@kensio/yulin 1.21.3 → 1.21.4

package/dist/service/lambda/serve/response/sim-lambda-url-cors-headers.js

@@ -0,0 +1,96 @@
+/**
+ * The request header a browser states the method it is asking about in.
+ *
+ * A preflight names it and nothing else does. That is what separates a
+ * preflight from an ordinary `OPTIONS` request the function should handle.
+ */
+const requestMethodHeader = "access-control-request-method";
+/**
+ * The CORS headers one Function URL configuration decides for a request.
+ *
+ * Lambda adds these to every response the URL serves, and answers a preflight
+ * with them itself. `AllowOrigins` is the one member whose header depends on
+ * the request. A browser reads one value there, so Lambda sends back either the
+ * Origin that asked or the wildcard.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/dg/urls-configuration.html
+ */
+export class SimLambdaUrlCorsHeaders {
+    cors;
+    constructor(cors) {
+        this.cors = cors;
+    }
+    /**
+     * Whether this request is the preflight a browser sends before a
+     * cross-origin call it is not allowed to make blind.
+     */
+    isPreflight(request) {
+        return (request.method === "OPTIONS" &&
+            request.headers.has("origin") &&
+            request.headers.has(requestMethodHeader));
+    }
+    /**
+     * The answer Lambda gives a preflight request itself.
+     *
+     * The function never runs for one. The configured headers are the whole
+     * response, and the handler has said nothing that could conflict with them.
+     */
+    preflightResponse(request) {
+        const headers = new Headers();
+        this.apply(headers, request);
+        return new Response(null, { status: 200, headers });
+    }
+    /**
+     * Add the configured CORS headers to a response the function produced.
+     *
+     * They are appended. A handler that sends CORS headers of its own keeps them
+     * and the response carries both values, which is what AWS documents for
+     * anything but a preflight.
+     */
+    apply(headers, request) {
+        const allowOrigin = this.allowOrigin(request.headers.get("origin"));
+        if (allowOrigin !== undefined) {
+            headers.append("access-control-allow-origin", allowOrigin);
+        }
+        // A false Access-Control-Allow-Credentials is not a value the fetch spec
+        // recognises. The header is left off instead.
+        if (this.cors.AllowCredentials === true) {
+            headers.append("access-control-allow-credentials", "true");
+        }
+        this.appendList(headers, "allow-methods", this.cors.AllowMethods);
+        this.appendList(headers, "allow-headers", this.cors.AllowHeaders);
+        this.appendList(headers, "expose-headers", this.cors.ExposeHeaders);
+        if (this.cors.MaxAge !== undefined) {
+            headers.append("access-control-max-age", String(this.cors.MaxAge));
+        }
+    }
+    /**
+     * Which Origin this request is told it may read the response from.
+     *
+     * A list holding the wildcard allows every Origin outright. Otherwise the
+     * Origin has to be one the list names. A request carrying no Origin at all,
+     * such as one from curl, is told nothing.
+     */
+    allowOrigin(requestOrigin) {
+        const allowOrigins = this.cors.AllowOrigins ?? [];
+        if (allowOrigins.includes("*")) {
+            return "*";
+        }
+        if (requestOrigin === null || !allowOrigins.includes(requestOrigin)) {
+            return undefined;
+        }
+        return requestOrigin;
+    }
+    /**
+     * Send a configured list as one comma-separated header.
+     *
+     * An empty list names nothing. A header carrying an empty value says
+     * something else to a browser, so the header is left off.
+     */
+    appendList(headers, suffix, values) {
+        if (values === undefined || values.length === 0) {
+            return;
+        }
+        headers.append(`access-control-${suffix}`, values.join(","));
+    }
+}

package/dist/service/lambda/serve/sim-lambda-controller.d.ts

@@ -16,6 +16,11 @@ interface SimLambdaServiceControllerProperties {
  * Either way the function itself runs as its execution Role, as it does for
  * any other invocation. Who invoked it and what it runs as are separate
  * questions on real Lambda, and stay separate here.
+ *
+ * A URL configured for CORS answers a preflight request itself, once the
+ * request has got past whatever its auth type asks of it. A browser cannot sign
+ * a preflight, and an `AWS_IAM` URL refuses one on the same terms it refuses
+ * any other unsigned request.
  */
 export declare class SimLambdaServiceController implements SimAwsServiceController {
     private readonly router;
@@ -46,6 +51,15 @@ export declare class SimLambdaServiceController implements SimAwsServiceControll
      * payload, so it is refused here rather than reaching the function.
      */
     private invokeAuthenticated;
+    /**
+     * Serve a request the Function URL has admitted.
+     *
+     * CORS is settled around the invocation. A preflight is answered from the
+     * configuration alone, and every other response carries the configured
+     * headers alongside whatever the handler sent, including a duplicate where
+     * the two disagree.
+     */
     private invoke;
+    private invokeFunction;
 }
 export {};

package/dist/service/lambda/serve/sim-lambda-controller.js

@@ -2,6 +2,7 @@ import { SimPayload2EventBuilder } from "../../../serve/payload-2/sim-payload-2-
 import { SimPayload2ResponseBuilder } from "../../../serve/payload-2/sim-payload-2-response-builder.js";
 import { SimAws } from "../../aws/sim-aws.js";
 import { simLambdaUrlEndpoint } from "./event/sim-lambda-url-endpoint.js";
+import { SimLambdaUrlCorsHeaders } from "./response/sim-lambda-url-cors-headers.js";
 import { SimLambdaUrlErrorResponse } from "./response/sim-lambda-url-error-response.js";
 import { SimLambdaUrlRouter, } from "./sim-lambda-url-router.js";
 import { SimLambdaUrlAuthorizer } from "./auth/sim-lambda-url-authorizer.js";
@@ -17,6 +18,11 @@ import { simLambdaUrlPayloadRefusal } from "./auth/sim-lambda-url-payload-hash.j
  * Either way the function itself runs as its execution Role, as it does for
  * any other invocation. Who invoked it and what it runs as are separate
  * questions on real Lambda, and stay separate here.
+ *
+ * A URL configured for CORS answers a preflight request itself, once the
+ * request has got past whatever its auth type asks of it. A browser cannot sign
+ * a preflight, and an `AWS_IAM` URL refuses one on the same terms it refuses
+ * any other unsigned request.
  */
 export class SimLambdaServiceController {
     router;
@@ -82,7 +88,28 @@ export class SimLambdaServiceController {
         }
         return await this.invoke(route, serviceRequest.request, caller);
     }
+    /**
+     * Serve a request the Function URL has admitted.
+     *
+     * CORS is settled around the invocation. A preflight is answered from the
+     * configuration alone, and every other response carries the configured
+     * headers alongside whatever the handler sent, including a duplicate where
+     * the two disagree.
+     */
     async invoke(route, request, authenticatedCaller) {
+        const { cors } = route.functionUrl;
+        if (cors === undefined) {
+            return await this.invokeFunction(route, request, authenticatedCaller);
+        }
+        const corsHeaders = new SimLambdaUrlCorsHeaders(cors);
+        if (corsHeaders.isPreflight(request)) {
+            return corsHeaders.preflightResponse(request);
+        }
+        const response = await this.invokeFunction(route, request, authenticatedCaller);
+        corsHeaders.apply(response.headers, request);
+        return response;
+    }
+    async invokeFunction(route, request, authenticatedCaller) {
         try {
             const event = await this.eventBuilder.build(request, simLambdaUrlEndpoint(route.functionUrl), { caller: authenticatedCaller });
             return this.responseBuilder.build(await route.simFunction.invoke(event));

package/dist/service/lambda/sim-lambda-commands.d.ts

@@ -18,6 +18,7 @@ import type { SimLambdaVmSdkModuleProvider } from "./function/code/vm/sdk/sim-la
 import type { SimCloudWatchServiceWriter } from "../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import type { SimLogsServiceWriter } from "../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaOutboundHttp } from "./function/outbound/sim-lambda-outbound-http.js";
+import { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 import { SimLambdaEventInvokeConfigStore } from "./function/event-invoke/sim-lambda-event-invoke-config-store.js";
 import { type SimLambdaDestinationTargets } from "./destination/sim-lambda-destination-targets.js";
 import type { SimLambdaFunctionMap } from "./function/sim-lambda-function.js";
@@ -79,6 +80,15 @@ export declare class SimLambdaCommands {
     readonly functionUrlStore: SimLambdaFunctionUrlStore;
     readonly versionStore: SimLambdaFunctionVersionStore;
     readonly aliasStore: SimLambdaFunctionAliasStore;
+    /**
+     * Where this simulated Lambda's functions send what they print, besides
+     * their own log groups.
+     *
+     * Shared across every function so that one setting covers a simulation with
+     * several of them, and read as each line is written so that a function that
+     * has already cold started follows a change.
+     */
+    readonly output: SimLambdaOutput;
     readonly functionLookup: SimLambdaFunctionLookup;
     readonly eventInvokeConfigStore: SimLambdaEventInvokeConfigStore;
     readonly functions: SimLambdaFunctionCommands;

package/dist/service/lambda/sim-lambda-commands.js

@@ -14,6 +14,7 @@ import { SimLambdaNoEventSourceStreams, } from "./event-source/stream/sim-lambda
 import { SimLambdaNoKinesisStreams } from "./event-source/stream/kinesis/sim-lambda-no-kinesis-streams.js";
 import { SimLambdaNoContainerImages, } from "./function/code/image/sim-lambda-container-images.js";
 import { SimLambdaEnvironmentConflicts } from "./function/environment/sim-lambda-environment-conflicts.js";
+import { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 import { SimLambdaEventInvokeConfigStore } from "./function/event-invoke/sim-lambda-event-invoke-config-store.js";
 import { SimLambdaNoDestinationTargets, } from "./destination/sim-lambda-destination-targets.js";
 import { SimLambdaFunctionLookup } from "./function/url/sim-lambda-function-lookup.js";
@@ -41,6 +42,15 @@ export class SimLambdaCommands {
     aliasStore = new SimLambdaFunctionAliasStore({
         versions: this.versionStore,
     });
+    /**
+     * Where this simulated Lambda's functions send what they print, besides
+     * their own log groups.
+     *
+     * Shared across every function so that one setting covers a simulation with
+     * several of them, and read as each line is written so that a function that
+     * has already cold started follows a change.
+     */
+    output = new SimLambdaOutput();
     functionLookup;
     eventInvokeConfigStore;
     functions;
@@ -142,6 +152,7 @@ export class SimLambdaCommands {
             containerImages,
             vmSdkModuleProvider,
             logs,
+            output: this.output,
             metrics,
             outboundHttp,
         });

package/dist/service/lambda/sim-lambda.d.ts

@@ -1,6 +1,7 @@
 import type { SimSdkCommandRouter } from "../../sdk/index.js";
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimLambdaContainerImages } from "./function/code/image/sim-lambda-container-images.js";
+import type { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 import type { SimLambdaFunctionMap } from "./function/sim-lambda-function.js";
 import type * as simLambdaCommands from "./command/sim-lambda-command.types.js";
 import { SimLambdaCommands, type SimLambdaProperties } from "./sim-lambda-commands.js";
@@ -32,6 +33,17 @@ export declare class SimLambda extends SimLambdaEventInvokeOperations {
      * @internal
      */
     containerImages(): SimLambdaContainerImages;
+    /**
+     * Where this simulated Lambda's functions send what they print, besides the
+     * log group they always reach. The host console gets a copy until told
+     * otherwise, and these settings belong to one Account and Region as the
+     * functions do.
+     *
+     * ```typescript
+     * simAws.lambda().output().captureOnly();
+     * ```
+     */
+    output(): SimLambdaOutput;
     /** Handle a Create Function Command from the SDK. */
     createFunction(command: simLambdaCommands.SimCreateFunctionCommand, options?: SimLambdaRequestOptions): Promise<simLambdaCommands.SimCreateFunctionCommandOutput>;
     /** Handle a Get Function Command from the SDK. */

package/dist/service/lambda/sim-lambda.js

@@ -39,6 +39,19 @@ export class SimLambda extends SimLambdaEventInvokeOperations {
     containerImages() {
         return this.commands.containerImages;
     }
+    /**
+     * Where this simulated Lambda's functions send what they print, besides the
+     * log group they always reach. The host console gets a copy until told
+     * otherwise, and these settings belong to one Account and Region as the
+     * functions do.
+     *
+     * ```typescript
+     * simAws.lambda().output().captureOnly();
+     * ```
+     */
+    output() {
+        return this.commands.output;
+    }
     /** Handle a Create Function Command from the SDK. */
     async createFunction(command, options) {
         return await this.commands.functions.create(command, options);

package/dist/service/s3/bucket/encryption/sim-s3-bucket-encryption.d.ts

@@ -0,0 +1,67 @@
+import { type SimS3ServerSideEncryption } from "../../object/s3-server-side-encryption.js";
+/**
+ * The encryption a Bucket applies to an Object whose write named none.
+ */
+export interface SimS3ServerSideEncryptionByDefault {
+    readonly SSEAlgorithm?: string | undefined;
+    readonly KMSMasterKeyID?: string | undefined;
+}
+/**
+ * One rule of a Bucket's default encryption configuration.
+ *
+ * Real S3 takes exactly one. `BucketKeyEnabled` says whether S3 uses a bucket
+ * key to cut KMS calls, and is stored and read back here without acting.
+ */
+export interface SimS3ServerSideEncryptionRule {
+    readonly ApplyServerSideEncryptionByDefault?: SimS3ServerSideEncryptionByDefault | undefined;
+    readonly BucketKeyEnabled?: boolean | undefined;
+}
+/**
+ * A Bucket's default encryption configuration, as a request states it.
+ */
+export interface SimS3ServerSideEncryptionConfiguration {
+    readonly Rules?: readonly SimS3ServerSideEncryptionRule[] | undefined;
+}
+interface SimS3BucketEncryptionProperties {
+    readonly rules?: readonly SimS3ServerSideEncryptionRule[] | undefined;
+}
+/**
+ * The default encryption of one simulated S3 Bucket.
+ *
+ * Nothing is encrypted. The bytes of an Object are stored as they arrive, and
+ * its ETag stays the MD5 of them, which is what real S3 reports for an
+ * SSE-S3 Object as well. What this decides is the algorithm a write stamps on
+ * an Object when it names none itself, and what `GetBucketEncryption` answers.
+ *
+ * A Bucket nobody has configured is SSE-S3 encrypted. Real S3 has applied that
+ * default to every Bucket since January 2023, and answers a read of an
+ * unconfigured Bucket with the same `AES256` rule as one configured that way.
+ */
+export declare class SimS3BucketEncryption {
+    private readonly storedRules;
+    constructor(properties?: SimS3BucketEncryptionProperties);
+    /**
+     * The encryption a Bucket nobody has configured has, which is what
+     * `DeleteBucketEncryption` puts a Bucket back to.
+     */
+    static default(): SimS3BucketEncryption;
+    /**
+     * The encryption a PutBucketEncryption request asks for.
+     *
+     * Every algorithm named is read here, before the Bucket is changed, so a
+     * configuration real S3 refuses leaves the Bucket as it was.
+     */
+    static fromConfiguration(configuration: SimS3ServerSideEncryptionConfiguration, bucketName: string): SimS3BucketEncryption;
+    /**
+     * The algorithm this Bucket stamps on an Object written without one.
+     */
+    get algorithm(): SimS3ServerSideEncryption;
+    /**
+     * The configuration a read of the Bucket answers with.
+     *
+     * Cloned on the way out, so a caller holding what it was given cannot change
+     * what the Bucket applies by mutating it.
+     */
+    get configuration(): SimS3ServerSideEncryptionConfiguration;
+}
+export {};

package/dist/service/s3/bucket/encryption/sim-s3-bucket-encryption.js

@@ -0,0 +1,69 @@
+import { simS3DefaultServerSideEncryption, simS3ServerSideEncryptionFrom, } from "../../object/s3-server-side-encryption.js";
+/**
+ * The default encryption of one simulated S3 Bucket.
+ *
+ * Nothing is encrypted. The bytes of an Object are stored as they arrive, and
+ * its ETag stays the MD5 of them, which is what real S3 reports for an
+ * SSE-S3 Object as well. What this decides is the algorithm a write stamps on
+ * an Object when it names none itself, and what `GetBucketEncryption` answers.
+ *
+ * A Bucket nobody has configured is SSE-S3 encrypted. Real S3 has applied that
+ * default to every Bucket since January 2023, and answers a read of an
+ * unconfigured Bucket with the same `AES256` rule as one configured that way.
+ */
+export class SimS3BucketEncryption {
+    storedRules;
+    constructor(properties = {}) {
+        this.storedRules = structuredClone(properties.rules ?? defaultRules);
+    }
+    /**
+     * The encryption a Bucket nobody has configured has, which is what
+     * `DeleteBucketEncryption` puts a Bucket back to.
+     */
+    static default() {
+        return new SimS3BucketEncryption();
+    }
+    /**
+     * The encryption a PutBucketEncryption request asks for.
+     *
+     * Every algorithm named is read here, before the Bucket is changed, so a
+     * configuration real S3 refuses leaves the Bucket as it was.
+     */
+    static fromConfiguration(configuration, bucketName) {
+        const rules = configuration.Rules ?? [];
+        for (const rule of rules) {
+            simS3ServerSideEncryptionFrom(rule.ApplyServerSideEncryptionByDefault?.SSEAlgorithm, `the default encryption of Bucket ${bucketName}`);
+        }
+        return new SimS3BucketEncryption({ rules });
+    }
+    /**
+     * The algorithm this Bucket stamps on an Object written without one.
+     */
+    get algorithm() {
+        const named = this.storedRules
+            .map((rule) => rule.ApplyServerSideEncryptionByDefault?.SSEAlgorithm)
+            .find((algorithm) => algorithm !== undefined);
+        return (simS3ServerSideEncryptionFrom(named, "a stored Bucket configuration") ??
+            simS3DefaultServerSideEncryption);
+    }
+    /**
+     * The configuration a read of the Bucket answers with.
+     *
+     * Cloned on the way out, so a caller holding what it was given cannot change
+     * what the Bucket applies by mutating it.
+     */
+    get configuration() {
+        return { Rules: structuredClone(this.storedRules) };
+    }
+}
+/**
+ * The rule real S3 reports for a Bucket nobody has configured.
+ */
+const defaultRules = [
+    {
+        ApplyServerSideEncryptionByDefault: {
+            SSEAlgorithm: simS3DefaultServerSideEncryption,
+        },
+        BucketKeyEnabled: false,
+    },
+];

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-configuration.d.ts

@@ -1,36 +1,8 @@
 import type { SimS3LifecycleConfiguration as SimS3LifecycleConfigurationInput, SimS3LifecycleRule } from "../../command/put-bucket-lifecycle-configuration/put-bucket-lifecycle-configuration.command.js";
+import type { SimS3LifecycleNoncurrentVersion, SimS3LifecycleObject, SimS3LifecycleUpload } from "./sim-s3-lifecycle-subject.js";
 interface SimS3LifecycleConfigurationProperties {
     readonly rules?: readonly SimS3LifecycleRule[];
 }
-/**
- * An Object as a lifecycle rule reads it.
- */
-export interface SimS3LifecycleObject {
-    readonly key: string;
-    readonly size: number;
-    readonly lastModified: Date;
-}
-/**
- * A noncurrent version as a lifecycle rule reads it.
- *
- * `newerVersionsAhead` is how many noncurrent versions of the same key are
- * newer than this one, which is what `NewerNoncurrentVersions` counts. The
- * current version is not one of them, since a rule for noncurrent versions
- * never reaches it.
- */
-export interface SimS3LifecycleNoncurrentVersion {
-    readonly key: string;
-    readonly size: number;
-    readonly noncurrentSince: Date | undefined;
-    readonly newerVersionsAhead: number;
-}
-/**
- * A multipart upload in progress as a lifecycle rule reads it.
- */
-export interface SimS3LifecycleUpload {
-    readonly key: string;
-    readonly initiated: Date;
-}
 /**
  * The lifecycle configuration of one simulated S3 Bucket.
  *
@@ -107,8 +79,9 @@ export declare class SimS3LifecycleConfiguration {
      *
      * Read from the stored rules rather than from `rules`, because every read of
      * a Bucket asks and cloning the whole configuration each time would be the
-     * cost of having one.
+     * cost of having one. A transition is worked out from these by
+     * `simS3TransitionedObjectClass`.
      */
-    private enabledRules;
+    get enabledRules(): readonly SimS3LifecycleRule[];
 }
 export {};

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-configuration.js

@@ -60,7 +60,7 @@ export class SimS3LifecycleConfiguration {
      * shortest one.
      */
     expires(object, now) {
-        return this.enabledRules().some((rule) => rule.Expiration !== undefined &&
+        return this.enabledRules.some((rule) => rule.Expiration !== undefined &&
             simS3LifecycleRuleSelects(rule, object) &&
             simS3LifecycleReached(simS3ObjectExpiryInstant(rule.Expiration, object.lastModified), now));
     }
@@ -73,7 +73,7 @@ export class SimS3LifecycleConfiguration {
      * reaches the third and everything older.
      */
     expiresNoncurrent(version, now) {
-        return this.enabledRules().some((rule) => {
+        return this.enabledRules.some((rule) => {
             const expiration = rule.NoncurrentVersionExpiration;
             return (expiration !== undefined &&
                 version.newerVersionsAhead >=
@@ -91,7 +91,7 @@ export class SimS3LifecycleConfiguration {
      * key in a listing once its last version has gone.
      */
     expiresDeleteMarker(key) {
-        return this.enabledRules().some((rule) => rule.Expiration?.ExpiredObjectDeleteMarker === true &&
+        return this.enabledRules.some((rule) => rule.Expiration?.ExpiredObjectDeleteMarker === true &&
             simS3LifecycleRuleSelects(rule, { key }));
     }
     /**
@@ -99,7 +99,7 @@ export class SimS3LifecycleConfiguration {
      * instant.
      */
     abandons(upload, now) {
-        return this.enabledRules().some((rule) => rule.AbortIncompleteMultipartUpload !== undefined &&
+        return this.enabledRules.some((rule) => rule.AbortIncompleteMultipartUpload !== undefined &&
             simS3LifecycleRuleSelects(rule, { key: upload.key }) &&
             simS3LifecycleReached(simS3UploadAbortInstant(rule.AbortIncompleteMultipartUpload, upload.initiated), now));
     }
@@ -108,9 +108,10 @@ export class SimS3LifecycleConfiguration {
      *
      * Read from the stored rules rather than from `rules`, because every read of
      * a Bucket asks and cloning the whole configuration each time would be the
-     * cost of having one.
+     * cost of having one. A transition is worked out from these by
+     * `simS3TransitionedObjectClass`.
      */
-    enabledRules() {
+    get enabledRules() {
         return this.storedRules.filter((rule) => rule.Status === "Enabled");
     }
 }

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-expiry.d.ts

@@ -32,3 +32,8 @@ export declare function simS3UploadAbortInstant(abort: SimS3LifecycleAbortIncomp
  * Whether simulated time has reached a boundary.
  */
 export declare function simS3LifecycleReached(boundary: Date | undefined, now: Date): boolean;
+/**
+ * The instant a number of days after another one, which is how every lifecycle
+ * boundary measured in days is reached.
+ */
+export declare function simS3LifecycleAfterDays(from: Date, days: number): Date;

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-expiry.js

@@ -14,7 +14,7 @@ const millisecondsPerDay = 24 * 60 * 60 * 1000;
  */
 export function simS3ObjectExpiryInstant(expiration, writtenAt) {
     if (expiration.Days !== undefined) {
-        return afterDays(writtenAt, expiration.Days);
+        return simS3LifecycleAfterDays(writtenAt, expiration.Days);
     }
     if (expiration.Date !== undefined) {
         return new Date(expiration.Date);
@@ -35,7 +35,7 @@ export function simS3NoncurrentExpiryInstant(expiration, noncurrentSince) {
         expiration.NoncurrentDays === undefined) {
         return undefined;
     }
-    return afterDays(noncurrentSince, expiration.NoncurrentDays);
+    return simS3LifecycleAfterDays(noncurrentSince, expiration.NoncurrentDays);
 }
 /**
  * The instant an `AbortIncompleteMultipartUpload` abandons an upload started
@@ -45,7 +45,7 @@ export function simS3UploadAbortInstant(abort, initiated) {
     if (abort.DaysAfterInitiation === undefined) {
         return undefined;
     }
-    return afterDays(initiated, abort.DaysAfterInitiation);
+    return simS3LifecycleAfterDays(initiated, abort.DaysAfterInitiation);
 }
 /**
  * Whether simulated time has reached a boundary.
@@ -53,6 +53,10 @@ export function simS3UploadAbortInstant(abort, initiated) {
 export function simS3LifecycleReached(boundary, now) {
     return boundary !== undefined && now.getTime() >= boundary.getTime();
 }
-function afterDays(from, days) {
+/**
+ * The instant a number of days after another one, which is how every lifecycle
+ * boundary measured in days is reached.
+ */
+export function simS3LifecycleAfterDays(from, days) {
     return new Date(from.getTime() + days * millisecondsPerDay);
 }

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-selection.d.ts

@@ -1,23 +1,10 @@
 import type { SimS3LifecycleRule } from "../../command/put-bucket-lifecycle-configuration/put-bucket-lifecycle-configuration.command.js";
-/**
- * What a lifecycle rule looks at to decide whether it selects something.
- *
- * An Object states its size and a multipart upload leaves it out. Half an
- * upload has no size for a rule to measure, and real S3 has no size to
- * measure either until the parts are joined.
- */
-export interface SimS3LifecycleSubject {
-    readonly key: string;
-    readonly size?: number | undefined;
-}
+import type { SimS3LifecycleSubject } from "./sim-s3-lifecycle-subject.js";
 /**
  * Whether a rule selects the Object or upload a key names.
  *
  * A rule states its scope either as the older top-level `Prefix` or as a
  * `Filter`. A rule with no scope at all covers every key in the Bucket. Real
  * S3 refuses a rule stating both.
- *
- * Simulated S3 has no Object tags. A `Tag` or a `TagFilters` entry names a
- * condition the simulator has no answer for, and selects no key.
  */
 export declare function simS3LifecycleRuleSelects(rule: SimS3LifecycleRule, subject: SimS3LifecycleSubject): boolean;

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-selection.js

@@ -4,9 +4,6 @@
  * A rule states its scope either as the older top-level `Prefix` or as a
  * `Filter`. A rule with no scope at all covers every key in the Bucket. Real
  * S3 refuses a rule stating both.
- *
- * Simulated S3 has no Object tags. A `Tag` or a `TagFilters` entry names a
- * condition the simulator has no answer for, and selects no key.
  */
 export function simS3LifecycleRuleSelects(rule, subject) {
     if (rule.Filter === undefined) {
@@ -19,16 +16,27 @@ function filterSelects(filter, subject) {
         return conjunctionSelects(filter.And, subject);
     }
     if (filter.Tag !== undefined) {
-        return false;
+        // A bare `Tag` filter is scoped by the tag alone. It says nothing about
+        // the key, so every Object carrying the tag is selected wherever it is.
+        return tagsSelect([filter.Tag], subject);
     }
     return (subject.key.startsWith(filter.Prefix ?? "") && sizeWithin(filter, subject));
 }
 function conjunctionSelects(operator, subject) {
-    if ((operator.Tags ?? []).length > 0) {
-        return false;
-    }
     return (subject.key.startsWith(operator.Prefix ?? "") &&
-        sizeWithin(operator, subject));
+        sizeWithin(operator, subject) &&
+        tagsSelect(operator.Tags ?? [], subject));
+}
+/**
+ * Whether the subject carries every tag the filter names.
+ *
+ * Both halves of a tag have to match, because a rule for `archive=true` says
+ * nothing about an Object tagged `archive=false`. A subject carrying no tag
+ * set at all, meaning an upload in progress or a delete marker, matches no
+ * named tag and is selected only by a filter naming none.
+ */
+function tagsSelect(tags, subject) {
+    return tags.every((tag) => subject.tags?.has(tag.Key ?? "", tag.Value ?? "") === true);
 }
 /**
  * Whether the subject's size falls inside the bounds a filter states.