,
+ * because it travels in the `x-amz-tagging` header where a list has nowhere to
+ * go. It is read the same way here, so an SDK caller and an HTTP one produce
+ * the same tag set. A write naming no tags stores an untagged Object.
+ */
+export function simS3WriteTags(input, context) {
+    const tagging = input.Tagging;
+    if (tagging === undefined) {
+        return SimS3ObjectTagSet.empty();
+    }
+    return SimS3ObjectTagSet.from(new URLSearchParams(tagging)
+        .entries()
+        .map(([Key, Value]) => ({ Key, Value }))
+        .toArray(), context);
+}

package/dist/service/s3/sdk/sim-s3-sdk-bucket-routes.js

@@ -64,6 +64,18 @@ export function simS3SdkBucketRoutes(simS3) {
             "GetBucketVersioningCommand",
             async (command, context) => await simS3.getBucketVersioning(command, simSdkCallerOptions(context)),
         ],
+        [
+            "PutBucketEncryptionCommand",
+            async (command, context) => await simS3.putBucketEncryption(command, simSdkCallerOptions(context)),
+        ],
+        [
+            "GetBucketEncryptionCommand",
+            async (command, context) => await simS3.getBucketEncryption(command, simSdkCallerOptions(context)),
+        ],
+        [
+            "DeleteBucketEncryptionCommand",
+            async (command, context) => await simS3.deleteBucketEncryption(command, simSdkCallerOptions(context)),
+        ],
         [
             "PutBucketWebsiteCommand",
             async (command, context) => await simS3.putBucketWebsite(command, simSdkCallerOptions(context)),

package/dist/service/s3/sdk/sim-s3-sdk-command-router.js

@@ -1,6 +1,7 @@
 import { simS3SdkBucketRoutes } from "./sim-s3-sdk-bucket-routes.js";
 import { simS3SdkObjectLockRoutes } from "./sim-s3-sdk-object-lock-routes.js";
 import { simS3SdkObjectRoutes } from "./sim-s3-sdk-object-routes.js";
+import { simS3SdkObjectTaggingRoutes } from "./sim-s3-sdk-object-tagging-routes.js";
 /**
  * Routes intercepted SDK Commands to one scoped simulated S3 instance.
  */
@@ -11,6 +12,7 @@ export class SimS3SdkCommandRouter {
             ...simS3SdkBucketRoutes(simS3),
             ...simS3SdkObjectRoutes(simS3),
             ...simS3SdkObjectLockRoutes(simS3),
+            ...simS3SdkObjectTaggingRoutes(simS3),
         ]);
     }
     /**

package/dist/service/s3/sdk/sim-s3-sdk-object-tagging-routes.d.ts

@@ -0,0 +1,9 @@
+import type { SimSdkCommandRoute } from "../../../sdk/index.js";
+import type { SimS3 } from "../sim-s3.js";
+/**
+ * The SDK Commands that hold tags against an Object.
+ *
+ * They route together because each is granted by a permission of its own, and
+ * none of them is reachable through `PutObject` or `GetObject`.
+ */
+export declare function simS3SdkObjectTaggingRoutes(simS3: SimS3): readonly (readonly [string, SimSdkCommandRoute])[];

package/dist/service/s3/sdk/sim-s3-sdk-object-tagging-routes.js

@@ -0,0 +1,23 @@
+import { simSdkCallerOptions } from "../../../sdk/index.js";
+/**
+ * The SDK Commands that hold tags against an Object.
+ *
+ * They route together because each is granted by a permission of its own, and
+ * none of them is reachable through `PutObject` or `GetObject`.
+ */
+export function simS3SdkObjectTaggingRoutes(simS3) {
+    return [
+        [
+            "PutObjectTaggingCommand",
+            async (command, context) => await simS3.putObjectTagging(command, simSdkCallerOptions(context)),
+        ],
+        [
+            "GetObjectTaggingCommand",
+            async (command, context) => await simS3.getObjectTagging(command, simSdkCallerOptions(context)),
+        ],
+        [
+            "DeleteObjectTaggingCommand",
+            async (command, context) => await simS3.deleteObjectTagging(command, simSdkCallerOptions(context)),
+        ],
+    ];
+}

package/dist/service/s3/serve/api/sim-s3-api-bucket-routes.js

@@ -1,4 +1,5 @@
 import { readSimS3NotificationConfiguration } from "./sim-s3-api-notification-read.js";
+import { readSimS3EncryptionConfiguration } from "./sim-s3-api-encryption-read.js";
 import { readSimS3DeleteRequest, readSimS3PublicAccessBlock, readSimS3WebsiteConfiguration, } from "./sim-s3-api-xml-read.js";
 import { bucketBodyInput, bucketInput, listBucketsInput, listObjectsInput, listObjectsV2Input, } from "./sim-s3-api-input.js";
 import { listMultipartUploadsInput } from "./sim-s3-api-multipart-input.js";
@@ -35,6 +36,13 @@ export const simS3BucketApiRoutes = [
         commandName: "GetPublicAccessBlockCommand",
         input: bucketInput,
     },
+    {
+        method: "GET",
+        target: "bucket",
+        subResource: "encryption",
+        commandName: "GetBucketEncryptionCommand",
+        input: bucketInput,
+    },
     {
         method: "GET",
         target: "bucket",
@@ -84,6 +92,13 @@ export const simS3BucketApiRoutes = [
         commandName: "PutPublicAccessBlockCommand",
         input: (request) => bucketBodyInput(request, "PublicAccessBlockConfiguration", readSimS3PublicAccessBlock),
     },
+    {
+        method: "PUT",
+        target: "bucket",
+        subResource: "encryption",
+        commandName: "PutBucketEncryptionCommand",
+        input: (request) => bucketBodyInput(request, "ServerSideEncryptionConfiguration", readSimS3EncryptionConfiguration),
+    },
     {
         method: "PUT",
         target: "bucket",
@@ -111,6 +126,13 @@ export const simS3BucketApiRoutes = [
         commandName: "DeleteBucketPolicyCommand",
         input: bucketInput,
     },
+    {
+        method: "DELETE",
+        target: "bucket",
+        subResource: "encryption",
+        commandName: "DeleteBucketEncryptionCommand",
+        input: bucketInput,
+    },
     {
         method: "DELETE",
         target: "bucket",

package/dist/service/s3/serve/api/sim-s3-api-configuration-output.d.ts

@@ -8,6 +8,10 @@
  * Write a Block Public Access configuration.
  */
 export declare function publicAccessBlockXml(output: Record<string, unknown>): string;
+/**
+ * Write a Bucket's default encryption configuration.
+ */
+export declare function encryptionConfigurationXml(output: Record<string, unknown>): string;
 /**
  * Write an event notification configuration.
  */

package/dist/service/s3/serve/api/sim-s3-api-configuration-output.js

@@ -16,6 +16,16 @@ export function publicAccessBlockXml(output) {
         xmlValue("BlockPublicPolicy", configuration["BlockPublicPolicy"]) +
         xmlValue("RestrictPublicBuckets", configuration["RestrictPublicBuckets"]));
 }
+/**
+ * Write a Bucket's default encryption configuration.
+ */
+export function encryptionConfigurationXml(output) {
+    const configuration = (output["ServerSideEncryptionConfiguration"] ?? {});
+    return xmlDocument("ServerSideEncryptionConfiguration", (configuration.Rules ?? [])
+        .map((rule) => xmlElement("Rule", xmlElement("ApplyServerSideEncryptionByDefault", xmlValue("SSEAlgorithm", rule.ApplyServerSideEncryptionByDefault?.SSEAlgorithm) +
+        xmlValue("KMSMasterKeyID", rule.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID)) + xmlValue("BucketKeyEnabled", rule.BucketKeyEnabled)))
+        .join(""));
+}
 /**
  * Write an event notification configuration.
  */

package/dist/service/s3/serve/api/sim-s3-api-encryption-read.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Read a default encryption configuration.
+ *
+ * Real S3 takes one rule and the SDK sends a list, so the list is read here
+ * and the Bucket decides what to do with more than one of them.
+ */
+export declare function readSimS3EncryptionConfiguration(body: string): object;

package/dist/service/s3/serve/api/sim-s3-api-encryption-read.js

@@ -0,0 +1,30 @@
+import { parseXmlDocument, xmlBoolean, xmlChild, xmlChildren, xmlText, } from "../../../../util/xml/xml-document.js";
+/**
+ * Read a default encryption configuration.
+ *
+ * Real S3 takes one rule and the SDK sends a list, so the list is read here
+ * and the Bucket decides what to do with more than one of them.
+ */
+export function readSimS3EncryptionConfiguration(body) {
+    const root = parseXmlDocument(body);
+    return {
+        Rules: xmlChildren(root, "Rule").map((rule) => {
+            const byDefault = xmlChild(rule, "ApplyServerSideEncryptionByDefault");
+            return {
+                ...(byDefault !== undefined && {
+                    ApplyServerSideEncryptionByDefault: {
+                        ...defined("SSEAlgorithm", xmlText(byDefault, "SSEAlgorithm")),
+                        ...defined("KMSMasterKeyID", xmlText(byDefault, "KMSMasterKeyID")),
+                    },
+                }),
+                ...defined("BucketKeyEnabled", xmlBoolean(rule, "BucketKeyEnabled")),
+            };
+        }),
+    };
+}
+/**
+ * One member of a request document, or nothing where it was absent.
+ */
+function defined(name, value) {
+    return value === undefined ? {} : { [name]: value };
+}

package/dist/service/s3/serve/api/sim-s3-api-head-output.d.ts

@@ -9,9 +9,11 @@
  * Answer a HEAD with what a read would have said and none of the Object.
  *
  * The `content-length` describes the Object rather than the response, which is
- * what makes a HEAD worth sending.
+ * what makes a HEAD worth sending. A HEAD reads the same `response-` parameters
+ * a GET does, so a caller can see what a presigned URL would serve without
+ * fetching the Object.
  */
-export declare function simS3HeadObjectResponse(output: Record<string, unknown>): Response;
+export declare function simS3HeadObjectResponse(output: Record<string, unknown>, overrides: Readonly<Record<string, string>>): Response;
 /**
  * Answer that a Bucket is there and reachable.
  *