@kensio/yulin 1.21.3 → 1.21.5

package/dist/service/lambda/function/url/sim-lambda-function-url.d.ts

@@ -1,6 +1,7 @@
 import type { Brand } from "../../../../util/brand.type.js";
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import type { SimLambdaFunctionName } from "../sim-lambda-function.js";
+import type { SimLambdaFunctionUrlCors } from "./sim-lambda-function-url-cors.js";
 import { type SimClock } from "../../../../util/clock/sim-clock.js";
 /**
  * The id AWS allocates for one Function URL, which is the leading DNS label of
@@ -31,6 +32,7 @@ interface SimLambdaFunctionUrlProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly authType?: SimLambdaFunctionUrlAuthType | undefined;
     readonly invokeMode?: SimLambdaFunctionUrlInvokeMode | undefined;
+    readonly cors?: SimLambdaFunctionUrlCors | undefined;
     /**
      * Clock stamping this Function URL's creation and last modified times. A
      * Function URL built standalone, outside a SimAws instance, falls back to the
@@ -42,12 +44,16 @@ interface SimLambdaFunctionUrlProperties {
  * Minimal structural Function URL configuration, as returned by the
  * CreateFunctionUrlConfig, GetFunctionUrlConfig and UpdateFunctionUrlConfig
  * commands.
+ *
+ * A URL configured without CORS has no `Cors` member at all. An empty block
+ * would still decide headers.
  */
 export interface SimLambdaFunctionUrlConfiguration {
     FunctionUrl: string;
     FunctionArn: string;
     AuthType: SimLambdaFunctionUrlAuthType;
     InvokeMode: SimLambdaFunctionUrlInvokeMode;
+    Cors?: SimLambdaFunctionUrlCors | undefined;
     CreationTime: string;
     LastModifiedTime: string;
 }
@@ -75,6 +81,11 @@ export declare class SimLambdaFunctionUrl {
      * Get the invocation mode for this Function URL.
      */
     get invokeMode(): SimLambdaFunctionUrlInvokeMode;
+    /**
+     * Get the CORS configuration for this Function URL. A URL without one sends
+     * no CORS headers of its own.
+     */
+    get cors(): SimLambdaFunctionUrlCors | undefined;
     /**
      * Get the endpoint hostname for this Function URL.
      */
@@ -88,10 +99,15 @@ export declare class SimLambdaFunctionUrl {
      * Apply an update to this Function URL's configuration.
      *
      * Omitted values are left as they are, as real UpdateFunctionUrlConfig does.
+     *
+     * A stated `Cors` replaces the whole block. An update naming only
+     * `AllowOrigins` drops the methods and headers the URL was created with, the
+     * way it does on AWS.
      */
     update(properties: {
         readonly authType?: SimLambdaFunctionUrlAuthType | undefined;
         readonly invokeMode?: SimLambdaFunctionUrlInvokeMode | undefined;
+        readonly cors?: SimLambdaFunctionUrlCors | undefined;
     }): void;
     /**
      * Get the AWS-like configuration for this Function URL.

package/dist/service/lambda/function/url/sim-lambda-function-url.js

@@ -23,10 +23,11 @@ export class SimLambdaFunctionUrl {
     creationTime;
     #authType;
     #invokeMode;
+    #cors;
     #lastModifiedTime;
     clock;
     constructor(properties) {
-        const { urlId, functionName, functionArn, accountRegionScope, authType = "NONE", invokeMode = "BUFFERED", clock = new SimRealClock(), } = properties;
+        const { urlId, functionName, functionArn, accountRegionScope, authType = "NONE", invokeMode = "BUFFERED", cors, clock = new SimRealClock(), } = properties;
         this.clock = clock;
         this.urlId = urlId;
         this.functionName = functionName;
@@ -34,6 +35,7 @@ export class SimLambdaFunctionUrl {
         this.accountRegionScope = accountRegionScope;
         this.#authType = authType;
         this.#invokeMode = invokeMode;
+        this.#cors = cors;
         this.creationTime = clock.now().toISOString();
         this.#lastModifiedTime = this.creationTime;
     }
@@ -49,6 +51,13 @@ export class SimLambdaFunctionUrl {
     get invokeMode() {
         return this.#invokeMode;
     }
+    /**
+     * Get the CORS configuration for this Function URL. A URL without one sends
+     * no CORS headers of its own.
+     */
+    get cors() {
+        return this.#cors;
+    }
     /**
      * Get the endpoint hostname for this Function URL.
      */
@@ -69,10 +78,15 @@ export class SimLambdaFunctionUrl {
      * Apply an update to this Function URL's configuration.
      *
      * Omitted values are left as they are, as real UpdateFunctionUrlConfig does.
+     *
+     * A stated `Cors` replaces the whole block. An update naming only
+     * `AllowOrigins` drops the methods and headers the URL was created with, the
+     * way it does on AWS.
      */
     update(properties) {
         this.#authType = properties.authType ?? this.#authType;
         this.#invokeMode = properties.invokeMode ?? this.#invokeMode;
+        this.#cors = properties.cors ?? this.#cors;
         this.#lastModifiedTime = this.clock.now().toISOString();
     }
     /**
@@ -84,6 +98,7 @@ export class SimLambdaFunctionUrl {
             FunctionArn: this.functionArn,
             AuthType: this.#authType,
             InvokeMode: this.#invokeMode,
+            ...(this.#cors !== undefined && { Cors: this.#cors }),
             CreationTime: this.creationTime,
             LastModifiedTime: this.#lastModifiedTime,
         };

package/dist/service/lambda/index.d.ts

@@ -1,4 +1,5 @@
 export { SimLambda } from "./sim-lambda.js";
+export { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 export { SimLambdaNoVmSdkModuleProvider, type SimLambdaVmSdkModuleProvider, } from "./function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
 export { SimSdkLambdaVmModuleProvider } from "./function/code/vm/sdk/sim-sdk-lambda-vm-module-provider.js";
 export { makeLambdaZipFileInput } from "./function/code/lambda-zip-file-input.js";

package/dist/service/lambda/index.js

@@ -1,4 +1,5 @@
 export { SimLambda } from "./sim-lambda.js";
+export { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 export { SimLambdaNoVmSdkModuleProvider, } from "./function/code/vm/sdk/sim-lambda-vm-sdk-module-provider.js";
 export { SimSdkLambdaVmModuleProvider } from "./function/code/vm/sdk/sim-sdk-lambda-vm-module-provider.js";
 export { makeLambdaZipFileInput } from "./function/code/lambda-zip-file-input.js";

package/dist/service/lambda/serve/response/sim-lambda-url-cors-headers.d.ts

@@ -0,0 +1,50 @@
+import type { SimLambdaFunctionUrlCors } from "../../function/url/sim-lambda-function-url-cors.js";
+/**
+ * The CORS headers one Function URL configuration decides for a request.
+ *
+ * Lambda adds these to every response the URL serves, and answers a preflight
+ * with them itself. `AllowOrigins` is the one member whose header depends on
+ * the request. A browser reads one value there, so Lambda sends back either the
+ * Origin that asked or the wildcard.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/dg/urls-configuration.html
+ */
+export declare class SimLambdaUrlCorsHeaders {
+    private readonly cors;
+    constructor(cors: SimLambdaFunctionUrlCors);
+    /**
+     * Whether this request is the preflight a browser sends before a
+     * cross-origin call it is not allowed to make blind.
+     */
+    isPreflight(request: Request): boolean;
+    /**
+     * The answer Lambda gives a preflight request itself.
+     *
+     * The function never runs for one. The configured headers are the whole
+     * response, and the handler has said nothing that could conflict with them.
+     */
+    preflightResponse(request: Request): Response;
+    /**
+     * Add the configured CORS headers to a response the function produced.
+     *
+     * They are appended. A handler that sends CORS headers of its own keeps them
+     * and the response carries both values, which is what AWS documents for
+     * anything but a preflight.
+     */
+    apply(headers: Headers, request: Request): void;
+    /**
+     * Which Origin this request is told it may read the response from.
+     *
+     * A list holding the wildcard allows every Origin outright. Otherwise the
+     * Origin has to be one the list names. A request carrying no Origin at all,
+     * such as one from curl, is told nothing.
+     */
+    private allowOrigin;
+    /**
+     * Send a configured list as one comma-separated header.
+     *
+     * An empty list names nothing. A header carrying an empty value says
+     * something else to a browser, so the header is left off.
+     */
+    private appendList;
+}

package/dist/service/lambda/serve/response/sim-lambda-url-cors-headers.js

@@ -0,0 +1,96 @@
+/**
+ * The request header a browser states the method it is asking about in.
+ *
+ * A preflight names it and nothing else does. That is what separates a
+ * preflight from an ordinary `OPTIONS` request the function should handle.
+ */
+const requestMethodHeader = "access-control-request-method";
+/**
+ * The CORS headers one Function URL configuration decides for a request.
+ *
+ * Lambda adds these to every response the URL serves, and answers a preflight
+ * with them itself. `AllowOrigins` is the one member whose header depends on
+ * the request. A browser reads one value there, so Lambda sends back either the
+ * Origin that asked or the wildcard.
+ *
+ * https://docs.aws.amazon.com/lambda/latest/dg/urls-configuration.html
+ */
+export class SimLambdaUrlCorsHeaders {
+    cors;
+    constructor(cors) {
+        this.cors = cors;
+    }
+    /**
+     * Whether this request is the preflight a browser sends before a
+     * cross-origin call it is not allowed to make blind.
+     */
+    isPreflight(request) {
+        return (request.method === "OPTIONS" &&
+            request.headers.has("origin") &&
+            request.headers.has(requestMethodHeader));
+    }
+    /**
+     * The answer Lambda gives a preflight request itself.
+     *
+     * The function never runs for one. The configured headers are the whole
+     * response, and the handler has said nothing that could conflict with them.
+     */
+    preflightResponse(request) {
+        const headers = new Headers();
+        this.apply(headers, request);
+        return new Response(null, { status: 200, headers });
+    }
+    /**
+     * Add the configured CORS headers to a response the function produced.
+     *
+     * They are appended. A handler that sends CORS headers of its own keeps them
+     * and the response carries both values, which is what AWS documents for
+     * anything but a preflight.
+     */
+    apply(headers, request) {
+        const allowOrigin = this.allowOrigin(request.headers.get("origin"));
+        if (allowOrigin !== undefined) {
+            headers.append("access-control-allow-origin", allowOrigin);
+        }
+        // A false Access-Control-Allow-Credentials is not a value the fetch spec
+        // recognises. The header is left off instead.
+        if (this.cors.AllowCredentials === true) {
+            headers.append("access-control-allow-credentials", "true");
+        }
+        this.appendList(headers, "allow-methods", this.cors.AllowMethods);
+        this.appendList(headers, "allow-headers", this.cors.AllowHeaders);
+        this.appendList(headers, "expose-headers", this.cors.ExposeHeaders);
+        if (this.cors.MaxAge !== undefined) {
+            headers.append("access-control-max-age", String(this.cors.MaxAge));
+        }
+    }
+    /**
+     * Which Origin this request is told it may read the response from.
+     *
+     * A list holding the wildcard allows every Origin outright. Otherwise the
+     * Origin has to be one the list names. A request carrying no Origin at all,
+     * such as one from curl, is told nothing.
+     */
+    allowOrigin(requestOrigin) {
+        const allowOrigins = this.cors.AllowOrigins ?? [];
+        if (allowOrigins.includes("*")) {
+            return "*";
+        }
+        if (requestOrigin === null || !allowOrigins.includes(requestOrigin)) {
+            return undefined;
+        }
+        return requestOrigin;
+    }
+    /**
+     * Send a configured list as one comma-separated header.
+     *
+     * An empty list names nothing. A header carrying an empty value says
+     * something else to a browser, so the header is left off.
+     */
+    appendList(headers, suffix, values) {
+        if (values === undefined || values.length === 0) {
+            return;
+        }
+        headers.append(`access-control-${suffix}`, values.join(","));
+    }
+}

package/dist/service/lambda/serve/sim-lambda-controller.d.ts

@@ -16,6 +16,11 @@ interface SimLambdaServiceControllerProperties {
  * Either way the function itself runs as its execution Role, as it does for
  * any other invocation. Who invoked it and what it runs as are separate
  * questions on real Lambda, and stay separate here.
+ *
+ * A URL configured for CORS answers a preflight request itself, once the
+ * request has got past whatever its auth type asks of it. A browser cannot sign
+ * a preflight, and an `AWS_IAM` URL refuses one on the same terms it refuses
+ * any other unsigned request.
  */
 export declare class SimLambdaServiceController implements SimAwsServiceController {
     private readonly router;
@@ -46,6 +51,15 @@ export declare class SimLambdaServiceController implements SimAwsServiceControll
      * payload, so it is refused here rather than reaching the function.
      */
     private invokeAuthenticated;
+    /**
+     * Serve a request the Function URL has admitted.
+     *
+     * CORS is settled around the invocation. A preflight is answered from the
+     * configuration alone, and every other response carries the configured
+     * headers alongside whatever the handler sent, including a duplicate where
+     * the two disagree.
+     */
     private invoke;
+    private invokeFunction;
 }
 export {};

package/dist/service/lambda/serve/sim-lambda-controller.js

@@ -2,6 +2,7 @@ import { SimPayload2EventBuilder } from "../../../serve/payload-2/sim-payload-2-
 import { SimPayload2ResponseBuilder } from "../../../serve/payload-2/sim-payload-2-response-builder.js";
 import { SimAws } from "../../aws/sim-aws.js";
 import { simLambdaUrlEndpoint } from "./event/sim-lambda-url-endpoint.js";
+import { SimLambdaUrlCorsHeaders } from "./response/sim-lambda-url-cors-headers.js";
 import { SimLambdaUrlErrorResponse } from "./response/sim-lambda-url-error-response.js";
 import { SimLambdaUrlRouter, } from "./sim-lambda-url-router.js";
 import { SimLambdaUrlAuthorizer } from "./auth/sim-lambda-url-authorizer.js";
@@ -17,6 +18,11 @@ import { simLambdaUrlPayloadRefusal } from "./auth/sim-lambda-url-payload-hash.j
  * Either way the function itself runs as its execution Role, as it does for
  * any other invocation. Who invoked it and what it runs as are separate
  * questions on real Lambda, and stay separate here.
+ *
+ * A URL configured for CORS answers a preflight request itself, once the
+ * request has got past whatever its auth type asks of it. A browser cannot sign
+ * a preflight, and an `AWS_IAM` URL refuses one on the same terms it refuses
+ * any other unsigned request.
  */
 export class SimLambdaServiceController {
     router;
@@ -82,7 +88,28 @@ export class SimLambdaServiceController {
         }
         return await this.invoke(route, serviceRequest.request, caller);
     }
+    /**
+     * Serve a request the Function URL has admitted.
+     *
+     * CORS is settled around the invocation. A preflight is answered from the
+     * configuration alone, and every other response carries the configured
+     * headers alongside whatever the handler sent, including a duplicate where
+     * the two disagree.
+     */
     async invoke(route, request, authenticatedCaller) {
+        const { cors } = route.functionUrl;
+        if (cors === undefined) {
+            return await this.invokeFunction(route, request, authenticatedCaller);
+        }
+        const corsHeaders = new SimLambdaUrlCorsHeaders(cors);
+        if (corsHeaders.isPreflight(request)) {
+            return corsHeaders.preflightResponse(request);
+        }
+        const response = await this.invokeFunction(route, request, authenticatedCaller);
+        corsHeaders.apply(response.headers, request);
+        return response;
+    }
+    async invokeFunction(route, request, authenticatedCaller) {
         try {
             const event = await this.eventBuilder.build(request, simLambdaUrlEndpoint(route.functionUrl), { caller: authenticatedCaller });
             return this.responseBuilder.build(await route.simFunction.invoke(event));

package/dist/service/lambda/sim-lambda-commands.d.ts

@@ -18,6 +18,7 @@ import type { SimLambdaVmSdkModuleProvider } from "./function/code/vm/sdk/sim-la
 import type { SimCloudWatchServiceWriter } from "../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import type { SimLogsServiceWriter } from "../logs/write/sim-logs-service-writer.js";
 import type { SimLambdaOutboundHttp } from "./function/outbound/sim-lambda-outbound-http.js";
+import { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 import { SimLambdaEventInvokeConfigStore } from "./function/event-invoke/sim-lambda-event-invoke-config-store.js";
 import { type SimLambdaDestinationTargets } from "./destination/sim-lambda-destination-targets.js";
 import type { SimLambdaFunctionMap } from "./function/sim-lambda-function.js";
@@ -79,6 +80,15 @@ export declare class SimLambdaCommands {
     readonly functionUrlStore: SimLambdaFunctionUrlStore;
     readonly versionStore: SimLambdaFunctionVersionStore;
     readonly aliasStore: SimLambdaFunctionAliasStore;
+    /**
+     * Where this simulated Lambda's functions send what they print, besides
+     * their own log groups.
+     *
+     * Shared across every function so that one setting covers a simulation with
+     * several of them, and read as each line is written so that a function that
+     * has already cold started follows a change.
+     */
+    readonly output: SimLambdaOutput;
     readonly functionLookup: SimLambdaFunctionLookup;
     readonly eventInvokeConfigStore: SimLambdaEventInvokeConfigStore;
     readonly functions: SimLambdaFunctionCommands;

package/dist/service/lambda/sim-lambda-commands.js

@@ -14,6 +14,7 @@ import { SimLambdaNoEventSourceStreams, } from "./event-source/stream/sim-lambda
 import { SimLambdaNoKinesisStreams } from "./event-source/stream/kinesis/sim-lambda-no-kinesis-streams.js";
 import { SimLambdaNoContainerImages, } from "./function/code/image/sim-lambda-container-images.js";
 import { SimLambdaEnvironmentConflicts } from "./function/environment/sim-lambda-environment-conflicts.js";
+import { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 import { SimLambdaEventInvokeConfigStore } from "./function/event-invoke/sim-lambda-event-invoke-config-store.js";
 import { SimLambdaNoDestinationTargets, } from "./destination/sim-lambda-destination-targets.js";
 import { SimLambdaFunctionLookup } from "./function/url/sim-lambda-function-lookup.js";
@@ -41,6 +42,15 @@ export class SimLambdaCommands {
     aliasStore = new SimLambdaFunctionAliasStore({
         versions: this.versionStore,
     });
+    /**
+     * Where this simulated Lambda's functions send what they print, besides
+     * their own log groups.
+     *
+     * Shared across every function so that one setting covers a simulation with
+     * several of them, and read as each line is written so that a function that
+     * has already cold started follows a change.
+     */
+    output = new SimLambdaOutput();
     functionLookup;
     eventInvokeConfigStore;
     functions;
@@ -142,6 +152,7 @@ export class SimLambdaCommands {
             containerImages,
             vmSdkModuleProvider,
             logs,
+            output: this.output,
             metrics,
             outboundHttp,
         });

package/dist/service/lambda/sim-lambda.d.ts

@@ -1,6 +1,7 @@
 import type { SimSdkCommandRouter } from "../../sdk/index.js";
 import type { SimCfnServiceResourceFactory } from "../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
 import type { SimLambdaContainerImages } from "./function/code/image/sim-lambda-container-images.js";
+import type { SimLambdaOutput } from "./function/logging/sim-lambda-output.js";
 import type { SimLambdaFunctionMap } from "./function/sim-lambda-function.js";
 import type * as simLambdaCommands from "./command/sim-lambda-command.types.js";
 import { SimLambdaCommands, type SimLambdaProperties } from "./sim-lambda-commands.js";
@@ -32,6 +33,17 @@ export declare class SimLambda extends SimLambdaEventInvokeOperations {
      * @internal
      */
     containerImages(): SimLambdaContainerImages;
+    /**
+     * Where this simulated Lambda's functions send what they print, besides the
+     * log group they always reach. The host console gets a copy until told
+     * otherwise, and these settings belong to one Account and Region as the
+     * functions do.
+     *
+     * ```typescript
+     * simAws.lambda().output().captureOnly();
+     * ```
+     */
+    output(): SimLambdaOutput;
     /** Handle a Create Function Command from the SDK. */
     createFunction(command: simLambdaCommands.SimCreateFunctionCommand, options?: SimLambdaRequestOptions): Promise<simLambdaCommands.SimCreateFunctionCommandOutput>;
     /** Handle a Get Function Command from the SDK. */

package/dist/service/lambda/sim-lambda.js

@@ -39,6 +39,19 @@ export class SimLambda extends SimLambdaEventInvokeOperations {
     containerImages() {
         return this.commands.containerImages;
     }
+    /**
+     * Where this simulated Lambda's functions send what they print, besides the
+     * log group they always reach. The host console gets a copy until told
+     * otherwise, and these settings belong to one Account and Region as the
+     * functions do.
+     *
+     * ```typescript
+     * simAws.lambda().output().captureOnly();
+     * ```
+     */
+    output() {
+        return this.commands.output;
+    }
     /** Handle a Create Function Command from the SDK. */
     async createFunction(command, options) {
         return await this.commands.functions.create(command, options);

package/dist/service/s3/bucket/encryption/sim-s3-bucket-encryption.d.ts

@@ -0,0 +1,67 @@
+import { type SimS3ServerSideEncryption } from "../../object/s3-server-side-encryption.js";
+/**
+ * The encryption a Bucket applies to an Object whose write named none.
+ */
+export interface SimS3ServerSideEncryptionByDefault {
+    readonly SSEAlgorithm?: string | undefined;
+    readonly KMSMasterKeyID?: string | undefined;
+}
+/**
+ * One rule of a Bucket's default encryption configuration.
+ *
+ * Real S3 takes exactly one. `BucketKeyEnabled` says whether S3 uses a bucket
+ * key to cut KMS calls, and is stored and read back here without acting.
+ */
+export interface SimS3ServerSideEncryptionRule {
+    readonly ApplyServerSideEncryptionByDefault?: SimS3ServerSideEncryptionByDefault | undefined;
+    readonly BucketKeyEnabled?: boolean | undefined;
+}
+/**
+ * A Bucket's default encryption configuration, as a request states it.
+ */
+export interface SimS3ServerSideEncryptionConfiguration {
+    readonly Rules?: readonly SimS3ServerSideEncryptionRule[] | undefined;
+}
+interface SimS3BucketEncryptionProperties {
+    readonly rules?: readonly SimS3ServerSideEncryptionRule[] | undefined;
+}
+/**
+ * The default encryption of one simulated S3 Bucket.
+ *
+ * Nothing is encrypted. The bytes of an Object are stored as they arrive, and
+ * its ETag stays the MD5 of them, which is what real S3 reports for an
+ * SSE-S3 Object as well. What this decides is the algorithm a write stamps on
+ * an Object when it names none itself, and what `GetBucketEncryption` answers.
+ *
+ * A Bucket nobody has configured is SSE-S3 encrypted. Real S3 has applied that
+ * default to every Bucket since January 2023, and answers a read of an
+ * unconfigured Bucket with the same `AES256` rule as one configured that way.
+ */
+export declare class SimS3BucketEncryption {
+    private readonly storedRules;
+    constructor(properties?: SimS3BucketEncryptionProperties);
+    /**
+     * The encryption a Bucket nobody has configured has, which is what
+     * `DeleteBucketEncryption` puts a Bucket back to.
+     */
+    static default(): SimS3BucketEncryption;
+    /**
+     * The encryption a PutBucketEncryption request asks for.
+     *
+     * Every algorithm named is read here, before the Bucket is changed, so a
+     * configuration real S3 refuses leaves the Bucket as it was.
+     */
+    static fromConfiguration(configuration: SimS3ServerSideEncryptionConfiguration, bucketName: string): SimS3BucketEncryption;
+    /**
+     * The algorithm this Bucket stamps on an Object written without one.
+     */
+    get algorithm(): SimS3ServerSideEncryption;
+    /**
+     * The configuration a read of the Bucket answers with.
+     *
+     * Cloned on the way out, so a caller holding what it was given cannot change
+     * what the Bucket applies by mutating it.
+     */
+    get configuration(): SimS3ServerSideEncryptionConfiguration;
+}
+export {};

package/dist/service/s3/bucket/encryption/sim-s3-bucket-encryption.js

@@ -0,0 +1,69 @@
+import { simS3DefaultServerSideEncryption, simS3ServerSideEncryptionFrom, } from "../../object/s3-server-side-encryption.js";
+/**
+ * The default encryption of one simulated S3 Bucket.
+ *
+ * Nothing is encrypted. The bytes of an Object are stored as they arrive, and
+ * its ETag stays the MD5 of them, which is what real S3 reports for an
+ * SSE-S3 Object as well. What this decides is the algorithm a write stamps on
+ * an Object when it names none itself, and what `GetBucketEncryption` answers.
+ *
+ * A Bucket nobody has configured is SSE-S3 encrypted. Real S3 has applied that
+ * default to every Bucket since January 2023, and answers a read of an
+ * unconfigured Bucket with the same `AES256` rule as one configured that way.
+ */
+export class SimS3BucketEncryption {
+    storedRules;
+    constructor(properties = {}) {
+        this.storedRules = structuredClone(properties.rules ?? defaultRules);
+    }
+    /**
+     * The encryption a Bucket nobody has configured has, which is what
+     * `DeleteBucketEncryption` puts a Bucket back to.
+     */
+    static default() {
+        return new SimS3BucketEncryption();
+    }
+    /**
+     * The encryption a PutBucketEncryption request asks for.
+     *
+     * Every algorithm named is read here, before the Bucket is changed, so a
+     * configuration real S3 refuses leaves the Bucket as it was.
+     */
+    static fromConfiguration(configuration, bucketName) {
+        const rules = configuration.Rules ?? [];
+        for (const rule of rules) {
+            simS3ServerSideEncryptionFrom(rule.ApplyServerSideEncryptionByDefault?.SSEAlgorithm, `the default encryption of Bucket ${bucketName}`);
+        }
+        return new SimS3BucketEncryption({ rules });
+    }
+    /**
+     * The algorithm this Bucket stamps on an Object written without one.
+     */
+    get algorithm() {
+        const named = this.storedRules
+            .map((rule) => rule.ApplyServerSideEncryptionByDefault?.SSEAlgorithm)
+            .find((algorithm) => algorithm !== undefined);
+        return (simS3ServerSideEncryptionFrom(named, "a stored Bucket configuration") ??
+            simS3DefaultServerSideEncryption);
+    }
+    /**
+     * The configuration a read of the Bucket answers with.
+     *
+     * Cloned on the way out, so a caller holding what it was given cannot change
+     * what the Bucket applies by mutating it.
+     */
+    get configuration() {
+        return { Rules: structuredClone(this.storedRules) };
+    }
+}
+/**
+ * The rule real S3 reports for a Bucket nobody has configured.
+ */
+const defaultRules = [
+    {
+        ApplyServerSideEncryptionByDefault: {
+            SSEAlgorithm: simS3DefaultServerSideEncryption,
+        },
+        BucketKeyEnabled: false,
+    },
+];

package/dist/service/s3/bucket/lifecycle/sim-s3-lifecycle-configuration.d.ts

@@ -1,36 +1,8 @@
 import type { SimS3LifecycleConfiguration as SimS3LifecycleConfigurationInput, SimS3LifecycleRule } from "../../command/put-bucket-lifecycle-configuration/put-bucket-lifecycle-configuration.command.js";
+import type { SimS3LifecycleNoncurrentVersion, SimS3LifecycleObject, SimS3LifecycleUpload } from "./sim-s3-lifecycle-subject.js";
 interface SimS3LifecycleConfigurationProperties {
     readonly rules?: readonly SimS3LifecycleRule[];
 }
-/**
- * An Object as a lifecycle rule reads it.
- */
-export interface SimS3LifecycleObject {
-    readonly key: string;
-    readonly size: number;
-    readonly lastModified: Date;
-}
-/**
- * A noncurrent version as a lifecycle rule reads it.
- *
- * `newerVersionsAhead` is how many noncurrent versions of the same key are
- * newer than this one, which is what `NewerNoncurrentVersions` counts. The
- * current version is not one of them, since a rule for noncurrent versions
- * never reaches it.
- */
-export interface SimS3LifecycleNoncurrentVersion {
-    readonly key: string;
-    readonly size: number;
-    readonly noncurrentSince: Date | undefined;
-    readonly newerVersionsAhead: number;
-}
-/**
- * A multipart upload in progress as a lifecycle rule reads it.
- */
-export interface SimS3LifecycleUpload {
-    readonly key: string;
-    readonly initiated: Date;
-}
 /**
  * The lifecycle configuration of one simulated S3 Bucket.
  *
@@ -107,8 +79,9 @@ export declare class SimS3LifecycleConfiguration {
      *
      * Read from the stored rules rather than from `rules`, because every read of
      * a Bucket asks and cloning the whole configuration each time would be the
-     * cost of having one.
+     * cost of having one. A transition is worked out from these by
+     * `simS3TransitionedObjectClass`.
      */
-    private enabledRules;
+    get enabledRules(): readonly SimS3LifecycleRule[];
 }
 export {};