@kensio/yulin 1.21.3 → 1.21.5

package/dist/service/s3/bucket/sim-s3-bucket-configuration.d.ts

@@ -0,0 +1,84 @@
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import { SimS3BucketEncryption } from "./encryption/sim-s3-bucket-encryption.js";
+import { SimS3NotificationConfiguration } from "./notification/sim-s3-notification-configuration.js";
+import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
+import type { SimS3BucketProperties } from "./sim-s3-bucket-properties.js";
+import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
+/**
+ * How one simulated S3 Bucket is configured.
+ *
+ * These are the five configurations a Bucket holds one of rather than a list
+ * of, and each is replaced whole by the request that sets it. None of them says
+ * anything about what the Bucket stores, which is why they sit apart from the
+ * Objects, the versions and the uploads.
+ *
+ * `SimS3Bucket` extends this, so a caller reaches all of them on the Bucket
+ * itself. The lifecycle configuration is the exception and stays with the
+ * Objects, because every read of one applies it.
+ */
+export declare abstract class SimS3BucketConfiguration {
+    private website;
+    private policy;
+    private publicAccessBlock;
+    private notifications;
+    private encryption;
+    protected constructor(properties: SimS3BucketProperties);
+    /**
+     * Configure static website hosting for this simulated S3 Bucket.
+     */
+    configureWebsite(website: SimS3BucketWebsite): void;
+    /**
+     * Get static website configuration for this simulated S3 Bucket.
+     */
+    getWebsite(): SimS3BucketWebsite;
+    /**
+     * Configure the Bucket resource policy.
+     */
+    configurePolicy(policy: SimIamPolicyDocument): void;
+    /**
+     * Get the Bucket resource policy.
+     */
+    getPolicy(): SimIamPolicyDocument | undefined;
+    /**
+     * Remove the Bucket resource policy.
+     *
+     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
+     * whether there was a policy to remove.
+     */
+    deletePolicy(): void;
+    /**
+     * Replace this Bucket's Block Public Access settings.
+     */
+    configurePublicAccessBlock(publicAccessBlock: SimS3PublicAccessBlock): void;
+    /**
+     * Get this Bucket's Block Public Access settings.
+     */
+    getPublicAccessBlock(): SimS3PublicAccessBlock;
+    /**
+     * Remove this Bucket's Block Public Access settings.
+     *
+     * Removing the configuration returns the Bucket to the all-enabled state a
+     * new Bucket starts in, rather than leaving it unprotected.
+     */
+    deletePublicAccessBlock(): void;
+    /**
+     * Replace this Bucket's event notification configuration.
+     *
+     * Real S3 holds one configuration per Bucket rather than a list of them, so
+     * this replaces what was there instead of adding to it.
+     */
+    configureNotifications(notifications: SimS3NotificationConfiguration): void;
+    /** Get this Bucket's event notification configuration. */
+    getNotifications(): SimS3NotificationConfiguration;
+    /** Replace this Bucket's default encryption configuration. */
+    configureEncryption(encryption: SimS3BucketEncryption): void;
+    /** Get this Bucket's default encryption configuration. */
+    getEncryption(): SimS3BucketEncryption;
+    /**
+     * Put this Bucket back to the encryption every Bucket has.
+     *
+     * Real S3 DeleteBucketEncryption leaves the Bucket SSE-S3 encrypted rather
+     * than unencrypted, because there is no such thing as an unencrypted Bucket.
+     */
+    deleteEncryption(): void;
+}

package/dist/service/s3/bucket/sim-s3-bucket-configuration.js

@@ -0,0 +1,115 @@
+import { SimS3BucketEncryption } from "./encryption/sim-s3-bucket-encryption.js";
+import { SimS3NotificationConfiguration } from "./notification/sim-s3-notification-configuration.js";
+import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
+import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
+/**
+ * How one simulated S3 Bucket is configured.
+ *
+ * These are the five configurations a Bucket holds one of rather than a list
+ * of, and each is replaced whole by the request that sets it. None of them says
+ * anything about what the Bucket stores, which is why they sit apart from the
+ * Objects, the versions and the uploads.
+ *
+ * `SimS3Bucket` extends this, so a caller reaches all of them on the Bucket
+ * itself. The lifecycle configuration is the exception and stays with the
+ * Objects, because every read of one applies it.
+ */
+export class SimS3BucketConfiguration {
+    website;
+    policy;
+    publicAccessBlock;
+    notifications;
+    encryption;
+    constructor(properties) {
+        const { website = new SimS3BucketWebsite(), publicAccessBlock = SimS3PublicAccessBlock.blockingAll(), notifications = SimS3NotificationConfiguration.empty(), encryption = SimS3BucketEncryption.default(), } = properties;
+        this.website = website;
+        this.policy = properties.policy;
+        this.publicAccessBlock = publicAccessBlock;
+        this.notifications = notifications;
+        this.encryption = encryption;
+    }
+    /**
+     * Configure static website hosting for this simulated S3 Bucket.
+     */
+    configureWebsite(website) {
+        this.website = website;
+    }
+    /**
+     * Get static website configuration for this simulated S3 Bucket.
+     */
+    getWebsite() {
+        return this.website;
+    }
+    /**
+     * Configure the Bucket resource policy.
+     */
+    configurePolicy(policy) {
+        this.policy = policy;
+    }
+    /**
+     * Get the Bucket resource policy.
+     */
+    getPolicy() {
+        return this.policy;
+    }
+    /**
+     * Remove the Bucket resource policy.
+     *
+     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
+     * whether there was a policy to remove.
+     */
+    deletePolicy() {
+        this.policy = undefined;
+    }
+    /**
+     * Replace this Bucket's Block Public Access settings.
+     */
+    configurePublicAccessBlock(publicAccessBlock) {
+        this.publicAccessBlock = publicAccessBlock;
+    }
+    /**
+     * Get this Bucket's Block Public Access settings.
+     */
+    getPublicAccessBlock() {
+        return this.publicAccessBlock;
+    }
+    /**
+     * Remove this Bucket's Block Public Access settings.
+     *
+     * Removing the configuration returns the Bucket to the all-enabled state a
+     * new Bucket starts in, rather than leaving it unprotected.
+     */
+    deletePublicAccessBlock() {
+        this.publicAccessBlock = SimS3PublicAccessBlock.blockingAll();
+    }
+    /**
+     * Replace this Bucket's event notification configuration.
+     *
+     * Real S3 holds one configuration per Bucket rather than a list of them, so
+     * this replaces what was there instead of adding to it.
+     */
+    configureNotifications(notifications) {
+        this.notifications = notifications;
+    }
+    /** Get this Bucket's event notification configuration. */
+    getNotifications() {
+        return this.notifications;
+    }
+    /** Replace this Bucket's default encryption configuration. */
+    configureEncryption(encryption) {
+        this.encryption = encryption;
+    }
+    /** Get this Bucket's default encryption configuration. */
+    getEncryption() {
+        return this.encryption;
+    }
+    /**
+     * Put this Bucket back to the encryption every Bucket has.
+     *
+     * Real S3 DeleteBucketEncryption leaves the Bucket SSE-S3 encrypted rather
+     * than unencrypted, because there is no such thing as an unencrypted Bucket.
+     */
+    deleteEncryption() {
+        this.encryption = SimS3BucketEncryption.default();
+    }
+}

package/dist/service/s3/bucket/sim-s3-bucket-maker.d.ts

@@ -0,0 +1,31 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import { SimS3Bucket, type SimS3BucketName } from "./sim-s3-bucket.js";
+import type { SimS3GlobalRegistry } from "../sim-s3-global-registry.js";
+interface SimS3BucketMakerProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly s3GlobalRegistry: SimS3GlobalRegistry;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * Puts a Bucket into a simulated S3 scope, once something has decided it may
+ * be there.
+ *
+ * `CreateBucketCommand` decides that by authorizing the caller. A Bucket real
+ * AWS provisions outside the deployment being simulated, such as the CDK
+ * bootstrap staging Bucket, has no caller to authorize and comes through
+ * `SimS3.makeSimBucket` instead. Both arrive at the same Bucket registered in
+ * the same two places, because the name check and the registration are here
+ * rather than in the command handler.
+ */
+export declare class SimS3BucketMaker {
+    private readonly properties;
+    constructor(properties: SimS3BucketMakerProperties);
+    /**
+     * Make a Bucket of the given name, reporting a name this scope cannot take
+     * the way `CreateBucketCommand` reports it.
+     */
+    make(bucketName: string): SimS3Bucket;
+}
+export {};

package/dist/service/s3/bucket/sim-s3-bucket-maker.js

@@ -0,0 +1,41 @@
+import { SimS3BucketNameAvailability } from "./name-availability/sim-s3-bucket-name-availability.js";
+import { validateS3BucketName } from "./validate/validate-s3-bucket-name.js";
+import { SimS3Bucket } from "./sim-s3-bucket.js";
+/**
+ * Puts a Bucket into a simulated S3 scope, once something has decided it may
+ * be there.
+ *
+ * `CreateBucketCommand` decides that by authorizing the caller. A Bucket real
+ * AWS provisions outside the deployment being simulated, such as the CDK
+ * bootstrap staging Bucket, has no caller to authorize and comes through
+ * `SimS3.makeSimBucket` instead. Both arrive at the same Bucket registered in
+ * the same two places, because the name check and the registration are here
+ * rather than in the command handler.
+ */
+export class SimS3BucketMaker {
+    properties;
+    constructor(properties) {
+        this.properties = properties;
+    }
+    /**
+     * Make a Bucket of the given name, reporting a name this scope cannot take
+     * the way `CreateBucketCommand` reports it.
+     */
+    make(bucketName) {
+        const { accountRegionScope, buckets, s3GlobalRegistry, background } = this.properties;
+        validateS3BucketName(bucketName);
+        new SimS3BucketNameAvailability({
+            accountRegionScope,
+            buckets,
+            s3GlobalRegistry,
+        }).ensureCanCreateBucketNamed(bucketName);
+        const bucket = new SimS3Bucket({
+            bucketName,
+            accountRegionScope,
+            clock: background,
+        });
+        buckets.set(bucketName, bucket);
+        s3GlobalRegistry.registerBucket(bucketName, accountRegionScope);
+        return bucket;
+    }
+}

package/dist/service/s3/bucket/sim-s3-bucket-objects.d.ts

@@ -5,6 +5,7 @@ import { SimS3MultipartUploads } from "../upload/sim-s3-multipart-uploads.js";
 import { SimS3BucketObjectLock } from "./lock/sim-s3-bucket-object-lock.js";
 import { SimS3LifecycleConfiguration } from "./lifecycle/sim-s3-lifecycle-configuration.js";
 import { SimS3ObjectDeletion } from "./sim-s3-object-deletion.js";
+import { SimS3TaggableObject } from "./tagging/sim-s3-taggable-object.js";
 import type { SimS3BucketVersioning } from "./versioning/sim-s3-bucket-versioning.js";
 import { SimS3BucketVersions } from "./versioning/sim-s3-bucket-versions.js";
 import type { SimS3ObjectVersion } from "./versioning/sim-s3-object-version.js";
@@ -64,6 +65,15 @@ export declare class SimS3BucketObjects {
      * Lock is holding never gets that far.
      */
     deleteVersion(key: string, versionId: string, bypassGovernance?: boolean): Promise<SimS3ObjectVersion | undefined>;
+    /**
+     * The Object a tagging request names, ready to be read or retagged.
+     *
+     * A request naming a version acts on that version, and one naming none acts
+     * on whatever a plain read of the key answers with. The read happens either
+     * way, because it is what applies the Bucket's rules, and a request naming a
+     * version has no more effect on the Bucket than any other read of it.
+     */
+    taggable(key: string, versionId: string | undefined): Promise<SimS3TaggableObject>;
     /**
      * The versions this Bucket keeps, with whatever the rules have expired gone.
      *

package/dist/service/s3/bucket/sim-s3-bucket-objects.js

@@ -4,6 +4,7 @@ import { SimS3LifecycleConfiguration } from "./lifecycle/sim-s3-lifecycle-config
 import { SimS3NoncurrentSweep } from "./lifecycle/sim-s3-noncurrent-sweep.js";
 import { SimS3LifecycleSweep } from "./lifecycle/sim-s3-lifecycle-sweep.js";
 import { SimS3ObjectDeletion } from "./sim-s3-object-deletion.js";
+import { SimS3TaggableObject } from "./tagging/sim-s3-taggable-object.js";
 import { SimS3BucketVersions } from "./versioning/sim-s3-bucket-versions.js";
 /**
  * What one simulated S3 Bucket stores, and what time does to it.
@@ -80,6 +81,23 @@ export class SimS3BucketObjects {
         this.objectLock.assertDeletable(this.versions.find(key, versionId), this.clock.now(), bypassGovernance);
         return await this.versions.deleteVersion(this.storage, key, versionId);
     }
+    /**
+     * The Object a tagging request names, ready to be read or retagged.
+     *
+     * A request naming a version acts on that version, and one naming none acts
+     * on whatever a plain read of the key answers with. The read happens either
+     * way, because it is what applies the Bucket's rules, and a request naming a
+     * version has no more effect on the Bucket than any other read of it.
+     */
+    async taggable(key, versionId) {
+        return SimS3TaggableObject.named({
+            storage: this.storage,
+            versions: this.sweptVersions(),
+            key,
+            versionId,
+            stored: await this.get(key),
+        });
+    }
     /**
      * The versions this Bucket keeps, with whatever the rules have expired gone.
      *

package/dist/service/s3/bucket/sim-s3-bucket-properties.d.ts

@@ -0,0 +1,41 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import type { SimS3BucketStorage } from "../storage/s3-bucket-storage.js";
+import type { SimS3BucketEncryption } from "./encryption/sim-s3-bucket-encryption.js";
+import type { SimS3LifecycleConfiguration } from "./lifecycle/sim-s3-lifecycle-configuration.js";
+import type { SimS3NotificationConfiguration } from "./notification/sim-s3-notification-configuration.js";
+import type { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
+import type { SimS3BucketName } from "./sim-s3-bucket.js";
+import type { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
+/**
+ * What a simulated S3 Bucket is made of.
+ *
+ * Every one of these has a default, apart from the name. A Bucket made by
+ * CreateBucket states only its name and its scope, and the configuration
+ * properties are what a Bucket built directly in a test starts out with.
+ */
+export interface SimS3BucketProperties {
+    readonly bucketName: SimS3BucketName | string;
+    readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly storage?: SimS3BucketStorage;
+    readonly website?: SimS3BucketWebsite;
+    readonly policy?: SimIamPolicyDocument | undefined;
+    readonly publicAccessBlock?: SimS3PublicAccessBlock;
+    readonly notifications?: SimS3NotificationConfiguration;
+    readonly lifecycle?: SimS3LifecycleConfiguration;
+    readonly encryption?: SimS3BucketEncryption;
+    /**
+     * The simulation's sense of time, which is what a lifecycle rule is measured
+     * against. A Bucket made outside a simulated environment has none to be
+     * given, and runs on the host clock.
+     */
+    readonly clock?: SimClock;
+    /**
+     * When the Bucket came into being, in simulated time.
+     *
+     * Real S3 reports this on every Bucket a listing returns, and the `aws` CLI
+     * reads it from each entry, so a Bucket without one cannot be listed.
+     */
+    readonly creationDate?: Date;
+}

package/dist/service/s3/bucket/sim-s3-bucket-properties.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/bucket/sim-s3-bucket.d.ts

@@ -1,57 +1,28 @@
 import type { Brand } from "../../../util/brand.type.js";
-import { type SimClock } from "../../../util/clock/sim-clock.js";
 import type { SimS3BucketStorage } from "../storage/s3-bucket-storage.js";
 import type { SimS3Object } from "../object/s3-object.js";
 import type { SimS3ObjectDeletion } from "./sim-s3-object-deletion.js";
+import type { SimS3TaggableObject } from "./tagging/sim-s3-taggable-object.js";
 import type { SimS3BucketObjectLock } from "./lock/sim-s3-bucket-object-lock.js";
 import type { SimS3BucketVersioning } from "./versioning/sim-s3-bucket-versioning.js";
 import type { SimS3BucketVersions } from "./versioning/sim-s3-bucket-versions.js";
 import type { SimS3ObjectVersion } from "./versioning/sim-s3-object-version.js";
-import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
-import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
-import { SimS3NotificationConfiguration } from "./notification/sim-s3-notification-configuration.js";
 import { SimS3LifecycleConfiguration } from "./lifecycle/sim-s3-lifecycle-configuration.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
-import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import { SimS3BucketConfiguration } from "./sim-s3-bucket-configuration.js";
 import { SimS3BucketSystemMetadata } from "./sim-s3-bucket-system-metadata.js";
 import type { SimS3MultipartUploads } from "../upload/sim-s3-multipart-uploads.js";
+import type { SimS3BucketProperties } from "./sim-s3-bucket-properties.js";
 export type SimS3BucketName = Brand<string, "SimS3BucketName">;
-interface SimS3BucketProperties {
-    readonly bucketName: SimS3BucketName | string;
-    readonly accountRegionScope?: SimAwsAccountRegionScope;
-    readonly storage?: SimS3BucketStorage;
-    readonly website?: SimS3BucketWebsite;
-    readonly policy?: SimIamPolicyDocument | undefined;
-    readonly publicAccessBlock?: SimS3PublicAccessBlock;
-    readonly notifications?: SimS3NotificationConfiguration;
-    readonly lifecycle?: SimS3LifecycleConfiguration;
-    /**
-     * The simulation's sense of time, which is what a lifecycle rule is measured
-     * against. A Bucket made outside a simulated environment has none to be
-     * given, and runs on the host clock.
-     */
-    readonly clock?: SimClock;
-    /**
-     * When the Bucket came into being, in simulated time.
-     *
-     * Real S3 reports this on every Bucket a listing returns, and the `aws` CLI
-     * reads it from each entry, so a Bucket without one cannot be listed.
-     */
-    readonly creationDate?: Date;
-}
 /**
  * Simulated S3 Bucket.
  */
-export declare class SimS3Bucket {
+export declare class SimS3Bucket extends SimS3BucketConfiguration {
     readonly bucketName: SimS3BucketName;
     readonly creationDate: Date;
     private readonly accountRegionScope;
     private readonly systemMetadata;
     private readonly objects;
-    private website;
-    private policy;
-    private publicAccessBlock;
-    private notifications;
     constructor(properties: SimS3BucketProperties);
     /** Put an Object into storage, answering the version it was given, if any. */
     putObject(object: SimS3Object): Promise<SimS3ObjectVersion | undefined>;
@@ -75,6 +46,13 @@ export declare class SimS3Bucket {
      * refuses the removal of a version it is holding.
      */
     deleteObjectVersion(key: string, versionId: string, bypassGovernance?: boolean): Promise<SimS3ObjectVersion | undefined>;
+    /**
+     * The Object a tagging request names, ready to be read or retagged.
+     *
+     * A request naming no version acts on whatever a plain read of the key
+     * answers with, which is what real S3 does.
+     */
+    taggableObject(key: string, versionId?: string): Promise<SimS3TaggableObject>;
     /** The versions this Bucket keeps, and whether it keeps any. */
     getVersions(): SimS3BucketVersions;
     /** How this Bucket is locked, and what that does to a write and a delete. */
@@ -100,55 +78,6 @@ export declare class SimS3Bucket {
      * those Objects is served with the headers they had.
      */
     getDeclaredSystemMetadata(): SimS3BucketSystemMetadata;
-    /**
-     * Configure static website hosting for this simulated S3 Bucket.
-     */
-    configureWebsite(website: SimS3BucketWebsite): void;
-    /**
-     * Get static website configuration for this simulated S3 Bucket.
-     */
-    getWebsite(): SimS3BucketWebsite;
-    /**
-     * Configure the Bucket resource policy.
-     */
-    configurePolicy(policy: SimIamPolicyDocument): void;
-    /**
-     * Get the Bucket resource policy.
-     */
-    getPolicy(): SimIamPolicyDocument | undefined;
-    /**
-     * Remove the Bucket resource policy.
-     *
-     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
-     * whether there was a policy to remove.
-     */
-    deletePolicy(): void;
-    /**
-     * Replace this Bucket's Block Public Access settings.
-     */
-    configurePublicAccessBlock(publicAccessBlock: SimS3PublicAccessBlock): void;
-    /**
-     * Get this Bucket's Block Public Access settings.
-     */
-    getPublicAccessBlock(): SimS3PublicAccessBlock;
-    /**
-     * Remove this Bucket's Block Public Access settings.
-     *
-     * Removing the configuration returns the Bucket to the all-enabled state a
-     * new Bucket starts in, rather than leaving it unprotected.
-     */
-    deletePublicAccessBlock(): void;
-    /**
-     * Replace this Bucket's event notification configuration.
-     *
-     * Real S3 holds one configuration per Bucket rather than a list of them, so
-     * this replaces what was there instead of adding to it.
-     */
-    configureNotifications(notifications: SimS3NotificationConfiguration): void;
-    /**
-     * Get this Bucket's event notification configuration.
-     */
-    getNotifications(): SimS3NotificationConfiguration;
     /**
      * Replace this Bucket's lifecycle configuration.
      *
@@ -176,4 +105,3 @@ export declare class SimS3Bucket {
      */
     getWebsiteUrl(): URL;
 }
-export {};

package/dist/service/s3/bucket/sim-s3-bucket.js

@@ -1,37 +1,28 @@
 import { SimRealClock } from "../../../util/clock/sim-clock.js";
 import { MemoryS3BucketStorage } from "../storage/s3-memory-storage.js";
 import { SimS3BucketObjects } from "./sim-s3-bucket-objects.js";
-import { SimS3BucketWebsite } from "./website/sim-s3-bucket-website.js";
-import { SimS3PublicAccessBlock } from "./public-access/sim-s3-public-access-block.js";
-import { SimS3NotificationConfiguration } from "./notification/sim-s3-notification-configuration.js";
 import { SimS3LifecycleConfiguration } from "./lifecycle/sim-s3-lifecycle-configuration.js";
 import { simS3BucketWebsiteUrl } from "./website/sim-s3-bucket-website-url.js";
 import { validateS3BucketName } from "./validate/validate-s3-bucket-name.js";
 import { simAwsAccountRegionScopeFactory } from "../../aws/sim-aws-account-region-scope.factory.js";
+import { SimS3BucketConfiguration } from "./sim-s3-bucket-configuration.js";
 import { SimS3BucketSystemMetadata } from "./sim-s3-bucket-system-metadata.js";
 /**
  * Simulated S3 Bucket.
  */
-export class SimS3Bucket {
+export class SimS3Bucket extends SimS3BucketConfiguration {
     bucketName;
     creationDate;
     accountRegionScope;
     systemMetadata = new SimS3BucketSystemMetadata();
     objects;
-    website;
-    policy;
-    publicAccessBlock;
-    notifications;
     constructor(properties) {
-        const { bucketName, accountRegionScope = simAwsAccountRegionScopeFactory.make(), storage = new MemoryS3BucketStorage(), website = new SimS3BucketWebsite(), policy, publicAccessBlock = SimS3PublicAccessBlock.blockingAll(), notifications = SimS3NotificationConfiguration.empty(), lifecycle = SimS3LifecycleConfiguration.empty(), clock = new SimRealClock(), creationDate = clock.now(), } = properties;
+        super(properties);
+        const { bucketName, accountRegionScope = simAwsAccountRegionScopeFactory.make(), storage = new MemoryS3BucketStorage(), lifecycle = SimS3LifecycleConfiguration.empty(), clock = new SimRealClock(), creationDate = clock.now(), } = properties;
         validateS3BucketName(bucketName);
         this.bucketName = bucketName;
         this.accountRegionScope = accountRegionScope;
         this.objects = new SimS3BucketObjects({ storage, lifecycle, clock });
-        this.website = website;
-        this.policy = policy;
-        this.publicAccessBlock = publicAccessBlock;
-        this.notifications = notifications;
         this.creationDate = creationDate;
     }
     /** Put an Object into storage, answering the version it was given, if any. */
@@ -66,6 +57,15 @@ export class SimS3Bucket {
     async deleteObjectVersion(key, versionId, bypassGovernance = false) {
         return await this.objects.deleteVersion(key, versionId, bypassGovernance);
     }
+    /**
+     * The Object a tagging request names, ready to be read or retagged.
+     *
+     * A request naming no version acts on whatever a plain read of the key
+     * answers with, which is what real S3 does.
+     */
+    async taggableObject(key, versionId) {
+        return await this.objects.taggable(key, versionId);
+    }
     /** The versions this Bucket keeps, and whether it keeps any. */
     getVersions() {
         return this.objects.sweptVersions();
@@ -103,75 +103,6 @@ export class SimS3Bucket {
     getDeclaredSystemMetadata() {
         return this.systemMetadata;
     }
-    /**
-     * Configure static website hosting for this simulated S3 Bucket.
-     */
-    configureWebsite(website) {
-        this.website = website;
-    }
-    /**
-     * Get static website configuration for this simulated S3 Bucket.
-     */
-    getWebsite() {
-        return this.website;
-    }
-    /**
-     * Configure the Bucket resource policy.
-     */
-    configurePolicy(policy) {
-        this.policy = policy;
-    }
-    /**
-     * Get the Bucket resource policy.
-     */
-    getPolicy() {
-        return this.policy;
-    }
-    /**
-     * Remove the Bucket resource policy.
-     *
-     * Real S3 DeleteBucketPolicy is idempotent, so this reports nothing about
-     * whether there was a policy to remove.
-     */
-    deletePolicy() {
-        this.policy = undefined;
-    }
-    /**
-     * Replace this Bucket's Block Public Access settings.
-     */
-    configurePublicAccessBlock(publicAccessBlock) {
-        this.publicAccessBlock = publicAccessBlock;
-    }
-    /**
-     * Get this Bucket's Block Public Access settings.
-     */
-    getPublicAccessBlock() {
-        return this.publicAccessBlock;
-    }
-    /**
-     * Remove this Bucket's Block Public Access settings.
-     *
-     * Removing the configuration returns the Bucket to the all-enabled state a
-     * new Bucket starts in, rather than leaving it unprotected.
-     */
-    deletePublicAccessBlock() {
-        this.publicAccessBlock = SimS3PublicAccessBlock.blockingAll();
-    }
-    /**
-     * Replace this Bucket's event notification configuration.
-     *
-     * Real S3 holds one configuration per Bucket rather than a list of them, so
-     * this replaces what was there instead of adding to it.
-     */
-    configureNotifications(notifications) {
-        this.notifications = notifications;
-    }
-    /**
-     * Get this Bucket's event notification configuration.
-     */
-    getNotifications() {
-        return this.notifications;
-    }
     /**
      * Replace this Bucket's lifecycle configuration.
      *
@@ -206,6 +137,6 @@ export class SimS3Bucket {
      * Get the simulated S3 static website URL for this Bucket.
      */
     getWebsiteUrl() {
-        return simS3BucketWebsiteUrl(this.bucketName, this.accountRegionScope, this.website);
+        return simS3BucketWebsiteUrl(this.bucketName, this.accountRegionScope, this.getWebsite());
     }
 }

package/dist/service/s3/bucket/sim-s3-public-read.fixture.d.ts

@@ -12,5 +12,11 @@ import type { SimS3 } from "../sim-s3.js";
  * issues exactly the two commands a real deployment issues rather than reaching
  * around them, so a test using it exercises the same path a user's own setup
  * would.
+ *
+ * The policy grants listing alongside the read. Real S3 admits that a key is
+ * missing only to a reader holding `s3:ListBucket`, and answers 403 to a
+ * reader holding the Object read alone. A site with its own error document, a
+ * folder redirect or a custom 404 error response grants both permissions for
+ * that reason.
  */
 export declare function grantPublicObjectRead(simS3: SimS3, bucketName: string): Promise<void>;