@kensio/yulin 1.21.3 → 1.21.4

package/dist/service/s3/serve/api/sim-s3-api-configuration-output.js

@@ -16,6 +16,16 @@ export function publicAccessBlockXml(output) {
         xmlValue("BlockPublicPolicy", configuration["BlockPublicPolicy"]) +
         xmlValue("RestrictPublicBuckets", configuration["RestrictPublicBuckets"]));
 }
+/**
+ * Write a Bucket's default encryption configuration.
+ */
+export function encryptionConfigurationXml(output) {
+    const configuration = (output["ServerSideEncryptionConfiguration"] ?? {});
+    return xmlDocument("ServerSideEncryptionConfiguration", (configuration.Rules ?? [])
+        .map((rule) => xmlElement("Rule", xmlElement("ApplyServerSideEncryptionByDefault", xmlValue("SSEAlgorithm", rule.ApplyServerSideEncryptionByDefault?.SSEAlgorithm) +
+        xmlValue("KMSMasterKeyID", rule.ApplyServerSideEncryptionByDefault?.KMSMasterKeyID)) + xmlValue("BucketKeyEnabled", rule.BucketKeyEnabled)))
+        .join(""));
+}
 /**
  * Write an event notification configuration.
  */

package/dist/service/s3/serve/api/sim-s3-api-encryption-read.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Read a default encryption configuration.
+ *
+ * Real S3 takes one rule and the SDK sends a list, so the list is read here
+ * and the Bucket decides what to do with more than one of them.
+ */
+export declare function readSimS3EncryptionConfiguration(body: string): object;

package/dist/service/s3/serve/api/sim-s3-api-encryption-read.js

@@ -0,0 +1,30 @@
+import { parseXmlDocument, xmlBoolean, xmlChild, xmlChildren, xmlText, } from "../../../../util/xml/xml-document.js";
+/**
+ * Read a default encryption configuration.
+ *
+ * Real S3 takes one rule and the SDK sends a list, so the list is read here
+ * and the Bucket decides what to do with more than one of them.
+ */
+export function readSimS3EncryptionConfiguration(body) {
+    const root = parseXmlDocument(body);
+    return {
+        Rules: xmlChildren(root, "Rule").map((rule) => {
+            const byDefault = xmlChild(rule, "ApplyServerSideEncryptionByDefault");
+            return {
+                ...(byDefault !== undefined && {
+                    ApplyServerSideEncryptionByDefault: {
+                        ...defined("SSEAlgorithm", xmlText(byDefault, "SSEAlgorithm")),
+                        ...defined("KMSMasterKeyID", xmlText(byDefault, "KMSMasterKeyID")),
+                    },
+                }),
+                ...defined("BucketKeyEnabled", xmlBoolean(rule, "BucketKeyEnabled")),
+            };
+        }),
+    };
+}
+/**
+ * One member of a request document, or nothing where it was absent.
+ */
+function defined(name, value) {
+    return value === undefined ? {} : { [name]: value };
+}

package/dist/service/s3/serve/api/sim-s3-api-head-output.d.ts

@@ -9,9 +9,11 @@
  * Answer a HEAD with what a read would have said and none of the Object.
  *
  * The `content-length` describes the Object rather than the response, which is
- * what makes a HEAD worth sending.
+ * what makes a HEAD worth sending. A HEAD reads the same `response-` parameters
+ * a GET does, so a caller can see what a presigned URL would serve without
+ * fetching the Object.
  */
-export declare function simS3HeadObjectResponse(output: Record<string, unknown>): Response;
+export declare function simS3HeadObjectResponse(output: Record<string, unknown>, overrides: Readonly<Record<string, string>>): Response;
 /**
  * Answer that a Bucket is there and reachable.
  *

package/dist/service/s3/serve/api/sim-s3-api-head-output.js

@@ -11,16 +11,22 @@ import { simS3SystemMetadataHeadersFrom } from "../../object/s3-system-metadata-
  * Answer a HEAD with what a read would have said and none of the Object.
  *
  * The `content-length` describes the Object rather than the response, which is
- * what makes a HEAD worth sending.
+ * what makes a HEAD worth sending. A HEAD reads the same `response-` parameters
+ * a GET does, so a caller can see what a presigned URL would serve without
+ * fetching the Object.
  */
-export function simS3HeadObjectResponse(output) {
+export function simS3HeadObjectResponse(output, overrides) {
     return new Response(undefined, {
         status: 200,
         headers: simS3ObjectResponseHeaders({
             metadata: simS3SystemMetadataHeadersFrom(output),
+            userMetadata: output["Metadata"],
+            overrides,
             bodyLength: output["ContentLength"] ?? 0,
             etag: output["ETag"],
             lastModified: output["LastModified"],
+            storageClass: output["StorageClass"],
+            serverSideEncryption: output["ServerSideEncryption"],
         }),
     });
 }

package/dist/service/s3/serve/api/sim-s3-api-input.d.ts

@@ -26,12 +26,6 @@ export declare function listObjectsV2Input(request: SimS3ApiRequest): object;
  * The first ListObjects input, which pages by marker.
  */
 export declare function listObjectsInput(request: SimS3ApiRequest): object;
-/**
- * The user metadata an upload carried, which S3 sends as `x-amz-meta-` headers.
- */
-export declare function simS3UserMetadata(headers: Headers): {
-    Metadata?: Record<string, string>;
-};
 /**
  * Include a member only when the request stated it, since an operation treats
  * an absent member and an empty one differently.

package/dist/service/s3/serve/api/sim-s3-api-input.js

@@ -38,6 +38,7 @@ export function listObjectsV2Input(request) {
         ...optional("ContinuationToken", request.query.get("continuation-token")),
         ...optional("StartAfter", request.query.get("start-after")),
         ...optionalNumber("MaxKeys", request.query.get("max-keys")),
+        ...optional("EncodingType", request.query.get("encoding-type")),
     };
 }
 /**
@@ -50,21 +51,9 @@ export function listObjectsInput(request) {
         ...optional("Delimiter", request.query.get("delimiter")),
         ...optional("Marker", request.query.get("marker")),
         ...optionalNumber("MaxKeys", request.query.get("max-keys")),
+        ...optional("EncodingType", request.query.get("encoding-type")),
     };
 }
-/**
- * The user metadata an upload carried, which S3 sends as `x-amz-meta-` headers.
- */
-export function simS3UserMetadata(headers) {
-    const prefix = "x-amz-meta-";
-    const metadata = {};
-    for (const [name, value] of headers) {
-        if (name.toLowerCase().startsWith(prefix)) {
-            metadata[name.slice(prefix.length).toLowerCase()] = value;
-        }
-    }
-    return Object.keys(metadata).length === 0 ? {} : { Metadata: metadata };
-}
 /**
  * Include a member only when the request stated it, since an operation treats
  * an absent member and an empty one differently.

package/dist/service/s3/serve/api/sim-s3-api-listing.d.ts

@@ -26,6 +26,7 @@ interface ListObjectsOutput {
     readonly StartAfter?: string | undefined;
     readonly Marker?: string | undefined;
     readonly NextMarker?: string | undefined;
+    readonly EncodingType?: string | undefined;
 }
 interface ListBucketsOutput {
     readonly Buckets?: readonly BucketSummary[] | undefined;
@@ -42,6 +43,10 @@ export declare function simS3ListBucketsXml(output: ListBucketsOutput): string;
  * Both listing versions answer in a `ListBucketResult`, and differ only in how
  * they say where the next page starts. The version is passed in because the
  * output alone cannot say which was asked for.
+ *
+ * The keys arrive encoded or not according to what the listing was asked for,
+ * so nothing is encoded here. `EncodingType` says which of the two a client is
+ * reading, and is absent from a listing that asked for no encoding.
  */
 export declare function simS3ListObjectsXml(output: ListObjectsOutput, version: 1 | 2): string;
 export {};

package/dist/service/s3/serve/api/sim-s3-api-listing.js

@@ -17,6 +17,10 @@ export function simS3ListBucketsXml(output) {
  * Both listing versions answer in a `ListBucketResult`, and differ only in how
  * they say where the next page starts. The version is passed in because the
  * output alone cannot say which was asked for.
+ *
+ * The keys arrive encoded or not according to what the listing was asked for,
+ * so nothing is encoded here. `EncodingType` says which of the two a client is
+ * reading, and is absent from a listing that asked for no encoding.
  */
 export function simS3ListObjectsXml(output, version) {
     const contents = (output.Contents ?? []).map(objectSummaryXml).join("");
@@ -26,6 +30,7 @@ export function simS3ListObjectsXml(output, version) {
     return xmlDocument("ListBucketResult", xmlValue("Name", output.Name) +
         xmlValue("Prefix", output.Prefix) +
         xmlValue("Delimiter", output.Delimiter) +
+        xmlValue("EncodingType", output.EncodingType) +
         xmlValue("MaxKeys", output.MaxKeys) +
         xmlValue("IsTruncated", output.IsTruncated ?? false) +
         pagingXml(output, version) +

package/dist/service/s3/serve/api/sim-s3-api-object-input.d.ts

@@ -15,6 +15,17 @@ export declare const simS3CopySourceHeader = "x-amz-copy-source";
  * The input of an operation naming one Object.
  */
 export declare function objectInput(request: SimS3ApiRequest): object;
+/**
+ * The input of an operation naming one Object, or one version of it.
+ *
+ * Real S3 names the version in the query string alongside the sub-resource, so
+ * a request naming none acts on whatever a plain read of the key answers with.
+ */
+export declare function versionedObjectInput(request: SimS3ApiRequest): object;
+/**
+ * The input of a tagging write, which carries its tag set as a document.
+ */
+export declare function putObjectTaggingInput(request: SimS3ApiRequest): object;
 /**
  * The input of a read, which can ask for part of an Object.
  */
@@ -36,5 +47,10 @@ export declare function copyObjectInput(request: SimS3ApiRequest): object;
 /**
  * The input of a request that describes an Object without carrying its bytes,
  * which is what starting a multipart upload is.
+ *
+ * The metadata headers are read by the list a write and a read share, so an
+ * upload over this endpoint describes an Object exactly as a `PutObjectCommand`
+ * does. Where S3 keeps the Object and how it encrypts it are read alongside
+ * them, being facts about the storage rather than metadata about the Object.
  */
 export declare function createMultipartUploadInput(request: SimS3ApiRequest): object;

package/dist/service/s3/serve/api/sim-s3-api-object-input.js

@@ -1,4 +1,6 @@
-import { optional, simS3UserMetadata } from "./sim-s3-api-input.js";
+import { simS3WriteMetadataHeaders } from "../../object/s3-write-metadata.js";
+import { optional, utf8 } from "./sim-s3-api-input.js";
+import { readSimS3Tagging } from "./sim-s3-api-tagging-read.js";
 /**
  * Reading the Object operations' inputs out of a request.
  *
@@ -17,6 +19,27 @@ export const simS3CopySourceHeader = "x-amz-copy-source";
 export function objectInput(request) {
     return { Bucket: request.bucketName, Key: request.objectKey };
 }
+/**
+ * The input of an operation naming one Object, or one version of it.
+ *
+ * Real S3 names the version in the query string alongside the sub-resource, so
+ * a request naming none acts on whatever a plain read of the key answers with.
+ */
+export function versionedObjectInput(request) {
+    return {
+        ...objectInput(request),
+        ...optional("VersionId", request.query.get("versionId")),
+    };
+}
+/**
+ * The input of a tagging write, which carries its tag set as a document.
+ */
+export function putObjectTaggingInput(request) {
+    return {
+        ...versionedObjectInput(request),
+        Tagging: readSimS3Tagging(utf8(request.body)),
+    };
+}
 /**
  * The input of a read, which can ask for part of an Object.
  */
@@ -46,21 +69,25 @@ export function copyObjectInput(request) {
         ...createMultipartUploadInput(request),
         ...optional("CopySource", request.headers.get(simS3CopySourceHeader)),
         ...optional("MetadataDirective", request.headers.get("x-amz-metadata-directive")),
+        ...optional("TaggingDirective", request.headers.get("x-amz-tagging-directive")),
     };
 }
 /**
  * The input of a request that describes an Object without carrying its bytes,
  * which is what starting a multipart upload is.
+ *
+ * The metadata headers are read by the list a write and a read share, so an
+ * upload over this endpoint describes an Object exactly as a `PutObjectCommand`
+ * does. Where S3 keeps the Object and how it encrypts it are read alongside
+ * them, being facts about the storage rather than metadata about the Object.
  */
 export function createMultipartUploadInput(request) {
     return {
         Bucket: request.bucketName,
         Key: request.objectKey,
-        ...optional("ContentType", request.headers.get("content-type")),
-        ...optional("CacheControl", request.headers.get("cache-control")),
-        ...optional("ContentDisposition", request.headers.get("content-disposition")),
-        ...optional("ContentEncoding", request.headers.get("content-encoding")),
-        ...optional("ContentLanguage", request.headers.get("content-language")),
-        ...simS3UserMetadata(request.headers),
+        ...simS3WriteMetadataHeaders(request.headers),
+        ...optional("StorageClass", request.headers.get("x-amz-storage-class")),
+        ...optional("Tagging", request.headers.get("x-amz-tagging")),
+        ...optional("ServerSideEncryption", request.headers.get("x-amz-server-side-encryption")),
     };
 }

package/dist/service/s3/serve/api/sim-s3-api-object-output.d.ts

@@ -11,13 +11,30 @@ interface CopyObjectOutput {
  * reads the new ETag and write time out of this body and nowhere else.
  */
 export declare function simS3CopyObjectXml(output: CopyObjectOutput): string;
+interface TagSetOutput {
+    readonly TagSet?: readonly {
+        readonly Key?: string;
+        readonly Value?: string;
+    }[];
+}
+/**
+ * Write the tags on an Object as the document real S3 answers them with.
+ *
+ * An Object nobody has tagged answers with an empty `TagSet` element rather
+ * than none at all, which is what tells a client the Object exists and carries
+ * no tags.
+ */
+export declare function simS3ObjectTaggingXml(output: TagSetOutput): string;
 /**
  * Answer a read with the Object itself, headers and all.
  *
+ * The headers the read named in its `response-` parameters are served in place
+ * of the Object's own, leaving what the Object was written with alone.
+ *
  * A read that asked for part of the Object is answered `206 Partial Content`
  * and says which part it carries, because a client reading a large Object in
  * pieces at once writes each response at the offset it asked for, and a `200`
  * carrying the whole Object would be written over its neighbours.
  */
-export declare function simS3GetObjectResponse(output: Record<string, unknown>): Promise<Response>;
+export declare function simS3GetObjectResponse(output: Record<string, unknown>, overrides: Readonly<Record<string, string>>): Promise<Response>;
 export {};

package/dist/service/s3/serve/api/sim-s3-api-object-output.js

@@ -1,4 +1,4 @@
-import { xmlDocument, xmlValue } from "../../../../util/xml/xml-writer.js";
+import { xmlDocument, xmlElement, xmlValue, } from "../../../../util/xml/xml-writer.js";
 import { simS3ObjectResponseHeaders } from "../../object/s3-object-response-headers.js";
 import { simS3SystemMetadataHeadersFrom } from "../../object/s3-system-metadata-read.js";
 /**
@@ -12,25 +12,44 @@ export function simS3CopyObjectXml(output) {
     return xmlDocument("CopyObjectResult", xmlValue("ETag", result.ETag) +
         xmlValue("LastModified", result.LastModified));
 }
+/**
+ * Write the tags on an Object as the document real S3 answers them with.
+ *
+ * An Object nobody has tagged answers with an empty `TagSet` element rather
+ * than none at all, which is what tells a client the Object exists and carries
+ * no tags.
+ */
+export function simS3ObjectTaggingXml(output) {
+    return xmlDocument("Tagging", xmlElement("TagSet", (output.TagSet ?? [])
+        .map((tag) => xmlElement("Tag", xmlValue("Key", tag.Key) + xmlValue("Value", tag.Value)))
+        .join("")));
+}
 /**
  * Answer a read with the Object itself, headers and all.
  *
+ * The headers the read named in its `response-` parameters are served in place
+ * of the Object's own, leaving what the Object was written with alone.
+ *
  * A read that asked for part of the Object is answered `206 Partial Content`
  * and says which part it carries, because a client reading a large Object in
  * pieces at once writes each response at the offset it asked for, and a `200`
  * carrying the whole Object would be written over its neighbours.
  */
-export async function simS3GetObjectResponse(output) {
+export async function simS3GetObjectResponse(output, overrides) {
     const body = await objectBodyBytes(output["Body"]);
     const contentRange = output["ContentRange"];
     return new Response(body, {
         status: contentRange === undefined ? 200 : 206,
         headers: simS3ObjectResponseHeaders({
             metadata: simS3SystemMetadataHeadersFrom(output),
+            userMetadata: output["Metadata"],
+            overrides,
             bodyLength: body.length,
             etag: output["ETag"],
             lastModified: output["LastModified"],
             contentRange,
+            storageClass: output["StorageClass"],
+            serverSideEncryption: output["ServerSideEncryption"],
         }),
     });
 }

package/dist/service/s3/serve/api/sim-s3-api-object-routes.js

@@ -1,4 +1,4 @@
-import { copyObjectInput, createMultipartUploadInput, getObjectInput, objectInput, putObjectInput, simS3CopySourceHeader, } from "./sim-s3-api-object-input.js";
+import { copyObjectInput, createMultipartUploadInput, getObjectInput, objectInput, putObjectInput, putObjectTaggingInput, simS3CopySourceHeader, versionedObjectInput, } from "./sim-s3-api-object-input.js";
 import { completeMultipartUploadInput, uploadInput, uploadPartInput, } from "./sim-s3-api-multipart-input.js";
 /**
  * The Object-level S3 operations this endpoint serves.
@@ -16,6 +16,13 @@ export const simS3ObjectApiRoutes = [
         commandName: "GetObjectCommand",
         input: getObjectInput,
     },
+    {
+        method: "GET",
+        target: "object",
+        subResource: "tagging",
+        commandName: "GetObjectTaggingCommand",
+        input: versionedObjectInput,
+    },
     {
         method: "GET",
         target: "object",
@@ -56,6 +63,13 @@ export const simS3ObjectApiRoutes = [
         commandName: "UploadPartCommand",
         input: uploadPartInput,
     },
+    {
+        method: "PUT",
+        target: "object",
+        subResource: "tagging",
+        commandName: "PutObjectTaggingCommand",
+        input: putObjectTaggingInput,
+    },
     {
         // A copy and an upload are both a `PUT` on an Object path, and the copy
         // names its source in a header. Matched first, so an upload carrying no
@@ -72,6 +86,13 @@ export const simS3ObjectApiRoutes = [
         commandName: "PutObjectCommand",
         input: putObjectInput,
     },
+    {
+        method: "DELETE",
+        target: "object",
+        subResource: "tagging",
+        commandName: "DeleteObjectTaggingCommand",
+        input: versionedObjectInput,
+    },
     {
         method: "DELETE",
         target: "object",

package/dist/service/s3/serve/api/sim-s3-api-output.d.ts

@@ -5,5 +5,9 @@
  * the operation rather than of its output: a listing answers in XML, a read
  * answers with the Object itself, and a write answers with a status and
  * headers alone.
+ *
+ * The request's query string is read alongside the output because a read can
+ * name the headers it wants served in place of the Object's own, and those are
+ * a property of the request rather than of what the operation answered.
  */
-export declare function simS3ApiResponse(commandName: string, output: unknown): Promise<Response>;
+export declare function simS3ApiResponse(commandName: string, output: unknown, query: URLSearchParams): Promise<Response>;

package/dist/service/s3/serve/api/sim-s3-api-output.js

@@ -1,8 +1,9 @@
-import { deleteResultXml, notificationConfigurationXml, publicAccessBlockXml, } from "./sim-s3-api-configuration-output.js";
+import { deleteResultXml, encryptionConfigurationXml, notificationConfigurationXml, publicAccessBlockXml, } from "./sim-s3-api-configuration-output.js";
 import { simS3HeadBucketResponse, simS3HeadObjectResponse, } from "./sim-s3-api-head-output.js";
 import { simS3ListBucketsXml, simS3ListObjectsXml, } from "./sim-s3-api-listing.js";
 import { simS3MultipartResponse } from "./sim-s3-api-multipart-output.js";
-import { simS3CopyObjectXml, simS3GetObjectResponse, } from "./sim-s3-api-object-output.js";
+import { simS3CopyObjectXml, simS3GetObjectResponse, simS3ObjectTaggingXml, } from "./sim-s3-api-object-output.js";
+import { simS3ResponseHeaderOverrides } from "../../object/s3-object-response-headers.js";
 const xmlContentType = { "content-type": "application/xml" };
 /**
  * Build the HTTP response an S3 operation's output is sent as.
@@ -11,8 +12,12 @@ const xmlContentType = { "content-type": "application/xml" };
  * the operation rather than of its output: a listing answers in XML, a read
  * answers with the Object itself, and a write answers with a status and
  * headers alone.
+ *
+ * The request's query string is read alongside the output because a read can
+ * name the headers it wants served in place of the Object's own, and those are
+ * a property of the request rather than of what the operation answered.
  */
-export async function simS3ApiResponse(commandName, output) {
+export async function simS3ApiResponse(commandName, output, query) {
     const value = output;
     switch (commandName) {
         case "ListBucketsCommand": {
@@ -25,7 +30,7 @@ export async function simS3ApiResponse(commandName, output) {
             return xml(simS3ListObjectsXml(value, 2));
         }
         case "GetObjectCommand": {
-            return await simS3GetObjectResponse(value);
+            return await simS3GetObjectResponse(value, simS3ResponseHeaderOverrides(query));
         }
         case "GetBucketPolicyCommand": {
             // A Bucket policy is a JSON document, and real S3 answers this one
@@ -39,14 +44,20 @@ export async function simS3ApiResponse(commandName, output) {
         case "GetPublicAccessBlockCommand": {
             return xml(publicAccessBlockXml(value));
         }
+        case "GetBucketEncryptionCommand": {
+            return xml(encryptionConfigurationXml(value));
+        }
         case "GetBucketNotificationConfigurationCommand": {
             return xml(notificationConfigurationXml(value));
         }
+        case "GetObjectTaggingCommand": {
+            return xml(simS3ObjectTaggingXml(value));
+        }
         case "DeleteObjectsCommand": {
             return xml(deleteResultXml(value));
         }
         case "HeadObjectCommand": {
-            return simS3HeadObjectResponse(value);
+            return simS3HeadObjectResponse(value, simS3ResponseHeaderOverrides(query));
         }
         case "HeadBucketCommand": {
             return simS3HeadBucketResponse(value);

package/dist/service/s3/serve/api/sim-s3-api-request.d.ts

@@ -17,12 +17,13 @@ export interface SimS3ApiRequest {
     readonly body: Uint8Array;
 }
 /**
- * Read a request that arrived at the served AWS API endpoint as an S3 request.
+ * Read a request addressed to the S3 REST API as an S3 request.
  *
- * Only path-style addressing is read here. A virtual-host request names its
- * Bucket in the hostname, and simulated Route 53 resolves that to the Bucket's
- * own endpoint before this endpoint is ever reached, so a request that gets
- * this far put its Bucket in the path.
+ * Both of the addressing styles real S3 offers are read, because both arrive
+ * here. A client given an endpoint URL sends path style, with the Bucket as
+ * the first path segment. An SDK resolving S3's own endpoint sends virtual
+ * host style, with the Bucket in the hostname, and function code bundling the
+ * SDK reaches this endpoint with exactly that.
  */
 export declare function readSimS3ApiRequest(request: Request, body: Uint8Array): SimS3ApiRequest;
 /**

package/dist/service/s3/serve/api/sim-s3-api-request.js

@@ -1,19 +1,19 @@
 /**
- * Read a request that arrived at the served AWS API endpoint as an S3 request.
+ * The hostname label S3's own REST endpoints carry.
+ */
+const s3EndpointLabel = "s3";
+/**
+ * Read a request addressed to the S3 REST API as an S3 request.
  *
- * Only path-style addressing is read here. A virtual-host request names its
- * Bucket in the hostname, and simulated Route 53 resolves that to the Bucket's
- * own endpoint before this endpoint is ever reached, so a request that gets
- * this far put its Bucket in the path.
+ * Both of the addressing styles real S3 offers are read, because both arrive
+ * here. A client given an endpoint URL sends path style, with the Bucket as
+ * the first path segment. An SDK resolving S3's own endpoint sends virtual
+ * host style, with the Bucket in the hostname, and function code bundling the
+ * SDK reaches this endpoint with exactly that.
  */
 export function readSimS3ApiRequest(request, body) {
     const url = new URL(request.url);
-    // The first segment is the Bucket and everything after it is the key, which
-    // can itself contain slashes.
-    const path = url.pathname.replace(/^\//, "");
-    const separator = path.indexOf("/");
-    const bucketName = separator === -1 ? path : path.slice(0, separator);
-    const objectKey = separator === -1 ? "" : path.slice(separator + 1);
+    const { bucketName, objectKey } = simS3ApiRequestTargetNames(url.hostname, url.pathname.replace(/^\//, ""));
     return {
         method: request.method,
         bucketName: decodeURIComponent(bucketName),
@@ -23,6 +23,50 @@ export function readSimS3ApiRequest(request, body) {
         body,
     };
 }
+/**
+ * Split what a request addressed into the Bucket it names and the Object key
+ * below it, still encoded as they were sent.
+ *
+ * A virtual host request names its Bucket in the hostname, which leaves its
+ * whole path as the key. A path style request names both in the path, where
+ * the first segment is the Bucket and everything after it is the key, which
+ * can itself contain slashes.
+ */
+function simS3ApiRequestTargetNames(hostname, path) {
+    const hostedBucketName = simS3VirtualHostBucketName(hostname);
+    if (hostedBucketName !== undefined) {
+        return { bucketName: hostedBucketName, objectKey: path };
+    }
+    const separator = path.indexOf("/");
+    if (separator === -1) {
+        return { bucketName: path, objectKey: "" };
+    }
+    return {
+        bucketName: path.slice(0, separator),
+        objectKey: path.slice(separator + 1),
+    };
+}
+/**
+ * The Bucket a virtual host style hostname names, or nothing for a hostname
+ * that names none.
+ *
+ * S3's own endpoint hostnames carry an `s3` label, and virtual host style puts
+ * the Bucket in front of it, as in `<bucket>.s3.<region>.amazonaws.com`. Path
+ * style is the same hostname with nothing in front. The labels before the
+ * first `s3` label are the Bucket, and an empty set of them is path style.
+ *
+ * A Bucket name can contain dots. One Bucket is then several hostname labels,
+ * joined back together here.
+ *
+ * A hostname carrying no `s3` label names no Bucket. That covers the local
+ * endpoint an `--endpoint-url` client sends, which addresses every service on
+ * one hostname and can only be path style.
+ */
+function simS3VirtualHostBucketName(hostname) {
+    const labels = hostname.split(".");
+    const endpoint = labels.indexOf(s3EndpointLabel);
+    return endpoint <= 0 ? undefined : labels.slice(0, endpoint).join(".");
+}
 /**
  * Decode an Object key from the path it was sent in.
  *

package/dist/service/s3/serve/api/sim-s3-api-routes.js

@@ -13,6 +13,8 @@ const servedSubResources = [
     "delete",
     "uploads",
     "uploadId",
+    "encryption",
+    "tagging",
 ];
 /**
  * Every sub-resource S3 defines, served here or not.
@@ -29,7 +31,6 @@ const knownSubResources = new Set([
     "acl",
     "analytics",
     "cors",
-    "encryption",
     "intelligent-tiering",
     "inventory",
     "legal-hold",
@@ -45,7 +46,6 @@ const knownSubResources = new Set([
     "restore",
     "retention",
     "select",
-    "tagging",
     "torrent",
     "versioning",
     "versions",

package/dist/service/s3/serve/api/sim-s3-api-tagging-read.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Read the tag set a PutObjectTagging body carries.
+ *
+ * This sits apart from the other request-body readers because it is the only
+ * one about an Object rather than about a Bucket's configuration. A tag naming
+ * no key comes through with none, so the tagging command refuses it rather than
+ * the reader silently dropping it.
+ */
+export declare function readSimS3Tagging(body: string): object;

package/dist/service/s3/serve/api/sim-s3-api-tagging-read.js

@@ -0,0 +1,14 @@
+import { parseXmlDocument, xmlChild, xmlChildren, xmlText, } from "../../../../util/xml/xml-document.js";
+/**
+ * Read the tag set a PutObjectTagging body carries.
+ *
+ * This sits apart from the other request-body readers because it is the only
+ * one about an Object rather than about a Bucket's configuration. A tag naming
+ * no key comes through with none, so the tagging command refuses it rather than
+ * the reader silently dropping it.
+ */
+export function readSimS3Tagging(body) {
+    return {
+        TagSet: xmlChildren(xmlChild(parseXmlDocument(body), "TagSet"), "Tag").map((tag) => ({ Key: xmlText(tag, "Key"), Value: xmlText(tag, "Value") })),
+    };
+}

package/dist/service/s3/serve/api/sim-s3-api.d.ts

@@ -22,7 +22,13 @@ export declare class SimS3ApiEndpoint {
      * The Region is the one the request was signed for, read from its credential
      * scope, so it arrives as whatever the client wrote rather than as a Region
      * the simulator has already recognised.
+     *
+     * A request nothing has authenticated arrives with no caller, and runs as
+     * the ambient caller of whatever sent it, in the same way an intercepted SDK
+     * client's Command does. A sim Lambda's outbound call relies on that. Its
+     * signature is over placeholder credentials, and the invocation is already
+     * running as the execution Role.
      */
-    handle(request: Request, body: Uint8Array, caller: SimAwsCaller, regionName: string): Promise<Response>;
+    handle(request: Request, body: Uint8Array, caller: SimAwsCaller | undefined, regionName: string): Promise<Response>;
 }
 export {};