@backblaze-labs/b2-sdk 0.1.0 → 0.3.0

package/dist/simulator/index.js

@@ -1,1560 +1,3113 @@
-import { sha1Hex } from "../streams/hash.js";
-import { Capability } from "../types/auth.js";
-import { BucketRetentionMode } from "../types/bucket.js";
-import { EncryptionMode } from "../types/encryption.js";
 import { FileAction } from "../types/file.js";
 import { accountId, bucketId, fileId } from "../types/ids.js";
-import { utf8Encoder, utf8Decoder } from "../util/text-codec.js";
+import { utf8Decoder, utf8Encoder } from "../util/text-codec.js";
+import { encodeFileName } from "../raw/encoding.js";
+import { DownloadClientUnauthorizedToReadMarker, DownloadHeaderName } from "../types/download.js";
+import { md5Base64, md5Base64Sync } from "../util/md5.js";
+import { EncryptionAlgorithm, EncryptionMode } from "../types/encryption.js";
+import { LegalHoldValue, RetentionMode } from "../types/lock.js";
+import { hexEncode, hmacSha256 } from "../util/crypto.js";
+import { sha1Hex } from "../streams/hash.js";
+import { BucketRetentionMode } from "../types/bucket.js";
 import { toError } from "../util/to-error.js";
+import { b2Url, isB2ApiVersion } from "../raw/url.js";
+import { Capability } from "../types/auth.js";
+import { PartnerSimulator, isPartnerQueryEndpoint } from "./partner.js";
 import { missingCapabilitiesFor } from "./capabilities.js";
-import { validateFileName, validateFileInfo, validateBucketName, validateBucketInfo, validateMaxCount } from "./validation.js";
-import { BUCKET_INFO_MAX_KEYS, BUCKET_INFO_VALUE_MAX, BUCKET_NAME_MAX, BUCKET_NAME_MIN, FILE_INFO_TOTAL_MAX, FILE_INFO_VALUE_MAX, FILE_NAME_MAX_BYTES, LIST_ENDPOINT_CAPS } from "./validation.js";
+import { BUCKET_NAME_MAX, BUCKET_NAME_MIN, FILE_NAME_MAX_BYTES } from "../internal/b2-naming.js";
+import { BUCKET_INFO_MAX_KEYS, BUCKET_INFO_VALUE_MAX, DOWNLOAD_AUTH_DURATION_MAX_SECONDS, DOWNLOAD_AUTH_DURATION_MIN_SECONDS, FILE_INFO_TOTAL_MAX, FILE_INFO_VALUE_MAX, KEY_NAME_MAX, KEY_NAME_MIN, LIST_ENDPOINT_CAPS, normalizeCreateKeyCapabilities, validateBucketInfo, validateBucketName, validateBucketTypes, validateCorsRules, validateCreateKeyCapabilities, validateCreateKeyName, validateDefaultRetention, validateDownloadAuthorizationDuration, validateDownloadAuthorizationPrefix, validateFileInfo, validateFileName, validateLifecycleRules, validateMaxCount, validateNotificationRules, validateReplicationConfiguration } from "./validation.js";
+//#region src/simulator/index.ts
+var UPLOAD_TOKEN_SIGNING_KEY = [
+	"b2 sdk typescript",
+	"simulator upload authorization",
+	"v1"
+].join(":");
+var SIMULATOR_MASTER_APPLICATION_KEY_ID = "master-key-id";
+var SIMULATOR_MASTER_APPLICATION_KEY = "master-key";
+var SIMULATOR_TEST_APPLICATION_KEY_ID = "test-key-id";
+var SIMULATOR_TEST_APPLICATION_KEY = "test-key";
+var SIMULATOR_APPLICATION_KEY_ID_PREFIX = "sim_key_";
+var SIMULATOR_MASTER_CAPABILITIES = [
+	Capability.ListBuckets,
+	Capability.ListAllBucketNames,
+	Capability.ReadBuckets,
+	Capability.WriteBuckets,
+	Capability.DeleteBuckets,
+	Capability.ReadBucketEncryption,
+	Capability.WriteBucketEncryption,
+	Capability.ReadBucketReplications,
+	Capability.WriteBucketReplications,
+	Capability.ReadBucketNotifications,
+	Capability.WriteBucketNotifications,
+	Capability.ReadBucketLogging,
+	Capability.WriteBucketLogging,
+	Capability.ReadBucketLifecycleRules,
+	Capability.WriteBucketLifecycleRules,
+	Capability.ListFiles,
+	Capability.ReadFiles,
+	Capability.WriteFiles,
+	Capability.DeleteFiles,
+	Capability.ListKeys,
+	Capability.WriteKeys,
+	Capability.DeleteKeys,
+	Capability.ShareFiles
+];
+function apiPathParts(path) {
+	const segments = path.split("/").filter((segment) => segment.length > 0);
+	const candidate = segments.at(-2);
+	return {
+		endpoint: segments.at(-1) ?? "",
+		version: candidate !== void 0 && isB2ApiVersion(candidate) ? candidate : "v3"
+	};
+}
+function parseBasicAuthorizationHeader(authzHeader) {
+	if (!authzHeader?.startsWith("Basic ")) return null;
+	const decoded = (() => {
+		try {
+			return atob(authzHeader.slice(6));
+		} catch {
+			return null;
+		}
+	})();
+	if (decoded === null) return null;
+	const idx = decoded.indexOf(":");
+	if (idx <= 0 || idx === decoded.length - 1) return null;
+	return {
+		applicationKeyId: decoded.slice(0, idx),
+		applicationKey: decoded.slice(idx + 1)
+	};
+}
+var B2_MIN_PART_NUMBER = 1;
+var B2_MAX_PART_NUMBER = 1e4;
+function base64UrlEncode(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function base64UrlDecode(encoded) {
+	const base64 = encoded.replaceAll("-", "+").replaceAll("_", "/");
+	const padding = (4 - base64.length % 4) % 4;
+	try {
+		const binary = atob(base64.padEnd(base64.length + padding, "="));
+		return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+	} catch {
+		return null;
+	}
+}
+function timingSafeStringEqual(left, right) {
+	const max = Math.max(left.length, right.length);
+	let mismatch = left.length === right.length ? 0 : 1;
+	for (let i = 0; i < max; i++) mismatch |= (left.charCodeAt(i) || 0) ^ (right.charCodeAt(i) || 0);
+	return mismatch === 0;
+}
+var MS_PER_DAY = 864e5;
+var MAX_JS_DATE_MS = 864e13;
+function isValidRetentionTimestamp(timestamp, now = Date.now()) {
+	return Number.isFinite(timestamp) && timestamp <= MAX_JS_DATE_MS && timestamp > now;
+}
+/**
+* Parse an RFC 7233 `Range` header value into inclusive start/end byte
+* offsets clamped to the file size. Supports closed (`bytes=0-999`),
+* open-ended (`bytes=1000-`), and suffix (`bytes=-500`) forms.
+*
+* @param header - The raw header value (e.g. `'bytes=0-999'`).
+* @param totalSize - The full file size in bytes (for clamping + suffix).
+*
+* @returns A {@link RangeParseResult} tagged with how the simulator
+*   should respond: serve the range, send 416, or ignore the header.
+*
+* @see https://www.rfc-editor.org/rfc/rfc7233#section-2.1
+*/
 function parseRangeHeader(header, totalSize) {
-  const m = header.match(/^bytes=(\d*)-(\d*)$/);
-  if (!m) return { kind: "malformed" };
-  const [, startStr, endStr] = m;
-  const hasStart = startStr !== "";
-  const hasEnd = endStr !== "";
-  if (!hasStart && !hasEnd) return { kind: "malformed" };
-  if (totalSize === 0) return { kind: "unsatisfiable" };
-  let start;
-  let end;
-  if (!hasStart) {
-    const suffixLen = Number.parseInt(endStr ?? "0", 10);
-    if (!Number.isFinite(suffixLen) || suffixLen <= 0) return { kind: "malformed" };
-    start = Math.max(0, totalSize - suffixLen);
-    end = totalSize - 1;
-  } else if (!hasEnd) {
-    start = Number.parseInt(startStr ?? "0", 10);
-    end = totalSize - 1;
-  } else {
-    start = Number.parseInt(startStr ?? "0", 10);
-    end = Number.parseInt(endStr ?? "0", 10);
-  }
-  if (!Number.isFinite(start) || !Number.isFinite(end) || start < 0 || start > end) {
-    return { kind: "malformed" };
-  }
-  if (start >= totalSize) return { kind: "unsatisfiable" };
-  end = Math.min(end, totalSize - 1);
-  return { kind: "ok", start, end };
+	const m = header.match(/^bytes=(\d*)-(\d*)$/);
+	if (!m) return { kind: "malformed" };
+	const [, startStr, endStr] = m;
+	const hasStart = startStr !== "";
+	const hasEnd = endStr !== "";
+	if (!hasStart && !hasEnd) return { kind: "malformed" };
+	if (totalSize === 0) return { kind: "unsatisfiable" };
+	let start;
+	let end;
+	if (!hasStart) {
+		const suffixLen = Number.parseInt(endStr ?? "0", 10);
+		if (!Number.isFinite(suffixLen) || suffixLen <= 0) return { kind: "malformed" };
+		start = Math.max(0, totalSize - suffixLen);
+		end = totalSize - 1;
+	} else if (!hasEnd) {
+		start = Number.parseInt(startStr ?? "0", 10);
+		end = totalSize - 1;
+	} else {
+		start = Number.parseInt(startStr ?? "0", 10);
+		end = Number.parseInt(endStr ?? "0", 10);
+	}
+	if (!Number.isFinite(start) || !Number.isFinite(end) || start < 0 || start > end) return { kind: "malformed" };
+	if (start >= totalSize) return { kind: "unsatisfiable" };
+	end = Math.min(end, totalSize - 1);
+	return {
+		kind: "ok",
+		start,
+		end
+	};
 }
+/**
+* Parse `X-Bz-Info-*` headers (lowercased Map keys) into a plain
+* fileInfo record. Mirrors the SDK's `parseFileInfoHeaders` in
+* `raw/encoding.ts` but operates on a `Record<string, string>` rather
+* than a `Headers` object so the simulator can reuse the same
+* extraction logic without converting back to `Headers`.
+*
+* @param headers - Lowercased header map.
+*
+* @returns Plain `Record<string, string>` of `fileInfo` keys/values.
+*/
 function parseFileInfoHeaders(headers) {
-  const info = {};
-  const prefix = "x-bz-info-";
-  for (const [key, value] of Object.entries(headers)) {
-    if (!key.startsWith(prefix)) continue;
-    const fileInfoKey = decodeURIComponent(key.slice(prefix.length));
-    info[fileInfoKey] = decodeURIComponent(value);
-  }
-  return info;
+	const info = {};
+	const prefix = "x-bz-info-";
+	for (const [key, value] of Object.entries(headers)) {
+		if (!key.startsWith(prefix)) continue;
+		const fileInfoKey = decodeURIComponent(key.slice(10));
+		info[fileInfoKey] = decodeURIComponent(value);
+	}
+	return info;
+}
+function decodeHeaderValue(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+/**
+* Compares B2 file names with deterministic JS string order, not locale collation.
+*
+* @param a - First file name.
+* @param b - Second file name.
+*
+* @returns `-1` when `a` sorts first, `1` when `b` sorts first, otherwise `0`.
+*/
+function compareB2FileNames(a, b) {
+	if (a < b) return -1;
+	if (a > b) return 1;
+	return 0;
+}
+var DOWNLOAD_AUTH_TOKEN_BYTES = 32;
+var DOWNLOAD_AUTH_TOKEN_PREFIX = "sim_dl_auth_";
+var DOWNLOAD_AUTH_PURGE_BATCH_SIZE = 128;
+var DOWNLOAD_RESPONSE_OVERRIDE_PARAMS = [
+	"b2ContentDisposition",
+	"b2ContentLanguage",
+	"b2ContentEncoding",
+	"b2ContentType",
+	"b2CacheControl",
+	"b2Expires"
+];
+var DOWNLOAD_RESPONSE_OVERRIDE_HEADERS = {
+	b2ContentDisposition: DownloadHeaderName.ContentDisposition,
+	b2ContentLanguage: DownloadHeaderName.ContentLanguage,
+	b2ContentEncoding: DownloadHeaderName.ContentEncoding,
+	b2ContentType: DownloadHeaderName.ContentType,
+	b2CacheControl: DownloadHeaderName.CacheControl,
+	b2Expires: DownloadHeaderName.Expires
+};
+function randomDownloadAuthorizationToken() {
+	const crypto = globalThis.crypto;
+	if (typeof crypto?.getRandomValues !== "function") throw new Error("Download authorization tokens require globalThis.crypto.getRandomValues");
+	const bytes = new Uint8Array(DOWNLOAD_AUTH_TOKEN_BYTES);
+	crypto.getRandomValues(bytes);
+	return `${DOWNLOAD_AUTH_TOKEN_PREFIX}${hexEncode(bytes)}`;
+}
+function pickDownloadResponseOverrides(req) {
+	const overrides = {};
+	for (const param of DOWNLOAD_RESPONSE_OVERRIDE_PARAMS) {
+		const value = req[param];
+		if (typeof value === "string") overrides[param] = value;
+	}
+	return overrides;
+}
+function validateDownloadResponseOverrides(req) {
+	for (const param of DOWNLOAD_RESPONSE_OVERRIDE_PARAMS) {
+		const value = req[param];
+		if (value === void 0 || typeof value === "string") continue;
+		return {
+			code: "bad_request",
+			message: `${param} must be a string`
+		};
+	}
+	return null;
+}
+function normalizeKeyBucketIds(req) {
+	return req.bucketIds === void 0 || req.bucketIds === null ? null : Object.freeze([...req.bucketIds]);
+}
+function singleBucketId(bucketIds) {
+	return bucketIds?.length === 1 ? bucketIds[0] ?? null : null;
+}
+function cloneBucketIds(bucketIds) {
+	return bucketIds === null ? null : [...bucketIds];
+}
+function cloneCapabilities(capabilities) {
+	return [...capabilities];
+}
+function isImplicitStorageMasterCredential(credentials) {
+	return credentials.applicationKeyId === SIMULATOR_MASTER_APPLICATION_KEY_ID && credentials.applicationKey === SIMULATOR_MASTER_APPLICATION_KEY || credentials.applicationKeyId === SIMULATOR_TEST_APPLICATION_KEY_ID && credentials.applicationKey === SIMULATOR_TEST_APPLICATION_KEY;
+}
+function isImplicitPartnerMasterCredential(credentials) {
+	return credentials.applicationKeyId === SIMULATOR_MASTER_APPLICATION_KEY_ID && credentials.applicationKey === SIMULATOR_MASTER_APPLICATION_KEY;
+}
+function isSimulatorApplicationKeyId(applicationKeyId) {
+	return applicationKeyId.startsWith(SIMULATOR_APPLICATION_KEY_ID_PREFIX);
+}
+function hasOwnField(body, field) {
+	return typeof body === "object" && body !== null && Object.hasOwn(body, field);
+}
+function requestStringField(body, field) {
+	if (typeof body !== "object" || body === null) return void 0;
+	const value = body[field];
+	return typeof value === "string" ? value : void 0;
+}
+function requestRecord(body) {
+	return typeof body === "object" && body !== null && !Array.isArray(body) ? body : null;
+}
+function replicationDestinationBucketIds(body) {
+	const rules = requestRecord(requestRecord(requestRecord(body)?.["replicationConfiguration"])?.["asReplicationSource"])?.["replicationRules"];
+	if (!Array.isArray(rules)) return [];
+	const bucketIds = [];
+	for (const rule of rules) {
+		const destinationBucketId = requestRecord(rule)?.["destinationBucketId"];
+		if (typeof destinationBucketId === "string") bucketIds.push(destinationBucketId);
+	}
+	return [...new Set(bucketIds)];
+}
+function normalizeReplicationConfiguration(config) {
+	return {
+		asReplicationSource: config.asReplicationSource ?? null,
+		asReplicationDestination: config.asReplicationDestination ?? null
+	};
+}
+function validateBucketConfigurationFields(fields, options) {
+	if (fields.bucketInfo !== void 0) {
+		const infoError = validateBucketInfo(fields.bucketInfo);
+		if (infoError) return infoError;
+	}
+	if (fields.corsRules !== void 0) {
+		const corsError = validateCorsRules(fields.corsRules);
+		if (corsError) return corsError;
+	}
+	if (fields.lifecycleRules !== void 0) {
+		const lifecycleError = validateLifecycleRules(fields.lifecycleRules);
+		if (lifecycleError) return lifecycleError;
+	}
+	if (fields.replicationConfiguration !== void 0) {
+		const replicationError = validateReplicationConfiguration(fields.replicationConfiguration);
+		if (replicationError) return replicationError;
+	}
+	if (fields.defaultRetention !== void 0) {
+		const retentionError = validateDefaultRetention(fields.defaultRetention);
+		if (retentionError) return retentionError;
+		if (requestRecord(fields.defaultRetention)?.["mode"] !== BucketRetentionMode.None && !options.objectLockEnabled) return {
+			code: "file_lock_not_enabled",
+			message: "Bucket must have Object Lock enabled to set defaultRetention"
+		};
+	}
+	return null;
+}
+function nextObjectLockEnabled(current, requested) {
+	if (requested === void 0) return current;
+	if (typeof requested !== "boolean") return {
+		code: "bad_request",
+		message: "fileLockEnabled must be a boolean"
+	};
+	if (current && requested === false) return {
+		code: "file_lock_conflict",
+		message: "Object Lock cannot be disabled"
+	};
+	return current || requested;
 }
-class B2Simulator {
-  buckets = /* @__PURE__ */ new Map();
-  accountId = "sim_account_0001";
-  largeFiles = /* @__PURE__ */ new Map();
-  keys = /* @__PURE__ */ new Map();
-  notificationRules = /* @__PURE__ */ new Map();
-  minimumPartSize;
-  recommendedPartSize;
-  faults = [];
-  nextFaultId = 1;
-  onWebhookDeliver;
-  onReplicate;
-  onHookError;
-  strictAuth;
-  authTokenTtlMs;
-  /**
-   * Issued auth tokens with their associated grant scope + expiry. In
-   * permissive mode (`strictAuth: false`) this is still populated by
-   * `authorize` but never consulted on subsequent requests. In strict
-   * mode each request looks up its `Authorization` header here.
-   */
-  issuedTokens = /* @__PURE__ */ new Map();
-  /**
-   * Virtual-clock offset applied to `Date.now()` for expiry checks.
-   * Defaults to 0. Tests advance via {@link advanceTime} to fast-forward
-   * past auth-token expiry without sleeping.
-   */
-  clockOffsetMs = 0;
-  /**
-   * Per-instance monotonic counter used to mint realistic-looking
-   * IDs (`b2_bucket_<24-hex>`, `4_z<24-hex>`, etc.) and auth tokens.
-   * Module-global previously, which leaked state across `B2Simulator`
-   * instances in the same Vitest worker — concurrent tests could see
-   * colliding tokens. Per-instance ensures determinism within a single
-   * simulator's lifetime.
-   */
-  nextId = 1;
-  /**
-   * Last-issued upload timestamp. The simulator enforces strict
-   * monotonicity so version ordering is deterministic for tests; if
-   * two writes hit the same `Date.now()` millisecond, the second
-   * receives `lastTimestamp + 1`.
-   */
-  lastTimestamp = 0;
-  /**
-   * Outstanding fire-and-forget hook invocations. Tracked so tests
-   * (and future {@link flushHooks} callers) can wait for every
-   * dispatched `onWebhookDeliver` / `onReplicate` callback to settle
-   * before asserting against observable side effects. The microtask
-   * dance in fidelity tests was previously brittle: positive cases
-   * flushed twice, negative cases flushed once, and any addition to
-   * the hook dispatch chain quietly broke the negative path.
-   */
-  pendingHooks = /* @__PURE__ */ new Set();
-  /**
-   * Constructs a new in-memory B2 simulator.
-   * @param options - Optional simulator overrides. See {@link B2SimulatorOptions}.
-   */
-  constructor(options = {}) {
-    this.minimumPartSize = options.minimumPartSize ?? 5e6;
-    this.recommendedPartSize = options.recommendedPartSize ?? 1e8;
-    if (options.onWebhookDeliver !== void 0) this.onWebhookDeliver = options.onWebhookDeliver;
-    if (options.onReplicate !== void 0) this.onReplicate = options.onReplicate;
-    if (options.onHookError !== void 0) this.onHookError = options.onHookError;
-    this.strictAuth = options.strictAuth ?? false;
-    this.authTokenTtlMs = options.authTokenTtlMs ?? 24 * 60 * 60 * 1e3;
-  }
-  /**
-   * Advance the simulator's virtual clock by `ms` milliseconds. Used in
-   * conjunction with `strictAuth: true` + a finite `authTokenTtlMs` to
-   * force token expiry without `setTimeout`-based delays.
-   *
-   * @param ms - Milliseconds to advance. Negative values rewind (rarely useful).
-   */
-  advanceTime(ms) {
-    this.clockOffsetMs += ms;
-  }
-  /**
-   * Current simulator time. Equal to `Date.now() + clockOffsetMs`.
-   *
-   * @returns Unix milliseconds.
-   */
-  now() {
-    return Date.now() + this.clockOffsetMs;
-  }
-  /**
-   * Generate a deterministic-but-realistic-looking B2 identifier of the
-   * shape `<prefix>_<24-hex-counter>`, which approximates the visual
-   * width of real B2 wire IDs. The counter is monotonic per instance
-   * so test fixtures are deterministic across runs of the same
-   * simulator.
-   *
-   * @param prefix - B2-style prefix (`'b2_bucket'`, `'4_z'`, etc.).
-   *
-   * @returns A simulator-issued identifier that looks like a B2 wire ID.
-   */
-  genId(prefix) {
-    const n = this.nextId++;
-    return `${prefix}_${n.toString(16).padStart(24, "0")}`;
-  }
-  /**
-   * Return a strictly-increasing upload timestamp, even when multiple
-   * writes land in the same `Date.now()` millisecond. Tests rely on
-   * `uploadTimestamp` ordering to discriminate file versions; ties from
-   * coarse system-clock resolution would otherwise make version
-   * selection nondeterministic.
-   *
-   * @returns Unix milliseconds.
-   */
-  monotonicTimestamp() {
-    const now = Date.now();
-    if (now <= this.lastTimestamp) {
-      this.lastTimestamp += 1;
-    } else {
-      this.lastTimestamp = now;
-    }
-    return this.lastTimestamp;
-  }
-  /**
-   * Wait for every fire-and-forget hook (`onWebhookDeliver`,
-   * `onReplicate`) currently in flight to settle. Use in tests after
-   * an upload/copy/finish-large-file call to deterministically observe
-   * hook side effects without microtask-flush guesswork.
-   *
-   * @returns A promise that resolves once every pending hook callback
-   *   has either resolved or rejected.
-   */
-  async flushHooks() {
-    while (this.pendingHooks.size > 0) {
-      const snapshot = [...this.pendingHooks];
-      await Promise.allSettled(snapshot);
-    }
-  }
-  /**
-   * Authorize a request against the strict-auth bookkeeping. Returns
-   * a `SimulatorJsonResponse` error on failure or `null` on success.
-   * Only consulted when `strictAuth: true`.
-   *
-   * @param authToken - The `Authorization` header value from the request.
-   * @param endpoint - B2 endpoint name being invoked.
-   * @param bucketId - Optional bucket ID the request operates on, for scope check.
-   * @param fileName - Optional file name the request operates on, for prefix check.
-   *
-   * @returns `null` when the request is authorized, otherwise a 401/403 response.
-   */
-  authorizeRequest(authToken, endpoint, bucketId2, fileName) {
-    const required = missingCapabilitiesFor(endpoint, []);
-    const noCheckNeeded = required.length === 0 && endpoint === "b2_authorize_account";
-    if (noCheckNeeded) return null;
-    if (authToken === void 0 || authToken === "") {
-      return this.error(401, "bad_auth_token", "missing Authorization header");
-    }
-    const token = this.issuedTokens.get(authToken);
-    if (!token) {
-      return this.error(401, "bad_auth_token", "unknown auth token");
-    }
-    if (this.now() > token.expiresAt) {
-      return this.error(401, "expired_auth_token", "auth token has expired; reauthorize");
-    }
-    const missing = missingCapabilitiesFor(endpoint, token.capabilities);
-    if (missing.length > 0) {
-      return this.error(
-        403,
-        "unauthorized",
-        `application key lacks required capabilities: ${missing.join(", ")}`
-      );
-    }
-    if (token.bucketId !== null && bucketId2 !== void 0 && bucketId2 !== token.bucketId) {
-      return this.error(
-        403,
-        "unauthorized",
-        `application key is scoped to bucket ${token.bucketId}; cannot access ${bucketId2}`
-      );
-    }
-    if (token.namePrefix !== null && fileName !== void 0 && !fileName.startsWith(token.namePrefix)) {
-      return this.error(
-        403,
-        "unauthorized",
-        `application key is scoped to prefix "${token.namePrefix}"; "${fileName}" is outside scope`
-      );
-    }
-    return null;
-  }
-  /**
-   * Look up the application key matching the `Authorization` header on
-   * an `authorize_account` request. The header is in the form
-   * `Basic base64(applicationKeyId:applicationKey)`.
-   *
-   * Returns `null` for the implicit master credential (anything that
-   * does not match a key minted via `b2_create_key`); in that case
-   * `authorize` grants the full master capability set.
-   *
-   * @param authzHeader - Raw HTTP `Authorization` header value.
-   *
-   * @returns The matching key's grant scope, or `null` for the master.
-   */
-  findKeyForAuthHeader(authzHeader) {
-    if (!authzHeader || !authzHeader.startsWith("Basic ")) return null;
-    const decoded = (() => {
-      try {
-        return atob(authzHeader.slice(6));
-      } catch {
-        return null;
-      }
-    })();
-    if (decoded === null) return null;
-    const idx = decoded.indexOf(":");
-    if (idx === -1) return null;
-    const applicationKeyId = decoded.slice(0, idx);
-    const applicationKey = decoded.slice(idx + 1);
-    const stored = this.keys.get(applicationKeyId);
-    if (!stored || stored.applicationKey !== applicationKey) return null;
-    return {
-      capabilities: stored.capabilities,
-      bucketId: stored.bucketId,
-      namePrefix: stored.namePrefix,
-      applicationKeyId
-    };
-  }
-  /**
-   * Creates an {@link HttpTransport} that routes requests to this simulator.
-   * @returns A transport instance backed by this in-memory simulator.
-   */
-  transport() {
-    return new SimulatorTransport(this);
-  }
-  /**
-   * Register a synthetic failure to inject on requests whose URL contains
-   * `spec.on`. Use this to exercise retry / backoff / error-handling
-   * paths in tests without hand-rolling a wrapping `HttpTransport`. The
-   * fault is consumed in registration order on each matched request;
-   * once its `count` budget is exhausted it auto-retires.
-   *
-   * Faults are checked BEFORE the simulator's real handlers run, so a
-   * matched request never touches in-memory state — failed uploads
-   * don't create partial parts, failed deletes don't remove anything.
-   *
-   * @param spec - The failure to inject. See {@link FaultSpec}.
-   *
-   * @returns A handle whose `clear()` method removes this specific
-   *   fault registration (other faults remain in effect).
-   *
-   * @example
-   * ```ts
-   * // Fail the next 2 b2_upload_part calls with 503, then succeed.
-   * sim.injectFailure({ on: 'b2_upload_part', status: 503, count: 2 })
-   *
-   * // Fail every b2_authorize_account with 401 + Retry-After: 5.
-   * const handle = sim.injectFailure({
-   *   on: 'b2_authorize_account',
-   *   status: 401,
-   *   code: 'expired_auth_token',
-   *   retryAfter: 5,
-   * })
-   * // ... later
-   * handle.clear()
-   * ```
-   */
-  injectFailure(spec) {
-    const id = this.nextFaultId++;
-    const fault = {
-      id,
-      spec,
-      remainingSkip: spec.skip ?? 0,
-      remainingCount: spec.count ?? Number.POSITIVE_INFINITY
-    };
-    this.faults.push(fault);
-    return {
-      clear: () => {
-        const idx = this.faults.findIndex((f) => f.id === id);
-        if (idx !== -1) this.faults.splice(idx, 1);
-      }
-    };
-  }
-  /**
-   * Remove every registered fault. Equivalent to calling `.clear()` on
-   * every handle returned by {@link injectFailure}, plus a defensive
-   * reset for tests that re-use a simulator across cases.
-   */
-  clearFaults() {
-    this.faults.length = 0;
-  }
-  /**
-   * Internal: checks the registered faults for a match on the given URL
-   * and consumes one if it should fire. Called from
-   * {@link SimulatorTransport.send} before any real handler runs.
-   *
-   * @param url - The request URL to match against each fault's `on`
-   *   substring.
-   *
-   * @returns The fault to apply, or `null` if no fault should fire.
-   *
-   * @internal
-   */
-  consumeMatchingFault(url) {
-    for (let i = 0; i < this.faults.length; i++) {
-      const fault = this.faults[i];
-      if (!url.includes(fault.spec.on)) continue;
-      if (fault.remainingSkip > 0) {
-        fault.remainingSkip -= 1;
-        continue;
-      }
-      if (fault.remainingCount <= 0) continue;
-      fault.remainingCount -= 1;
-      if (fault.remainingCount <= 0) {
-        this.faults.splice(i, 1);
-      }
-      return fault.spec;
-    }
-    return null;
-  }
-  /**
-   * Dispatches a JSON API request to the appropriate handler.
-   * @param _method - The HTTP method (unused).
-   * @param path - The request URL path containing the B2 endpoint name.
-   * @param headers - The HTTP request headers; consulted by the
-   *   strict-auth gate to look up the issued auth token.
-   * @param body - The parsed JSON request body.
-   *
-   * @returns An object with HTTP status and JSON response body.
-   */
-  async handleRequest(_method, path, headers, body) {
-    const endpoint = path.split("/").pop() ?? "";
-    if (this.strictAuth) {
-      const authError = this.authorizeRequest(headers["authorization"], endpoint);
-      if (authError !== null) return authError;
-    }
-    switch (endpoint) {
-      case "b2_authorize_account":
-        return this.authorize(headers["authorization"]);
-      case "b2_create_bucket":
-        return this.createBucket(
-          body
-        );
-      case "b2_list_buckets":
-        return this.listBuckets();
-      case "b2_delete_bucket":
-        return this.deleteBucket(body);
-      case "b2_update_bucket":
-        return this.updateBucket(body);
-      case "b2_get_upload_url":
-        return this.getUploadUrl(body);
-      case "b2_list_file_names":
-        return this.listFileNames(
-          body
-        );
-      case "b2_list_file_versions":
-        return this.listFileVersions(
-          body
-        );
-      case "b2_get_file_info":
-        return this.getFileInfo(body);
-      case "b2_hide_file":
-        return this.hideFile(body);
-      case "b2_delete_file_version":
-        return this.deleteFileVersion(
-          body
-        );
-      case "b2_copy_file":
-        return this.copyFile(
-          body
-        );
-      case "b2_start_large_file":
-        return this.startLargeFile(
-          body
-        );
-      case "b2_get_upload_part_url":
-        return this.getUploadPartUrl(body);
-      case "b2_finish_large_file":
-        return this.finishLargeFile(body);
-      case "b2_cancel_large_file":
-        return this.cancelLargeFile(body);
-      case "b2_list_unfinished_large_files":
-        return this.listUnfinishedLargeFiles(
-          body
-        );
-      case "b2_list_parts":
-        return this.listParts(
-          body
-        );
-      case "b2_copy_part":
-        return await this.copyPart(
-          body
-        );
-      case "b2_get_download_authorization":
-        return this.getDownloadAuthorization(
-          body
-        );
-      case "b2_create_key":
-        return this.createKey(
-          body
-        );
-      case "b2_list_keys":
-        return this.listKeys(
-          body
-        );
-      case "b2_delete_key":
-        return this.deleteKey(body);
-      case "b2_update_file_retention":
-        return this.updateFileRetention(
-          body
-        );
-      case "b2_update_file_legal_hold":
-        return this.updateFileLegalHold(
-          body
-        );
-      case "b2_get_bucket_notification_rules":
-        return this.getBucketNotificationRules(body);
-      case "b2_set_bucket_notification_rules":
-        return this.setBucketNotificationRules(
-          body
-        );
-      default:
-        return {
-          status: 400,
-          body: { status: 400, code: "bad_request", message: `Unknown endpoint: ${endpoint}` }
-        };
-    }
-  }
-  /**
-   * Handles file and part upload requests (`b2_upload_file`, `b2_upload_part`).
-   * Dispatches to the appropriate internal handler based on the URL.
-   * @param url - The upload endpoint URL used to determine the upload type.
-   * @param headers - The HTTP headers containing file metadata and authorization.
-   * @param data - The raw file or part content as bytes.
-   *
-   * @returns An object with HTTP status and JSON response body.
-   */
-  handleUpload(url, headers, data) {
-    const isPart = url.includes("b2_upload_part");
-    if (this.strictAuth) {
-      const endpoint = isPart ? "b2_upload_part" : "b2_upload_file";
-      const authError = this.authorizeRequest(headers["authorization"], endpoint);
-      if (authError !== null) return authError;
-    }
-    if (isPart) {
-      return this.handleUploadPart(url, headers, data);
-    }
-    return this.handleUploadFile(url, headers, data);
-  }
-  /**
-   * Handles file download requests (`b2_download_file_by_id`, `/file/` by name).
-   * Returns the file data along with B2 response headers.
-   * @param path - The request URL path identifying the file to download.
-   * @param headers - The HTTP request headers for range or authorization.
-   * @param method - The HTTP method; `'HEAD'` suppresses the response body.
-   *
-   * @returns The download response containing file data and B2 headers.
-   */
-  handleDownload(path, headers, method = "GET") {
-    if (path.includes("b2_download_file_by_id")) {
-      if (this.strictAuth) {
-        const authError = this.authorizeRequest(headers["authorization"], "b2_download_file_by_id");
-        if (authError !== null) return this.errorAsDownload(authError);
-      }
-      const url = new URL(`http://localhost${path}`);
-      const fileId2 = url.searchParams.get("fileId") ?? "";
-      return this.finalizeDownload(this.downloadById(fileId2, headers["range"]), url, method);
-    }
-    const fileMatch = path.match(/^([^?]+)/)?.[1]?.match(/\/file\/([^/]+)\/(.+)/);
-    if (fileMatch) {
-      const bucketName = decodeURIComponent(fileMatch[1] ?? "");
-      const fileName = decodeURIComponent(fileMatch[2] ?? "");
-      if (this.strictAuth) {
-        const authError = this.authorizeRequest(
-          headers["authorization"],
-          "b2_download_file_by_name",
-          void 0,
-          fileName
-        );
-        if (authError !== null) return this.errorAsDownload(authError);
-      }
-      const url = new URL(`http://localhost${path}`);
-      return this.finalizeDownload(
-        this.downloadByName(bucketName, fileName, headers["range"]),
-        url,
-        method
-      );
-    }
-    return { status: 404, headers: {}, data: null };
-  }
-  /**
-   * Convert a synthetic JSON error body into a `SimulatorDownloadResponse`
-   * shape so the strict-auth gate on download paths can surface 401/403s
-   * through the same transport plumbing as a regular failed download.
-   *
-   * @param json - The JSON error from {@link authorizeRequest}.
-   *
-   * @returns A download-shaped response with the error body bytes inline.
-   */
-  errorAsDownload(json) {
-    return {
-      status: json.status,
-      headers: { "Content-Type": "application/json" },
-      data: utf8Encoder.encode(JSON.stringify(json.body))
-    };
-  }
-  /**
-   * Applies HEAD-method body suppression and `b2Content*` response-header
-   * overrides parsed from the download URL's query string. Mirrors what the
-   * real B2 service does: any `b2Content*` query parameter is echoed back as
-   * the corresponding response header.
-   *
-   * @param response - The download response produced by {@link downloadById} or {@link downloadByName}.
-   * @param url - The parsed download URL (used to read `b2Content*` query params).
-   * @param method - The HTTP method of the originating request.
-   *
-   * @returns The response with overrides applied.
-   */
-  finalizeDownload(response, url, method) {
-    const overrideMap = {
-      b2ContentDisposition: "Content-Disposition",
-      b2ContentLanguage: "Content-Language",
-      b2ContentEncoding: "Content-Encoding",
-      b2ContentType: "Content-Type",
-      b2CacheControl: "Cache-Control",
-      b2Expires: "Expires"
-    };
-    const newHeaders = { ...response.headers };
-    for (const [param, header] of Object.entries(overrideMap)) {
-      const value = url.searchParams.get(param);
-      if (value !== null) newHeaders[header] = value;
-    }
-    const data = method === "HEAD" ? null : response.data;
-    return { status: response.status, headers: newHeaders, data };
-  }
-  handleUploadFile(url, headers, data) {
-    const bucketId2 = new URL(url).searchParams.get("bucketId");
-    if (!bucketId2) return this.error(400, "bad_request", "Missing bucketId");
-    const bucket = this.buckets.get(bucketId2);
-    if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
-    const fileName = decodeURIComponent(headers["x-bz-file-name"] ?? "");
-    const contentType = headers["content-type"] ?? "application/octet-stream";
-    const sha1 = headers["x-bz-content-sha1"] ?? "none";
-    const fileNameError = validateFileName(fileName);
-    if (fileNameError) return this.error(400, fileNameError.code, fileNameError.message);
-    const fileInfo = parseFileInfoHeaders(headers);
-    const fileInfoError = validateFileInfo(fileInfo);
-    if (fileInfoError) return this.error(400, fileInfoError.code, fileInfoError.message);
-    const fileVersion = this.makeFileVersion({
-      bucketId: bucketId2,
-      fileName,
-      contentType,
-      contentLength: data.byteLength,
-      contentSha1: sha1,
-      action: FileAction.Upload
-    });
-    const stored = { fileVersion, data };
-    const existing = bucket.files.get(fileName);
-    if (existing) {
-      existing.push(stored);
-    } else {
-      bucket.files.set(fileName, [stored]);
-    }
-    this.firePostUploadHooks(fileVersion, bucketId2, "b2:ObjectCreated:Upload");
-    return { status: 200, body: fileVersion };
-  }
-  handleUploadPart(url, headers, data) {
-    const fileId2 = new URL(url).searchParams.get("fileId");
-    if (!fileId2) return this.error(400, "bad_request", "Missing fileId");
-    const large = this.largeFiles.get(fileId2);
-    if (!large) return this.error(400, "bad_request", "Large file not found");
-    const partNumber = Number.parseInt(headers["x-bz-part-number"] ?? "0", 10);
-    const sha1 = headers["x-bz-content-sha1"] ?? "none";
-    large.parts.set(partNumber, { data, sha1 });
-    return {
-      status: 200,
-      body: {
-        fileId: large.fileId,
-        partNumber,
-        contentLength: data.byteLength,
-        contentSha1: sha1,
-        serverSideEncryption: { mode: EncryptionMode.None },
-        uploadTimestamp: Date.now()
-      }
-    };
-  }
-  downloadById(fileId2, range) {
-    const found = this.findFile(fileId2);
-    if (found === null) return { status: 404, headers: {}, data: null };
-    return this.serveFile(found.stored, range);
-  }
-  downloadByName(bucketName, fileName, range) {
-    for (const bucket of this.buckets.values()) {
-      if (bucket.info.bucketName !== bucketName) continue;
-      const versions = bucket.files.get(fileName);
-      if (!versions || versions.length === 0) break;
-      const latest = versions[versions.length - 1];
-      if (!latest || latest.fileVersion.action === FileAction.Hide) {
-        return { status: 404, headers: {}, data: null };
-      }
-      return this.serveFile(latest, range);
-    }
-    return { status: 404, headers: {}, data: null };
-  }
-  serveFile(stored, range) {
-    const fullData = stored.data;
-    let data = fullData;
-    let status = 200;
-    let contentRange = null;
-    if (range) {
-      const parsed = parseRangeHeader(range, fullData.byteLength);
-      if (parsed.kind === "ok") {
-        data = fullData.subarray(parsed.start, parsed.end + 1);
-        status = 206;
-        contentRange = `bytes ${parsed.start}-${parsed.end}/${fullData.byteLength}`;
-      } else if (parsed.kind === "unsatisfiable") {
-        return {
-          status: 416,
-          headers: {
-            "Content-Type": stored.fileVersion.contentType,
-            "Content-Range": `bytes */${fullData.byteLength}`
-          },
-          data: new Uint8Array(0)
-        };
-      }
-    }
-    const fv = stored.fileVersion;
-    const headers = {
-      "Content-Type": fv.contentType,
-      "Content-Length": String(data.byteLength),
-      "X-Bz-File-Id": fv.fileId,
-      "X-Bz-File-Name": encodeURIComponent(fv.fileName),
-      "X-Bz-Content-Sha1": fv.contentSha1 ?? "none",
-      "X-Bz-Upload-Timestamp": String(fv.uploadTimestamp),
-      "X-Bz-Info-src_last_modified_millis": String(fv.uploadTimestamp)
-    };
-    if (contentRange !== null) {
-      headers["Content-Range"] = contentRange;
-    }
-    return { status, headers, data };
-  }
-  // --- API handlers ---
-  authorize(authzHeader) {
-    const capabilities = [
-      Capability.ListBuckets,
-      Capability.ReadBuckets,
-      Capability.WriteBuckets,
-      Capability.DeleteBuckets,
-      Capability.ListFiles,
-      Capability.ReadFiles,
-      Capability.WriteFiles,
-      Capability.DeleteFiles,
-      Capability.ListKeys,
-      Capability.WriteKeys,
-      Capability.DeleteKeys,
-      Capability.ShareFiles,
-      Capability.ReadBucketNotifications,
-      Capability.WriteBucketNotifications
-    ];
-    const keyForAuth = this.findKeyForAuthHeader(authzHeader);
-    const tokenStr = `sim_auth_token_${this.nextId++}`;
-    this.issuedTokens.set(tokenStr, {
-      capabilities: keyForAuth?.capabilities ?? capabilities,
-      bucketId: keyForAuth?.bucketId ?? null,
-      namePrefix: keyForAuth?.namePrefix ?? null,
-      expiresAt: this.now() + this.authTokenTtlMs,
-      applicationKeyId: keyForAuth?.applicationKeyId ?? null
-    });
-    return {
-      status: 200,
-      body: {
-        accountId: accountId(this.accountId),
-        // `AuthToken` has no public factory by design — auth tokens are
-        // minted by B2, not constructed by user code. The simulator is
-        // the only legitimate place that needs to forge one.
-        authorizationToken: tokenStr,
-        apiInfo: {
-          storageApi: {
-            absoluteMinimumPartSize: this.minimumPartSize,
-            apiUrl: "http://localhost:0",
-            bucketId: keyForAuth?.bucketId ?? null,
-            bucketName: null,
-            downloadUrl: "http://localhost:0",
-            infoType: "storageApi",
-            namePrefix: keyForAuth?.namePrefix ?? null,
-            recommendedPartSize: this.recommendedPartSize,
-            s3ApiUrl: "http://localhost:0",
-            allowed: {
-              capabilities: keyForAuth?.capabilities ?? capabilities,
-              bucketId: keyForAuth?.bucketId ?? null,
-              bucketName: null,
-              namePrefix: keyForAuth?.namePrefix ?? null
-            }
-          }
-        },
-        applicationKeyExpirationTimestamp: null
-      }
-    };
-  }
-  createBucket(req) {
-    const nameError = validateBucketName(req.bucketName);
-    if (nameError) return this.error(400, nameError.code, nameError.message);
-    if (req.bucketInfo !== void 0) {
-      const infoError = validateBucketInfo(req.bucketInfo);
-      if (infoError) return this.error(400, infoError.code, infoError.message);
-    }
-    for (const b of this.buckets.values()) {
-      if (b.info.bucketName === req.bucketName) {
-        return this.error(400, "duplicate_bucket_name", "Bucket name already in use");
-      }
-    }
-    const bid = bucketId(this.genId("b2_bucket"));
-    const defaultRetention = req.defaultRetention ?? {
-      mode: BucketRetentionMode.None,
-      period: null
-    };
-    const info = {
-      accountId: accountId(req.accountId),
-      bucketId: bid,
-      bucketName: req.bucketName,
-      bucketType: req.bucketType,
-      bucketInfo: req.bucketInfo ?? {},
-      corsRules: req.corsRules ?? [],
-      defaultServerSideEncryption: req.defaultServerSideEncryption ?? { mode: EncryptionMode.None },
-      fileLockConfiguration: {
-        isClientAuthorizedToRead: true,
-        value: {
-          isFileLockEnabled: req.fileLockEnabled ?? false,
-          defaultRetention
-        }
-      },
-      lifecycleRules: req.lifecycleRules ?? [],
-      options: [],
-      revision: 1,
-      defaultRetention,
-      replicationConfiguration: req.replicationConfiguration ?? {
-        asReplicationSource: null,
-        asReplicationDestination: null
-      }
-    };
-    this.buckets.set(bid, { info, files: /* @__PURE__ */ new Map() });
-    return { status: 200, body: info };
-  }
-  listBuckets() {
-    const buckets = [...this.buckets.values()].map((b) => b.info);
-    return { status: 200, body: { buckets } };
-  }
-  deleteBucket(req) {
-    const bucket = this.buckets.get(req.bucketId);
-    if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
-    this.buckets.delete(req.bucketId);
-    return { status: 200, body: bucket.info };
-  }
-  updateBucket(req) {
-    const bucket = this.buckets.get(req["bucketId"]);
-    if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
-    if (req["bucketInfo"] !== void 0) {
-      const infoError = validateBucketInfo(req["bucketInfo"]);
-      if (infoError) return this.error(400, infoError.code, infoError.message);
-    }
-    const updated = {
-      ...bucket.info,
-      ...req["bucketType"] !== void 0 ? { bucketType: req["bucketType"] } : {},
-      ...req["bucketInfo"] !== void 0 ? { bucketInfo: req["bucketInfo"] } : {},
-      ...req["lifecycleRules"] !== void 0 ? { lifecycleRules: req["lifecycleRules"] } : {},
-      ...req["corsRules"] !== void 0 ? { corsRules: req["corsRules"] } : {},
-      ...req["replicationConfiguration"] !== void 0 ? {
-        replicationConfiguration: req["replicationConfiguration"]
-      } : {},
-      ...req["defaultRetention"] !== void 0 ? {
-        defaultRetention: req["defaultRetention"],
-        fileLockConfiguration: {
-          isClientAuthorizedToRead: true,
-          value: {
-            isFileLockEnabled: bucket.info.fileLockConfiguration.value?.isFileLockEnabled ?? false,
-            defaultRetention: req["defaultRetention"]
-          }
-        }
-      } : {},
-      ...req["defaultServerSideEncryption"] !== void 0 ? {
-        defaultServerSideEncryption: req["defaultServerSideEncryption"]
-      } : {},
-      revision: bucket.info.revision + 1
-    };
-    this.buckets.set(req["bucketId"], { info: updated, files: bucket.files });
-    return { status: 200, body: updated };
-  }
-  getUploadUrl(req) {
-    if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
-    return {
-      status: 200,
-      body: {
-        bucketId: req.bucketId,
-        uploadUrl: `http://localhost:0/b2api/v3/b2_upload_file?bucketId=${req.bucketId}`,
-        authorizationToken: "sim_upload_token"
-      }
-    };
-  }
-  listFileNames(req) {
-    const bucket = this.buckets.get(req.bucketId);
-    if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
-    const countError = validateMaxCount(req.maxFileCount, "b2_list_file_names");
-    if (countError) return this.error(400, countError.code, countError.message);
-    const max = req.maxFileCount ?? 1e3;
-    const prefix = req.prefix ?? "";
-    let allFiles = [...bucket.files.entries()].filter(([name]) => name.startsWith(prefix)).map(([_, versions]) => versions[versions.length - 1]).filter((v) => v !== void 0).map((v) => v.fileVersion).sort((a, b) => a.fileName.localeCompare(b.fileName));
-    if (req.startFileName) {
-      const start = req.startFileName;
-      allFiles = allFiles.filter((f) => f.fileName >= start);
-    }
-    const files = allFiles.slice(0, max);
-    const nextFileName = allFiles.length > max ? allFiles[max]?.fileName ?? null : null;
-    return { status: 200, body: { files, nextFileName } };
-  }
-  listFileVersions(req) {
-    const bucket = this.buckets.get(req.bucketId);
-    if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
-    const countError = validateMaxCount(req.maxFileCount, "b2_list_file_versions");
-    if (countError) return this.error(400, countError.code, countError.message);
-    const max = req.maxFileCount ?? 1e3;
-    const prefix = req.prefix ?? "";
-    const allVersions = [...bucket.files.entries()].filter(([name]) => name.startsWith(prefix)).flatMap(([_, versions]) => versions.map((v) => v.fileVersion)).sort((a, b) => {
-      const nameCmp = a.fileName.localeCompare(b.fileName);
-      if (nameCmp !== 0) return nameCmp;
-      return b.uploadTimestamp - a.uploadTimestamp;
-    });
-    let startIdx = 0;
-    if (req.startFileName !== void 0) {
-      const startName = req.startFileName;
-      const startId = req.startFileId;
-      const nameIdx = allVersions.findIndex((f) => f.fileName >= startName);
-      if (nameIdx === -1) {
-        startIdx = allVersions.length;
-      } else if (startId !== void 0) {
-        const exactIdx = allVersions.findIndex((f, i) => i >= nameIdx && f.fileId === startId);
-        startIdx = exactIdx !== -1 ? exactIdx : nameIdx;
-      } else {
-        startIdx = nameIdx;
-      }
-    }
-    const sliced = allVersions.slice(startIdx, startIdx + max);
-    const hasMore = startIdx + max < allVersions.length;
-    const nextFileName = hasMore ? allVersions[startIdx + max]?.fileName ?? null : null;
-    const nextFileId = hasMore ? allVersions[startIdx + max]?.fileId ?? null : null;
-    return { status: 200, body: { files: sliced, nextFileName, nextFileId } };
-  }
-  getFileInfo(req) {
-    const found = this.findFile(req.fileId);
-    if (found === null) return this.error(404, "file_not_present", "File not found");
-    return { status: 200, body: found.stored.fileVersion };
-  }
-  hideFile(req) {
-    const bucket = this.buckets.get(req.bucketId);
-    if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
-    const nameError = validateFileName(req.fileName);
-    if (nameError) return this.error(400, nameError.code, nameError.message);
-    const fileVersion = this.makeFileVersion({
-      bucketId: req.bucketId,
-      fileName: req.fileName,
-      contentType: "application/octet-stream",
-      contentLength: 0,
-      contentSha1: "none",
-      action: FileAction.Hide
-    });
-    const existing = bucket.files.get(req.fileName);
-    const stored = { fileVersion, data: new Uint8Array(0) };
-    if (existing) {
-      existing.push(stored);
-    } else {
-      bucket.files.set(req.fileName, [stored]);
-    }
-    return { status: 200, body: fileVersion };
-  }
-  deleteFileVersion(req) {
-    const found = this.findFile(req.fileId);
-    if (found === null || found.stored.fileVersion.fileName !== req.fileName) {
-      return this.error(400, "file_not_present", "File version not found");
-    }
-    const fv = found.stored.fileVersion;
-    const retention = fv.fileRetention?.value;
-    const legalHold = fv.legalHold?.value;
-    const now = Date.now();
-    if (legalHold === "on") {
-      return this.error(
-        400,
-        "file_lock_legal_hold_protected",
-        "File is on legal hold and cannot be deleted"
-      );
-    }
-    if (retention?.mode === "compliance" && retention.retainUntilTimestamp !== null && retention.retainUntilTimestamp > now) {
-      return this.error(
-        400,
-        "file_lock_compliance_protected",
-        `File is under compliance-mode retention and cannot be deleted until ${new Date(retention.retainUntilTimestamp).toISOString()}`
-      );
-    }
-    if (retention?.mode === "governance" && retention.retainUntilTimestamp !== null && retention.retainUntilTimestamp > now && req.bypassGovernance !== true) {
-      return this.error(
-        400,
-        "file_lock_governance_protected",
-        "File is under governance-mode retention; pass bypassGovernance: true to delete"
-      );
-    }
-    found.versions.splice(found.index, 1);
-    if (found.versions.length === 0) found.bucket.files.delete(req.fileName);
-    return { status: 200, body: { fileId: req.fileId, fileName: req.fileName } };
-  }
-  copyFile(req) {
-    const nameError = validateFileName(req.fileName);
-    if (nameError) return this.error(400, nameError.code, nameError.message);
-    const found = this.findFile(req.sourceFileId);
-    if (found === null) return this.error(404, "file_not_present", "Source file not found");
-    const sourceStored = found.stored;
-    const destBucketId = req.destinationBucketId ?? found.bucketId;
-    const destBucket = this.buckets.get(destBucketId);
-    if (!destBucket) return this.error(400, "bad_bucket_id", "Destination bucket not found");
-    const fileVersion = this.makeFileVersion({
-      bucketId: destBucketId,
-      fileName: req.fileName,
-      contentType: sourceStored.fileVersion.contentType,
-      contentLength: sourceStored.data.byteLength,
-      contentSha1: sourceStored.fileVersion.contentSha1 ?? "none",
-      action: FileAction.Copy
-    });
-    const copied = { fileVersion, data: new Uint8Array(sourceStored.data) };
-    const existing = destBucket.files.get(req.fileName);
-    if (existing) {
-      existing.push(copied);
-    } else {
-      destBucket.files.set(req.fileName, [copied]);
-    }
-    this.firePostUploadHooks(fileVersion, destBucketId, "b2:ObjectCreated:Copy");
-    return { status: 200, body: fileVersion };
-  }
-  startLargeFile(req) {
-    if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
-    const nameError = validateFileName(req.fileName);
-    if (nameError) return this.error(400, nameError.code, nameError.message);
-    if (req.fileInfo !== void 0) {
-      const infoError = validateFileInfo(req.fileInfo);
-      if (infoError) return this.error(400, infoError.code, infoError.message);
-    }
-    const fid = this.genId("4_z");
-    const large = {
-      fileId: fid,
-      bucketId: req.bucketId,
-      fileName: req.fileName,
-      contentType: req.contentType,
-      fileInfo: req.fileInfo ?? {},
-      parts: /* @__PURE__ */ new Map()
-    };
-    this.largeFiles.set(fid, large);
-    return {
-      status: 200,
-      body: {
-        fileId: fid,
-        fileName: req.fileName,
-        accountId: this.accountId,
-        bucketId: req.bucketId,
-        contentType: req.contentType,
-        fileInfo: large.fileInfo
-      }
-    };
-  }
-  getUploadPartUrl(req) {
-    if (!this.largeFiles.has(req.fileId))
-      return this.error(400, "bad_request", "Large file not found");
-    return {
-      status: 200,
-      body: {
-        fileId: req.fileId,
-        uploadUrl: `http://localhost:0/b2api/v3/b2_upload_part?fileId=${req.fileId}`,
-        authorizationToken: "sim_part_token"
-      }
-    };
-  }
-  finishLargeFile(req) {
-    const large = this.largeFiles.get(req.fileId);
-    if (!large) return this.error(400, "bad_request", "Large file not found");
-    const bucket = this.buckets.get(large.bucketId);
-    if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
-    const sortedParts = [...large.parts.entries()].sort((a, b) => a[0] - b[0]);
-    if (sortedParts.length > 1e4) {
-      return this.error(
-        400,
-        "bad_request",
-        `multipart upload has ${sortedParts.length} parts; B2 caps at 10000`
-      );
-    }
-    for (const [partNumber] of sortedParts) {
-      if (!Number.isInteger(partNumber) || partNumber < 1 || partNumber > 1e4) {
-        return this.error(
-          400,
-          "bad_request",
-          `partNumber ${partNumber} is outside the [1, 10000] range B2 accepts`
-        );
-      }
-    }
-    if (req.partSha1Array.length !== sortedParts.length) {
-      return this.error(
-        400,
-        "bad_request",
-        `partSha1Array has ${req.partSha1Array.length} entries but ${sortedParts.length} parts were uploaded`
-      );
-    }
-    for (let i = 0; i < sortedParts.length - 1; i++) {
-      const [partNumber, part] = sortedParts[i];
-      if (part.data.byteLength < this.minimumPartSize) {
-        return this.error(
-          400,
-          "bad_request",
-          `part ${partNumber} (${part.data.byteLength} bytes) is smaller than the minimum part size of ${this.minimumPartSize}`
-        );
-      }
-    }
-    let totalSize = 0;
-    for (const [_, part] of sortedParts) totalSize += part.data.byteLength;
-    const combined = new Uint8Array(totalSize);
-    let offset = 0;
-    for (const [_, part] of sortedParts) {
-      combined.set(part.data, offset);
-      offset += part.data.byteLength;
-    }
-    const fileVersion = this.makeFileVersion({
-      bucketId: large.bucketId,
-      fileName: large.fileName,
-      contentType: large.contentType,
-      contentLength: totalSize,
-      contentSha1: "none",
-      action: FileAction.Upload
-    });
-    const stored = { fileVersion, data: combined };
-    const existing = bucket.files.get(large.fileName);
-    if (existing) {
-      existing.push(stored);
-    } else {
-      bucket.files.set(large.fileName, [stored]);
-    }
-    this.largeFiles.delete(req.fileId);
-    this.firePostUploadHooks(fileVersion, large.bucketId, "b2:ObjectCreated:Upload");
-    return { status: 200, body: fileVersion };
-  }
-  cancelLargeFile(req) {
-    const large = this.largeFiles.get(req.fileId);
-    if (!large) return this.error(400, "bad_request", "Large file not found");
-    this.largeFiles.delete(req.fileId);
-    return {
-      status: 200,
-      body: {
-        fileId: large.fileId,
-        accountId: this.accountId,
-        bucketId: large.bucketId,
-        fileName: large.fileName
-      }
-    };
-  }
-  listUnfinishedLargeFiles(req) {
-    const countError = validateMaxCount(req.maxFileCount, "b2_list_unfinished_large_files");
-    if (countError) return this.error(400, countError.code, countError.message);
-    const prefix = req.namePrefix ?? "";
-    const max = req.maxFileCount ?? 100;
-    const candidates = [...this.largeFiles.values()].filter((f) => f.bucketId === req.bucketId).filter((f) => f.fileName.startsWith(prefix)).sort((a, b) => a.fileName.localeCompare(b.fileName));
-    let startIndex = 0;
-    if (req.startFileId !== void 0) {
-      const found = candidates.findIndex((f) => f.fileId === req.startFileId);
-      startIndex = found >= 0 ? found : 0;
-    }
-    const slice = candidates.slice(startIndex, startIndex + max);
-    const files = slice.map((f) => ({
-      fileId: f.fileId,
-      fileName: f.fileName,
-      accountId: this.accountId,
-      bucketId: f.bucketId,
-      contentType: f.contentType,
-      fileInfo: f.fileInfo
-    }));
-    const hasMore = startIndex + max < candidates.length;
-    const nextFileId = hasMore ? candidates[startIndex + max]?.fileId ?? null : null;
-    return { status: 200, body: { files, nextFileId } };
-  }
-  listParts(req) {
-    const large = this.largeFiles.get(req.fileId);
-    if (!large) return this.error(400, "bad_request", "Large file not found");
-    const countError = validateMaxCount(req.maxPartCount, "b2_list_parts");
-    if (countError) return this.error(400, countError.code, countError.message);
-    const start = req.startPartNumber ?? 1;
-    const max = req.maxPartCount ?? 1e3;
-    const allParts = [...large.parts.entries()].filter(([n]) => n >= start).sort((a, b) => a[0] - b[0]).map(([partNumber, part]) => ({
-      fileId: req.fileId,
-      partNumber,
-      contentLength: part.data.byteLength,
-      contentSha1: part.sha1,
-      uploadTimestamp: Date.now()
-    }));
-    const parts = allParts.slice(0, max);
-    const nextPartNumber = allParts.length > max ? allParts[max]?.partNumber ?? null : null;
-    return { status: 200, body: { parts, nextPartNumber } };
-  }
-  async copyPart(req) {
-    const large = this.largeFiles.get(req.largeFileId);
-    if (!large) return this.error(400, "bad_request", "Large file not found");
-    const found = this.findFile(req.sourceFileId);
-    if (found === null) return this.error(404, "file_not_present", "Source file not found");
-    const sourceStored = found.stored;
-    let partData = sourceStored.data;
-    if (req.range) {
-      const match = req.range.match(/bytes=(\d+)-(\d+)?/);
-      if (match) {
-        const rs = Number.parseInt(match[1] ?? "0", 10);
-        const re = match[2] !== void 0 ? Number.parseInt(match[2], 10) : sourceStored.data.byteLength - 1;
-        partData = sourceStored.data.slice(rs, re + 1);
-      }
-    }
-    const sha1 = await sha1Hex(partData);
-    large.parts.set(req.partNumber, { data: new Uint8Array(partData), sha1 });
-    return {
-      status: 200,
-      body: {
-        fileId: req.largeFileId,
-        partNumber: req.partNumber,
-        contentLength: partData.byteLength,
-        contentSha1: sha1
-      }
-    };
-  }
-  getDownloadAuthorization(req) {
-    if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
-    return {
-      status: 200,
-      body: {
-        bucketId: req.bucketId,
-        fileNamePrefix: req.fileNamePrefix,
-        authorizationToken: `sim_dl_auth_${this.genId("tok")}`
-      }
-    };
-  }
-  // --- Keys ---
-  createKey(req) {
-    const kid = this.genId("sim_key");
-    const appKey = this.genId("sim_secret");
-    const expiration = req.validDurationInSeconds !== void 0 ? Date.now() + req.validDurationInSeconds * 1e3 : null;
-    const stored = {
-      applicationKeyId: kid,
-      keyName: req.keyName,
-      capabilities: req.capabilities,
-      accountId: req.accountId,
-      applicationKey: appKey,
-      bucketId: req.bucketId ?? null,
-      namePrefix: req.namePrefix ?? null,
-      expirationTimestamp: expiration
-    };
-    this.keys.set(kid, stored);
-    return {
-      status: 200,
-      body: {
-        keyName: stored.keyName,
-        applicationKeyId: stored.applicationKeyId,
-        applicationKey: stored.applicationKey,
-        capabilities: stored.capabilities,
-        accountId: stored.accountId,
-        expirationTimestamp: stored.expirationTimestamp,
-        bucketId: stored.bucketId,
-        namePrefix: stored.namePrefix,
-        options: []
-      }
-    };
-  }
-  listKeys(req) {
-    const countError = validateMaxCount(req.maxKeyCount, "b2_list_keys");
-    if (countError) return this.error(400, countError.code, countError.message);
-    const max = req.maxKeyCount ?? 1e3;
-    let allKeys = [...this.keys.values()].sort(
-      (a, b) => a.applicationKeyId.localeCompare(b.applicationKeyId)
-    );
-    if (req.startApplicationKeyId) {
-      const start = req.startApplicationKeyId;
-      allKeys = allKeys.filter((k) => k.applicationKeyId >= start);
-    }
-    const keys = allKeys.slice(0, max).map((k) => ({
-      keyName: k.keyName,
-      applicationKeyId: k.applicationKeyId,
-      capabilities: k.capabilities,
-      accountId: k.accountId,
-      expirationTimestamp: k.expirationTimestamp,
-      bucketId: k.bucketId,
-      namePrefix: k.namePrefix,
-      options: []
-    }));
-    const nextId = allKeys.length > max ? allKeys[max]?.applicationKeyId ?? null : null;
-    return { status: 200, body: { keys, nextApplicationKeyId: nextId } };
-  }
-  deleteKey(req) {
-    const key = this.keys.get(req.applicationKeyId);
-    if (!key) return this.error(400, "bad_request", "Key not found");
-    this.keys.delete(req.applicationKeyId);
-    for (const [token, scope] of this.issuedTokens.entries()) {
-      if (scope.applicationKeyId === req.applicationKeyId) {
-        this.issuedTokens.delete(token);
-      }
-    }
-    return {
-      status: 200,
-      body: {
-        keyName: key.keyName,
-        applicationKeyId: key.applicationKeyId,
-        capabilities: key.capabilities,
-        accountId: key.accountId,
-        expirationTimestamp: key.expirationTimestamp,
-        bucketId: key.bucketId,
-        namePrefix: key.namePrefix,
-        options: []
-      }
-    };
-  }
-  // --- File lock ---
-  updateFileRetention(req) {
-    const found = this.findFile(req.fileId);
-    if (found === null || found.stored.fileVersion.fileName !== req.fileName) {
-      return this.error(404, "file_not_present", "File not found");
-    }
-    found.versions[found.index] = {
-      fileVersion: {
-        ...found.stored.fileVersion,
-        fileRetention: { isClientAuthorizedToRead: true, value: req.fileRetention }
-      },
-      data: found.stored.data
-    };
-    return {
-      status: 200,
-      body: {
-        fileName: req.fileName,
-        fileId: req.fileId,
-        fileRetention: req.fileRetention
-      }
-    };
-  }
-  updateFileLegalHold(req) {
-    const found = this.findFile(req.fileId);
-    if (found === null || found.stored.fileVersion.fileName !== req.fileName) {
-      return this.error(404, "file_not_present", "File not found");
-    }
-    found.versions[found.index] = {
-      fileVersion: {
-        ...found.stored.fileVersion,
-        legalHold: {
-          isClientAuthorizedToRead: true,
-          value: req.legalHold
-        }
-      },
-      data: found.stored.data
-    };
-    return {
-      status: 200,
-      body: {
-        fileName: req.fileName,
-        fileId: req.fileId,
-        legalHold: req.legalHold
-      }
-    };
-  }
-  // --- Notifications ---
-  getBucketNotificationRules(req) {
-    if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
-    const rules = this.notificationRules.get(req.bucketId) ?? [];
-    return { status: 200, body: { bucketId: req.bucketId, eventNotificationRules: rules } };
-  }
-  setBucketNotificationRules(req) {
-    if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
-    this.notificationRules.set(req.bucketId, req.eventNotificationRules);
-    return {
-      status: 200,
-      body: { bucketId: req.bucketId, eventNotificationRules: req.eventNotificationRules }
-    };
-  }
-  // --- Helpers ---
-  /**
-   * Locates a stored file version by its `fileId`, scanning every bucket.
-   *
-   * Returns enough context to support read-only inspection (`stored`,
-   * `bucketId`) AND in-place mutation (`versions`, `index`) so callers
-   * that need to splice the version out can do so without re-scanning.
-   *
-   * Real B2 fileIds embed the bucketId, so production lookups are O(1);
-   * the simulator's flat ID generator (`this.genId('4_z')`) doesn't, so this
-   * is O(buckets × files × versions). Acceptable for tests.
-   *
-   * @param fileId - The file version ID to locate.
-   *
-   * @returns The location of the matching version, or `null` if not found.
-   */
-  findFile(fileId2) {
-    for (const [bid, bucket] of this.buckets.entries()) {
-      for (const versions of bucket.files.values()) {
-        const idx = versions.findIndex((v) => v.fileVersion.fileId === fileId2);
-        if (idx !== -1) {
-          const stored = versions[idx];
-          return { stored, bucketId: bid, bucket, versions, index: idx };
-        }
-      }
-    }
-    return null;
-  }
-  makeFileVersion(params) {
-    return {
-      accountId: accountId(this.accountId),
-      action: params.action,
-      bucketId: bucketId(params.bucketId),
-      contentLength: params.contentLength,
-      contentMd5: null,
-      contentSha1: params.contentSha1,
-      contentType: params.contentType,
-      fileId: fileId(this.genId("4_z")),
-      fileInfo: {},
-      fileName: params.fileName,
-      fileRetention: { isClientAuthorizedToRead: true, value: null },
-      legalHold: { isClientAuthorizedToRead: true, value: null },
-      replicationStatus: null,
-      serverSideEncryption: { mode: EncryptionMode.None },
-      uploadTimestamp: this.monotonicTimestamp()
-    };
-  }
-  error(status, code, message) {
-    return { status, body: { status, code, message } };
-  }
-  /**
-   * Fire the pluggable post-upload hooks for a file that just landed in
-   * a bucket: matching event-notification rules → `onWebhookDeliver`,
-   * configured replication source rules → `onReplicate`. Errors thrown
-   * from user-supplied hooks are swallowed so a buggy listener never
-   * masks an otherwise-successful API response.
-   *
-   * Fired-and-forgotten (no await) by the handler so the synthetic
-   * response is returned to the caller as fast as production B2 would
-   * acknowledge the write.
-   *
-   * @param fileVersion - The freshly-stored file metadata.
-   * @param bucketId - The bucket the upload landed in.
-   * @param eventType - The B2 event-type tag (e.g. `'b2:ObjectCreated:Upload'`)
-   *   used to match against `EventNotificationRule.eventTypes` globs.
-   */
-  firePostUploadHooks(fileVersion, bucketId2, eventType) {
-    const bucket = this.buckets.get(bucketId2);
-    if (!bucket) return;
-    if (this.onWebhookDeliver !== void 0) {
-      const rules = this.notificationRules.get(bucketId2) ?? [];
-      for (const rule of rules) {
-        if (!rule.isEnabled) continue;
-        const matches = rule.eventTypes.some((pattern) => eventTypeMatches(pattern, eventType));
-        if (!matches) continue;
-        const hook = this.onWebhookDeliver;
-        this.dispatchHook("webhook", () => hook({ rule, fileVersion, bucketId: bucketId2 }));
-      }
-    }
-    if (this.onReplicate !== void 0) {
-      const replConfig = bucket.info.replicationConfiguration;
-      const sourceRules = replConfig.asReplicationSource?.replicationRules ?? [];
-      for (const rule of sourceRules) {
-        if (!rule.isEnabled) continue;
-        if (rule.fileNamePrefix && !fileVersion.fileName.startsWith(rule.fileNamePrefix)) continue;
-        const hook = this.onReplicate;
-        this.dispatchHook(
-          "replication",
-          () => hook({
-            sourceFileVersion: fileVersion,
-            sourceBucketId: bucketId2,
-            destinationBucketId: rule.destinationBucketId
-          })
-        );
-      }
-    }
-  }
-  /**
-   * Schedule a user-supplied hook callback. Errors are routed to
-   * `onHookError` if configured, swallowed otherwise. The returned
-   * promise is tracked in {@link pendingHooks} so `flushHooks()` can
-   * wait for every dispatched hook to settle.
-   *
-   * @param kind - Which hook this is (`'webhook'` or `'replication'`).
-   * @param fn - Thunk that performs the hook invocation.
-   */
-  dispatchHook(kind, fn) {
-    const task = Promise.resolve().then(() => fn()).catch((err) => {
-      if (this.onHookError !== void 0) {
-        this.onHookError({ kind, error: toError(err) });
-      }
-    }).finally(() => {
-      this.pendingHooks.delete(task);
-    });
-    this.pendingHooks.add(task);
-  }
+function requestHeaderValue(headers, name) {
+	const exact = headers[name];
+	if (exact !== void 0) return exact;
+	const lowerName = name.toLowerCase();
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === lowerName) return value;
 }
-const eventTypeRegexCache = /* @__PURE__ */ new Map();
+function parseContentLengthHeader(headers) {
+	const header = requestHeaderValue(headers, "content-length");
+	if (header === void 0) return { kind: "absent" };
+	if (!/^\d+$/.test(header)) return {
+		kind: "error",
+		message: `Content-Length must be a byte count: ${header}`
+	};
+	const expectedLength = Number(header);
+	if (!Number.isSafeInteger(expectedLength)) return {
+		kind: "error",
+		message: `Content-Length is too large: ${header}`
+	};
+	return {
+		kind: "ok",
+		expectedLength
+	};
+}
+function contentLengthMismatchMessage(expectedLength, actualLength) {
+	return `Content-Length ${expectedLength} does not match request body length ${actualLength}`;
+}
+function fileNames(...names) {
+	const present = names.filter((name) => name !== void 0);
+	return present.length > 0 ? present : void 0;
+}
+function queryParamsBody(params) {
+	const body = Object.create(null);
+	let hasParams = false;
+	for (const [key, value] of params) {
+		if (body[key] !== void 0) continue;
+		body[key] = value;
+		hasParams = true;
+	}
+	return hasParams ? body : null;
+}
+var JSON_GET_ENDPOINTS = /* @__PURE__ */ new Set([
+	"b2_authorize_account",
+	"b2_list_groups",
+	"b2_list_group_members",
+	"bz_list_computers"
+]);
+var JSON_POST_ENDPOINTS = /* @__PURE__ */ new Set([
+	"b2_create_group_member",
+	"b2_eject_group_member",
+	"b2_reserve_trial_create_account",
+	"bz_delete_computer",
+	"b2_create_bucket",
+	"b2_list_buckets",
+	"b2_delete_bucket",
+	"b2_update_bucket",
+	"b2_get_upload_url",
+	"b2_list_file_names",
+	"b2_list_file_versions",
+	"b2_get_file_info",
+	"b2_hide_file",
+	"b2_delete_file_version",
+	"b2_copy_file",
+	"b2_start_large_file",
+	"b2_get_upload_part_url",
+	"b2_finish_large_file",
+	"b2_cancel_large_file",
+	"b2_list_unfinished_large_files",
+	"b2_list_parts",
+	"b2_copy_part",
+	"b2_get_download_authorization",
+	"b2_create_key",
+	"b2_list_keys",
+	"b2_delete_key",
+	"b2_update_file_retention",
+	"b2_update_file_legal_hold",
+	"b2_get_bucket_notification_rules",
+	"b2_set_bucket_notification_rules"
+]);
+function jsonEndpointAllowsMethod(method, endpoint) {
+	const normalizedMethod = method.toUpperCase();
+	if (JSON_GET_ENDPOINTS.has(endpoint)) return normalizedMethod === "GET";
+	if (JSON_POST_ENDPOINTS.has(endpoint)) return normalizedMethod === "POST";
+	return true;
+}
+function notificationRulePrefixes(body) {
+	if (typeof body !== "object" || body === null) return void 0;
+	const rules = body["eventNotificationRules"];
+	if (!Array.isArray(rules)) return void 0;
+	return rules.map((rule) => {
+		if (typeof rule !== "object" || rule === null) return "";
+		const objectNamePrefix = rule["objectNamePrefix"];
+		return typeof objectNamePrefix === "string" ? objectNamePrefix : "";
+	});
+}
+function storedNotificationRulePrefixes(rules) {
+	return (rules ?? []).map((rule) => typeof rule.objectNamePrefix === "string" ? rule.objectNamePrefix : "");
+}
+function hasKeyManagementCapability(capabilities) {
+	return capabilities.some((capability) => capability === Capability.ListKeys || capability === Capability.WriteKeys || capability === Capability.DeleteKeys);
+}
+function missingStoredKeyCapabilities(key, required) {
+	const capabilities = new Set(key.capabilities);
+	return required.filter((capability) => !capabilities.has(capability));
+}
+function storedKeyAllowsBucket(key, bucketId) {
+	return key.bucketIds === null || key.bucketIds.includes(bucketId);
+}
+function publicServerSideEncryption(encryption) {
+	if (encryption.mode === EncryptionMode.SseC) return {
+		mode: encryption.mode,
+		algorithm: encryption.algorithm
+	};
+	if (encryption.mode === EncryptionMode.None) return {
+		mode: null,
+		algorithm: null
+	};
+	return encryption;
+}
+function customerKeyDigest(customerKey) {
+	let first = 2166136261;
+	let second = 668265261;
+	for (const byte of customerKey) {
+		first = Math.imul(first ^ byte, 16777619) >>> 0;
+		second = Math.imul(second ^ byte, 2246822507) >>> 0;
+	}
+	return `${first.toString(16).padStart(8, "0")}${second.toString(16).padStart(8, "0")}`;
+}
+var BASE64_ALPHABET = /^[A-Za-z0-9+/]+$/;
+function normalizeSizedBase64(value, decodedByteLength) {
+	const paddedLength = Math.ceil(decodedByteLength / 3) * 4;
+	const noPaddingLength = Math.ceil(decodedByteLength * 8 / 6);
+	const padding = "=".repeat(paddedLength - noPaddingLength);
+	if (value.length === noPaddingLength && BASE64_ALPHABET.test(value)) return value.padEnd(paddedLength, "=");
+	if (value.length === paddedLength && value.endsWith(padding) && BASE64_ALPHABET.test(value.slice(0, noPaddingLength))) return value;
+	return null;
+}
+function base64ToBytes(value, decodedByteLength) {
+	const normalized = normalizeSizedBase64(value, decodedByteLength);
+	if (normalized === null) return null;
+	try {
+		const decoded = atob(normalized);
+		if (decoded.length !== decodedByteLength) return null;
+		const bytes = new Uint8Array(decoded.length);
+		for (let i = 0; i < decoded.length; i++) bytes[i] = decoded.charCodeAt(i);
+		return bytes;
+	} catch {
+		return null;
+	}
+}
+function encryptionValidationError(message) {
+	return {
+		status: 400,
+		body: {
+			status: 400,
+			code: "bad_request",
+			message
+		}
+	};
+}
+function sameStoredServerSideEncryption(a, b) {
+	if (a.mode !== b.mode) return false;
+	if (a.mode === EncryptionMode.None) return true;
+	if (a.mode === EncryptionMode.SseB2 && b.mode === EncryptionMode.SseB2) return a.algorithm === b.algorithm;
+	if (a.mode === EncryptionMode.SseC && b.mode === EncryptionMode.SseC) return a.algorithm === b.algorithm && a.customerKeyDigest === b.customerKeyDigest && a.customerKeyMd5 === b.customerKeyMd5;
+	return false;
+}
+function hasCustomerEncryptionFields(encryption) {
+	return encryption["customerKey"] !== void 0 || encryption["customerKeyMd5"] !== void 0 || encryption["customerAlgorithm"] !== void 0;
+}
+function hasCustomerEncryptionHeaders(headers) {
+	return headers["x-bz-server-side-encryption-customer-algorithm"] !== void 0 || headers["x-bz-server-side-encryption-customer-key"] !== void 0 || headers["x-bz-server-side-encryption-customer-key-md5"] !== void 0;
+}
+async function storedServerSideEncryption(encryption) {
+	const runtimeEncryption = encryption;
+	if (encryption.mode === EncryptionMode.SseC) {
+		if (runtimeEncryption["algorithm"] === void 0) return encryptionValidationError("SSE-C customer algorithm is required");
+		if (encryption.algorithm !== EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-C customer algorithm must be AES256");
+		const customerKey = encryption.customerKey;
+		const customerKeyMd5 = encryption.customerKeyMd5;
+		if (typeof customerKey !== "string" || customerKey === "") return encryptionValidationError("SSE-C customer key is required");
+		if (typeof customerKeyMd5 !== "string" || customerKeyMd5 === "") return encryptionValidationError("SSE-C customer key MD5 is required");
+		const customerKeyBytes = base64ToBytes(customerKey, 32);
+		if (customerKeyBytes === null) return encryptionValidationError("SSE-C customer key must be a base64-encoded 256-bit key");
+		const normalizedCustomerKeyMd5 = normalizeSizedBase64(customerKeyMd5, 16);
+		if (normalizedCustomerKeyMd5 === null) return encryptionValidationError("SSE-C customer key MD5 must be a base64-encoded 128-bit digest");
+		if (await md5Base64(customerKeyBytes) !== normalizedCustomerKeyMd5) return encryptionValidationError("SSE-C customer key MD5 does not match the key");
+		return {
+			mode: encryption.mode,
+			algorithm: encryption.algorithm,
+			customerKeyDigest: customerKeyDigest(customerKeyBytes),
+			customerKeyMd5: normalizedCustomerKeyMd5
+		};
+	}
+	if (encryption.mode === EncryptionMode.SseB2) {
+		if (hasCustomerEncryptionFields(runtimeEncryption)) return encryptionValidationError("SSE-B2 settings must not include SSE-C customer keys");
+		if (encryption.algorithm !== EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-B2 algorithm must be AES256");
+		return {
+			mode: encryption.mode,
+			algorithm: encryption.algorithm
+		};
+	}
+	if (encryption.mode === EncryptionMode.None) {
+		if (hasCustomerEncryptionFields(runtimeEncryption)) return encryptionValidationError("No-encryption settings must not include SSE-C customer keys");
+		return { mode: EncryptionMode.None };
+	}
+	return encryptionValidationError(`Unsupported server-side encryption mode: ${String(runtimeEncryption["mode"])}`);
+}
+async function uploadServerSideEncryption(headers, fallback) {
+	const customerAlgorithm = headers["x-bz-server-side-encryption-customer-algorithm"];
+	const customerKey = headers["x-bz-server-side-encryption-customer-key"];
+	const customerKeyMd5 = headers["x-bz-server-side-encryption-customer-key-md5"];
+	const managedEncryption = headers["x-bz-server-side-encryption"];
+	if (hasCustomerEncryptionHeaders(headers)) {
+		if (managedEncryption !== void 0) return encryptionValidationError("SSE-B2 settings must not include SSE-C customer keys");
+		if (customerAlgorithm === void 0) return encryptionValidationError("SSE-C customer algorithm is required");
+		if (customerAlgorithm !== EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-C customer algorithm must be AES256");
+		if (!customerKey || !customerKeyMd5) return encryptionValidationError("SSE-C customer key and MD5 are required");
+		return await storedServerSideEncryption({
+			mode: EncryptionMode.SseC,
+			algorithm: EncryptionAlgorithm.Aes256,
+			customerKey,
+			customerKeyMd5
+		});
+	}
+	if (managedEncryption !== void 0) {
+		if (managedEncryption !== EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-B2 algorithm must be AES256");
+		return {
+			mode: EncryptionMode.SseB2,
+			algorithm: EncryptionAlgorithm.Aes256
+		};
+	}
+	return await storedServerSideEncryption(fallback);
+}
+function defaultFileRetention(policy, uploadTimestamp) {
+	if (policy.mode === BucketRetentionMode.None || policy.period === null) return null;
+	const retainUntilTimestamp = uploadTimestamp + (policy.period.unit === "days" ? policy.period.duration : policy.period.duration * 365) * MS_PER_DAY;
+	if (!isValidRetentionTimestamp(retainUntilTimestamp, uploadTimestamp)) return null;
+	return {
+		mode: policy.mode,
+		retainUntilTimestamp
+	};
+}
+function isRetentionMode(value) {
+	return value === RetentionMode.Compliance || value === RetentionMode.Governance;
+}
+function parseFileRetentionValue(value, now) {
+	if (typeof value !== "object" || value === null) return null;
+	const candidate = value;
+	const mode = candidate["mode"];
+	const retainUntilTimestamp = candidate["retainUntilTimestamp"];
+	if (mode === null && retainUntilTimestamp === null) return {
+		mode,
+		retainUntilTimestamp
+	};
+	if (isRetentionMode(mode) && typeof retainUntilTimestamp === "number") {
+		if (!isValidRetentionTimestamp(retainUntilTimestamp, now)) return null;
+		return {
+			mode,
+			retainUntilTimestamp
+		};
+	}
+	return null;
+}
+function isRetentionWeakened(current, next) {
+	if (current === null || current === void 0) return false;
+	if (current.mode === null) return false;
+	if (next.mode === null) return true;
+	if (current.mode === RetentionMode.Compliance && next.mode !== RetentionMode.Compliance) return true;
+	if (current.retainUntilTimestamp === null) return next.mode !== current.mode;
+	if (next.retainUntilTimestamp === null) return true;
+	return next.retainUntilTimestamp < current.retainUntilTimestamp;
+}
+function requiresGovernanceBypass(current, next) {
+	if (current?.mode !== RetentionMode.Governance) return false;
+	if (next.mode === RetentionMode.Compliance) return true;
+	return isRetentionWeakened(current, next);
+}
+/**
+* In-memory B2 simulator for testing. Implements the B2 native API at the
+* request/response level without any network I/O. Supports 25+ operations
+* including buckets, files, large files, keys, and notifications.
+*
+* @example
+* ```ts
+* const sim = new B2Simulator()
+* const client = new B2Client({
+*   applicationKeyId: 'test-key-id',
+*   applicationKey: 'test-key',
+*   transport: sim.transport(),
+* })
+* await client.authorize()
+* ```
+*
+* `test-key-id:test-key` is the documented implicit full-access
+* storage credential. `master-key-id:master-key` is also accepted for
+* tests that share storage and Partner simulator credentials. In the
+* default permissive mode, other well-formed Basic credentials whose
+* applicationKeyId was not minted by `b2_create_key` receive the same
+* implicit master grant for backward compatibility. A simulator-created
+* key always authorizes with its own capabilities, bucket restrictions,
+* name prefix, and expiration.
+*/
+var B2Simulator = class {
+	buckets = /* @__PURE__ */ new Map();
+	accountId = "sim_account_0001";
+	largeFiles = /* @__PURE__ */ new Map();
+	keys = /* @__PURE__ */ new Map();
+	notificationRules = /* @__PURE__ */ new Map();
+	minimumPartSize;
+	recommendedPartSize;
+	faults = [];
+	nextFaultId = 1;
+	onWebhookDeliver;
+	onReplicate;
+	onHookError;
+	strictAuth;
+	authTokenTtlMs;
+	customUploadTimestampsEnabled;
+	partner;
+	/**
+	* Issued auth tokens with their associated grant scope + expiry. In
+	* permissive mode (`strictAuth: false`) this is still populated by
+	* `authorize` but never consulted on subsequent requests. In strict
+	* mode each request looks up its `Authorization` header here.
+	*/
+	issuedTokens = /* @__PURE__ */ new Map();
+	/**
+	* Mutable upload-token overrides for tokens minted by `b2_get_upload_url`
+	* and `b2_get_upload_part_url`. The token string is self-describing
+	* and signed so another simulator instance can validate issued-token
+	* state, while this map records local invalidation / forced-expiry
+	* state for tests.
+	*/
+	uploadTokens = /* @__PURE__ */ new Map();
+	downloadAuthorizationTokens = /* @__PURE__ */ new Map();
+	downloadAuthorizationExpiryHeap = [];
+	/**
+	* Virtual-clock offset applied to `Date.now()` for expiry checks.
+	* Defaults to 0. Tests advance via {@link advanceTime} to fast-forward
+	* past auth-token expiry without sleeping.
+	*/
+	clockOffsetMs = 0;
+	/**
+	* Per-instance monotonic counter used to mint realistic-looking
+	* IDs (`b2_bucket_<24-hex>`, `4_z<24-hex>`, etc.) and auth tokens.
+	* Module-global previously, which leaked state across `B2Simulator`
+	* instances in the same Vitest worker — concurrent tests could see
+	* colliding tokens. Per-instance ensures determinism within a single
+	* simulator's lifetime.
+	*/
+	nextId = 1;
+	/**
+	* Last-issued upload timestamp. The simulator enforces strict
+	* monotonicity so version ordering is deterministic for tests; if
+	* two writes hit the same `Date.now()` millisecond, the second
+	* receives `lastTimestamp + 1`.
+	*/
+	lastTimestamp = 0;
+	/**
+	* Outstanding fire-and-forget hook invocations. Tracked so tests
+	* (and future {@link flushHooks} callers) can wait for every
+	* dispatched `onWebhookDeliver` / `onReplicate` callback to settle
+	* before asserting against observable side effects. The microtask
+	* dance in fidelity tests was previously brittle: positive cases
+	* flushed twice, negative cases flushed once, and any addition to
+	* the hook dispatch chain quietly broke the negative path.
+	*/
+	pendingHooks = /* @__PURE__ */ new Set();
+	/**
+	* Constructs a new in-memory B2 simulator.
+	* @param options - Optional simulator overrides. See {@link B2SimulatorOptions}.
+	*/
+	constructor(options = {}) {
+		this.minimumPartSize = options.minimumPartSize ?? 5e6;
+		this.recommendedPartSize = options.recommendedPartSize ?? 1e8;
+		if (options.onWebhookDeliver !== void 0) this.onWebhookDeliver = options.onWebhookDeliver;
+		if (options.onReplicate !== void 0) this.onReplicate = options.onReplicate;
+		if (options.onHookError !== void 0) this.onHookError = options.onHookError;
+		this.strictAuth = options.strictAuth ?? false;
+		this.customUploadTimestampsEnabled = options.customUploadTimestampsEnabled ?? false;
+		this.authTokenTtlMs = options.authTokenTtlMs ?? 864e5;
+		this.partner = new PartnerSimulator({
+			accountId: this.accountId,
+			authTokenTtlMs: this.authTokenTtlMs,
+			minimumPartSize: this.minimumPartSize,
+			recommendedPartSize: this.recommendedPartSize,
+			canAuthorize: (authzHeader) => this.canAuthorizePartner(authzHeader),
+			createBucket: (req) => this.createBucket(req),
+			error: (status, code, message) => this.error(status, code, message),
+			genId: (prefix) => this.genId(prefix),
+			monotonicTimestamp: () => this.monotonicTimestamp(),
+			now: () => this.now(),
+			storeKey: (key) => {
+				this.keys.set(key.applicationKeyId, key);
+			}
+		}, options);
+	}
+	/**
+	* Advance the simulator's virtual clock by `ms` milliseconds. Used in
+	* conjunction with `strictAuth: true` + a finite `authTokenTtlMs` to
+	* force token expiry without `setTimeout`-based delays.
+	*
+	* @param ms - Milliseconds to advance. Negative values rewind (rarely useful).
+	*/
+	advanceTime(ms) {
+		this.clockOffsetMs += ms;
+	}
+	/**
+	* Expire an upload authorization token previously returned by
+	* `b2_get_upload_url` or `b2_get_upload_part_url`. Tests can use this
+	* to simulate a stale upload URL and verify retry paths that fetch a
+	* fresh URL/token pair.
+	*
+	* @param authorizationToken - The upload authorization token to expire.
+	*
+	* @returns `true` when the token existed and was expired, otherwise `false`.
+	*/
+	expireUploadToken(authorizationToken) {
+		const now = this.now();
+		const token = this.uploadTokens.get(authorizationToken);
+		if (token === void 0 || now >= token.cleanupAt) return false;
+		token.expiresAt = now - 1;
+		this.uploadTokens.set(authorizationToken, token);
+		return true;
+	}
+	/**
+	* Invalidate an upload authorization token previously returned by
+	* `b2_get_upload_url` or `b2_get_upload_part_url`.
+	*
+	* @param authorizationToken - The upload authorization token to invalidate.
+	*
+	* @returns `true` when the token existed and was invalidated, otherwise `false`.
+	*/
+	invalidateUploadToken(authorizationToken) {
+		const now = this.now();
+		const token = this.uploadTokens.get(authorizationToken);
+		if (token === void 0 || now >= token.cleanupAt) {
+			this.pruneExpiredUploadTokens(now);
+			return false;
+		}
+		token.invalidated = true;
+		this.uploadTokens.set(authorizationToken, token);
+		this.pruneExpiredUploadTokens();
+		return true;
+	}
+	/**
+	* Current simulator time. Equal to `Date.now() + clockOffsetMs`.
+	*
+	* @returns Unix milliseconds.
+	*/
+	now() {
+		return Date.now() + this.clockOffsetMs;
+	}
+	isStoredKeyExpired(key) {
+		return key.expirationTimestamp !== null && key.expirationTimestamp <= this.now();
+	}
+	pruneExpiredUploadTokens(now = this.now()) {
+		for (const [authorizationToken, token] of this.uploadTokens.entries()) if (now >= token.cleanupAt) this.uploadTokens.delete(authorizationToken);
+	}
+	async uploadTokenState(authorizationToken) {
+		const stored = this.uploadTokens.get(authorizationToken);
+		if (stored !== void 0) return stored;
+		return await this.decodeUploadAuthorizationToken(authorizationToken);
+	}
+	async encodeUploadAuthorizationToken(token) {
+		const payload = {
+			v: 1,
+			kind: token.kind,
+			fileName: token.fileName,
+			uploadUrl: token.uploadUrl,
+			namePrefix: token.namePrefix,
+			applicationKeyId: token.applicationKeyId,
+			expiresAt: token.expiresAt
+		};
+		const encoded = base64UrlEncode(utf8Encoder.encode(JSON.stringify(payload)));
+		const signature = await this.signUploadTokenPayload(encoded);
+		return `${token.kind === "file" ? "sim_upload_auth" : "sim_part_auth"}_${encoded}.${signature}`;
+	}
+	async decodeUploadAuthorizationToken(authorizationToken) {
+		const expectedKind = authorizationToken.startsWith("sim_upload_auth_") ? "file" : authorizationToken.startsWith("sim_part_auth_") ? "part" : null;
+		if (expectedKind === null) return null;
+		const tokenParts = authorizationToken.slice(expectedKind === "file" ? 16 : 14).split(".");
+		if (tokenParts.length !== 2) return null;
+		const [payloadBytes, signature] = tokenParts;
+		if (!timingSafeStringEqual(signature, await this.signUploadTokenPayload(payloadBytes))) return null;
+		let parsed;
+		try {
+			const bytes = base64UrlDecode(payloadBytes);
+			if (bytes === null) return null;
+			parsed = JSON.parse(utf8Decoder.decode(bytes));
+		} catch {
+			return null;
+		}
+		if (typeof parsed !== "object" || parsed === null) return null;
+		const payload = parsed;
+		if (payload["v"] !== 1 || payload["kind"] !== expectedKind || typeof payload["uploadUrl"] !== "string" || typeof payload["expiresAt"] !== "number" || !Number.isFinite(payload["expiresAt"]) || !(payload["namePrefix"] === null || typeof payload["namePrefix"] === "string") || !(payload["applicationKeyId"] === null || typeof payload["applicationKeyId"] === "string")) return null;
+		let fileName;
+		if (expectedKind === "part") {
+			if (typeof payload["fileName"] !== "string") return null;
+			fileName = payload["fileName"];
+		} else {
+			if (payload["fileName"] !== null) return null;
+			fileName = null;
+		}
+		return {
+			kind: expectedKind,
+			fileName,
+			uploadUrl: payload["uploadUrl"],
+			namePrefix: payload["namePrefix"],
+			applicationKeyId: payload["applicationKeyId"],
+			expiresAt: payload["expiresAt"],
+			cleanupAt: payload["expiresAt"],
+			invalidated: false
+		};
+	}
+	async signUploadTokenPayload(encodedPayload) {
+		return base64UrlEncode(await hmacSha256(UPLOAD_TOKEN_SIGNING_KEY, encodedPayload));
+	}
+	/**
+	* Generate a deterministic-but-realistic-looking B2 identifier of the
+	* shape `<prefix>_<24-hex-counter>`, which approximates the visual
+	* width of real B2 wire IDs. The counter is monotonic per instance
+	* so test fixtures are deterministic across runs of the same
+	* simulator.
+	*
+	* @param prefix - B2-style prefix (`'b2_bucket'`, `'4_z'`, etc.).
+	*
+	* @returns A simulator-issued identifier that looks like a B2 wire ID.
+	*/
+	genId(prefix) {
+		return `${prefix}_${(this.nextId++).toString(16).padStart(24, "0")}`;
+	}
+	/**
+	* Return a strictly-increasing upload timestamp, even when multiple
+	* writes land in the same `Date.now()` millisecond. Tests rely on
+	* `uploadTimestamp` ordering to discriminate file versions; ties from
+	* coarse system-clock resolution would otherwise make version
+	* selection nondeterministic.
+	*
+	* @returns Unix milliseconds.
+	*/
+	monotonicTimestamp() {
+		const now = Date.now();
+		if (now <= this.lastTimestamp) this.lastTimestamp += 1;
+		else this.lastTimestamp = now;
+		return this.lastTimestamp;
+	}
+	/**
+	* Wait for every fire-and-forget hook (`onWebhookDeliver`,
+	* `onReplicate`) currently in flight to settle. Use in tests after
+	* an upload/copy/finish-large-file call to deterministically observe
+	* hook side effects without microtask-flush guesswork.
+	*
+	* @returns A promise that resolves once every pending hook callback
+	*   has either resolved or rejected.
+	*/
+	async flushHooks() {
+		while (this.pendingHooks.size > 0) {
+			const snapshot = [...this.pendingHooks];
+			await Promise.allSettled(snapshot);
+		}
+	}
+	/**
+	* Authorize a request against the strict-auth bookkeeping. Returns
+	* a `SimulatorJsonResponse` error on failure or `null` on success.
+	* Only consulted when `strictAuth: true`.
+	*
+	* @param authToken - The `Authorization` header value from the request.
+	* @param endpoint - B2 endpoint name being invoked.
+	* @param scope - Optional effective bucket and file-name scope derived from the request.
+	*
+	* @returns `null` when the request is authorized, otherwise a 401/403 response.
+	*/
+	authorizeRequest(authToken, endpoint, scope) {
+		if (missingCapabilitiesFor(endpoint, []).length === 0 && endpoint === "b2_authorize_account") return null;
+		if (authToken === void 0 || authToken === "") return this.error(401, "bad_auth_token", "missing Authorization header");
+		const token = this.issuedTokens.get(authToken);
+		if (!token) return this.error(401, "bad_auth_token", "unknown auth token");
+		if (this.now() > token.expiresAt) return this.error(401, "expired_auth_token", "auth token has expired; reauthorize");
+		if (token.applicationKeyId !== null) {
+			const key = this.keys.get(token.applicationKeyId);
+			if (key === void 0) return this.error(401, "bad_auth_token", "application key has been deleted; reauthorize");
+			if (this.isStoredKeyExpired(key)) return this.error(401, "expired_auth_token", "application key has expired; reauthorize");
+		}
+		const missing = missingCapabilitiesFor(endpoint, token.capabilities);
+		if (missing.length > 0) return this.error(403, "unauthorized", `application key lacks required capabilities: ${missing.join(", ")}`);
+		return this.authorizeScopeGrant(scope, {
+			bucketIds: token.bucketIds,
+			namePrefix: token.namePrefix,
+			bucketScopeRequiredMessage: () => `application key is scoped to buckets ${token.bucketIds?.join(", ")}; bucket scope is required`,
+			bucketMismatchMessage: (bucketId) => `application key is scoped to buckets ${token.bucketIds?.join(", ")}; cannot access ${bucketId}`,
+			prefixMismatchMessage: (fileName) => `application key is scoped to prefix "${token.namePrefix}"; "${fileName}" is outside scope`
+		});
+	}
+	authorizeScopeGrant(scope, grant) {
+		if (grant.bucketIds !== null) {
+			if (scope?.requiresAccountLevelBucketAccess === true) return this.error(403, "unauthorized", grant.bucketScopeRequiredMessage());
+			if ((scope?.bucketIds.length ?? 0) === 0 && scope?.requiresBucketScope === true) return this.error(403, "unauthorized", grant.bucketScopeRequiredMessage());
+			for (const bucketId of scope?.bucketIds ?? []) {
+				if (grant.bucketIds.includes(bucketId)) continue;
+				return this.error(403, "unauthorized", grant.bucketMismatchMessage(bucketId));
+			}
+		}
+		if (grant.namePrefix !== null) for (const fileName of scope?.fileNames ?? []) {
+			if (fileName.startsWith(grant.namePrefix)) continue;
+			return this.error(403, "unauthorized", grant.prefixMismatchMessage(fileName));
+		}
+		return null;
+	}
+	authorizeDownloadRequest(authToken, endpoint, scope, url) {
+		if (authToken === void 0 || authToken === "") return this.error(401, "bad_auth_token", "missing authorization token");
+		const downloadAuth = this.downloadAuthorizationTokens.get(authToken);
+		if (downloadAuth === void 0) {
+			this.purgeExpiredDownloadAuthorizationTokens();
+			return this.authorizeRequest(authToken, endpoint, scope);
+		}
+		if (this.isExpiredDownloadAuthorizationToken(downloadAuth)) {
+			this.downloadAuthorizationTokens.delete(authToken);
+			this.purgeExpiredDownloadAuthorizationTokens();
+			return this.error(401, "expired_auth_token", "download authorization token has expired");
+		}
+		if (endpoint === "b2_download_file_by_id") return this.error(403, "unauthorized", "download authorization tokens cannot be used with b2_download_file_by_id");
+		const overrideError = this.authorizeDownloadResponseOverrides(downloadAuth, url);
+		if (overrideError !== null) return overrideError;
+		return this.authorizeScopeGrant(scope, {
+			bucketIds: [downloadAuth.bucketId],
+			namePrefix: downloadAuth.fileNamePrefix,
+			bucketScopeRequiredMessage: () => `download authorization is scoped to bucket ${downloadAuth.bucketId}; bucket scope is required`,
+			bucketMismatchMessage: (bucketId) => `download authorization is scoped to bucket ${downloadAuth.bucketId}; cannot access ${bucketId}`,
+			prefixMismatchMessage: (fileName) => `download authorization is scoped to prefix "${downloadAuth.fileNamePrefix}"; "${fileName}" is outside scope`
+		});
+	}
+	isExpiredDownloadAuthorizationToken(token, now = this.now()) {
+		return now >= token.expiresAt;
+	}
+	purgeExpiredDownloadAuthorizationTokens() {
+		const now = this.now();
+		for (let i = 0; i < DOWNLOAD_AUTH_PURGE_BATCH_SIZE; i++) {
+			const next = this.downloadAuthorizationExpiryHeap[0];
+			if (next === void 0 || next.expiresAt > now) return;
+			this.popDownloadAuthorizationExpiry();
+			if (this.downloadAuthorizationTokens.get(next.token)?.expiresAt === next.expiresAt) this.downloadAuthorizationTokens.delete(next.token);
+		}
+	}
+	pushDownloadAuthorizationExpiry(entry) {
+		const heap = this.downloadAuthorizationExpiryHeap;
+		heap.push(entry);
+		let idx = heap.length - 1;
+		while (idx > 0) {
+			const parentIdx = Math.floor((idx - 1) / 2);
+			const parent = heap[parentIdx];
+			if (parent.expiresAt <= entry.expiresAt) break;
+			heap[idx] = parent;
+			idx = parentIdx;
+		}
+		heap[idx] = entry;
+	}
+	popDownloadAuthorizationExpiry() {
+		const heap = this.downloadAuthorizationExpiryHeap;
+		const root = heap[0];
+		const last = heap.pop();
+		if (root === void 0 || last === void 0 || heap.length === 0) return root;
+		let idx = 0;
+		while (true) {
+			const leftIdx = idx * 2 + 1;
+			const rightIdx = leftIdx + 1;
+			const left = heap[leftIdx];
+			const right = heap[rightIdx];
+			if (left === void 0) break;
+			const childIdx = right !== void 0 && right.expiresAt < left.expiresAt ? rightIdx : leftIdx;
+			const child = heap[childIdx];
+			if (child.expiresAt >= last.expiresAt) break;
+			heap[idx] = child;
+			idx = childIdx;
+		}
+		heap[idx] = last;
+		return root;
+	}
+	authorizeDownloadResponseOverrides(downloadAuth, url) {
+		for (const param of DOWNLOAD_RESPONSE_OVERRIDE_PARAMS) {
+			const expected = downloadAuth.responseHeaderOverrides[param];
+			if (expected === void 0) continue;
+			const actual = url.searchParams.get(param);
+			if (actual === expected) continue;
+			const expectedText = JSON.stringify(expected);
+			const actualText = actual === null ? "absent" : JSON.stringify(actual);
+			return this.error(403, "unauthorized", `download authorization requires ${param}=${expectedText}; got ${actualText}`);
+		}
+		return null;
+	}
+	downloadAuthorizationFromRequest(headers, url, options = {}) {
+		const headerToken = requestHeaderValue(headers, "authorization");
+		if (headerToken !== void 0) return headerToken;
+		if (options.allowQueryAuthorization !== true) return void 0;
+		const queryToken = url.searchParams.get("Authorization") ?? url.searchParams.get("authorization");
+		return queryToken?.startsWith(DOWNLOAD_AUTH_TOKEN_PREFIX) ? queryToken : void 0;
+	}
+	requestHasCapability(authToken, capability) {
+		if (!this.strictAuth) return true;
+		if (authToken === void 0) return false;
+		return this.issuedTokens.get(authToken)?.capabilities.includes(capability) === true;
+	}
+	requireFileLockEnabled(bucket) {
+		if (bucket.info.fileLockConfiguration.value?.isFileLockEnabled === true) return null;
+		return this.error(400, "file_lock_not_enabled", "Bucket does not have file lock enabled");
+	}
+	requireGovernanceBypass(req, authToken, message) {
+		if (req.bypassGovernance !== true) return this.error(400, "file_lock_governance_protected", message);
+		if (!this.requestHasCapability(authToken, Capability.BypassGovernance)) return this.error(403, "unauthorized", `application key lacks required capabilities: ${Capability.BypassGovernance}`);
+		return null;
+	}
+	validateReplicationApplicationKey(applicationKeyId, requiredCapabilities, options) {
+		const key = this.keys.get(applicationKeyId);
+		if (key === void 0) return this.invalidReplicationApplicationKey(options.role);
+		if (missingStoredKeyCapabilities(key, requiredCapabilities).length > 0) return this.invalidReplicationApplicationKey(options.role);
+		if (options.bucketId !== void 0 && !storedKeyAllowsBucket(key, options.bucketId)) return this.invalidReplicationApplicationKey(options.role);
+		return null;
+	}
+	invalidReplicationApplicationKey(role) {
+		return this.error(400, "bad_request", `${role} application key is invalid or not authorized for this replication configuration`);
+	}
+	invalidReplicationDestinationBucket() {
+		return this.error(400, "bad_request", "replication destination bucket is invalid or not configured for this source application key");
+	}
+	validateReplicationDestinationBuckets(sourceApplicationKeyId, rules) {
+		for (const rule of rules) {
+			const destinationBucketId = requestRecord(rule)?.["destinationBucketId"];
+			if (typeof destinationBucketId !== "string") continue;
+			const destinationApplicationKeyId = this.buckets.get(destinationBucketId)?.info.replicationConfiguration.asReplicationDestination?.sourceToDestinationKeyMapping[sourceApplicationKeyId];
+			if (destinationApplicationKeyId === void 0) return this.invalidReplicationDestinationBucket();
+			const destinationKeyError = this.validateReplicationApplicationKey(destinationApplicationKeyId, [Capability.WriteFiles], {
+				bucketId: destinationBucketId,
+				role: "replication destination"
+			});
+			if (destinationKeyError !== null) return destinationKeyError;
+		}
+		return null;
+	}
+	validateReplicationApplicationKeys(config, bucketId) {
+		if (!this.strictAuth || config === void 0) return null;
+		const replicationConfiguration = requestRecord(config);
+		const source = requestRecord(replicationConfiguration?.["asReplicationSource"]);
+		if (source !== null) {
+			const sourceApplicationKeyId = source["sourceApplicationKeyId"];
+			if (typeof sourceApplicationKeyId === "string") {
+				const sourceKeyError = this.validateReplicationApplicationKey(sourceApplicationKeyId, [Capability.ReadFiles, Capability.ListFiles], {
+					bucketId,
+					role: "replication source"
+				});
+				if (sourceKeyError !== null) return sourceKeyError;
+			}
+			const rules = source["replicationRules"];
+			if (typeof sourceApplicationKeyId === "string" && Array.isArray(rules)) {
+				const destinationError = this.validateReplicationDestinationBuckets(sourceApplicationKeyId, rules);
+				if (destinationError !== null) return destinationError;
+			}
+		}
+		const mapping = requestRecord(requestRecord(replicationConfiguration?.["asReplicationDestination"])?.["sourceToDestinationKeyMapping"]);
+		if (mapping !== null) for (const [sourceApplicationKeyId, destinationApplicationKeyId] of Object.entries(mapping)) {
+			const sourceKeyError = this.validateReplicationApplicationKey(sourceApplicationKeyId, [Capability.ReadFiles, Capability.ListFiles], { role: "replication source" });
+			if (sourceKeyError !== null) return sourceKeyError;
+			if (typeof destinationApplicationKeyId === "string") {
+				const destinationKeyError = this.validateReplicationApplicationKey(destinationApplicationKeyId, [Capability.WriteFiles], {
+					bucketId,
+					role: "replication destination"
+				});
+				if (destinationKeyError !== null) return destinationKeyError;
+			}
+		}
+		return null;
+	}
+	requestScope(endpoint, body) {
+		const directBucketId = requestStringField(body, "bucketId");
+		const directFileName = requestStringField(body, "fileName");
+		switch (endpoint) {
+			case "b2_create_bucket": return this.createBucketScope(body);
+			case "b2_list_buckets": return this.listBucketsScope(body, directBucketId);
+			case "b2_list_file_names":
+			case "b2_list_file_versions": return {
+				bucketIds: directBucketId === void 0 ? [] : [directBucketId],
+				fileNames: [requestStringField(body, "prefix") ?? ""],
+				requiresBucketScope: true
+			};
+			case "b2_get_file_info": return this.fileIdScope(requestStringField(body, "fileId")) ?? {
+				bucketIds: [],
+				requiresBucketScope: true
+			};
+			case "b2_delete_file_version":
+			case "b2_update_file_retention":
+			case "b2_update_file_legal_hold": return this.fileVersionScope(body, directFileName);
+			case "b2_get_upload_part_url":
+			case "b2_finish_large_file":
+			case "b2_cancel_large_file":
+			case "b2_list_parts": return this.largeFileScope(requestStringField(body, "fileId")) ?? {
+				bucketIds: [],
+				requiresBucketScope: true
+			};
+			case "b2_copy_file": return this.copyFileScope(body, directFileName);
+			case "b2_copy_part": return this.copyPartScope(body);
+			case "b2_list_unfinished_large_files": return {
+				bucketIds: directBucketId === void 0 ? [] : [directBucketId],
+				fileNames: [requestStringField(body, "namePrefix") ?? ""],
+				requiresBucketScope: true
+			};
+			case "b2_get_download_authorization": return {
+				bucketIds: directBucketId === void 0 ? [] : [directBucketId],
+				fileNames: [requestStringField(body, "fileNamePrefix") ?? ""],
+				requiresBucketScope: true
+			};
+			case "b2_get_bucket_notification_rules": return this.notificationRulesScope(body, directBucketId, false);
+			case "b2_set_bucket_notification_rules": return this.notificationRulesScope(body, directBucketId, true);
+			case "b2_update_bucket": return this.updateBucketScope(body, directBucketId);
+			default: return this.defaultRequestScope(directBucketId, directFileName);
+		}
+	}
+	createBucketScope(body) {
+		return {
+			bucketIds: replicationDestinationBucketIds(body),
+			requiresBucketScope: true,
+			requiresAccountLevelBucketAccess: true
+		};
+	}
+	updateBucketScope(body, directBucketId) {
+		return {
+			bucketIds: [...directBucketId === void 0 ? [] : [directBucketId], ...replicationDestinationBucketIds(body)],
+			requiresBucketScope: true
+		};
+	}
+	listBucketsScope(body, directBucketId) {
+		if (directBucketId !== void 0) return {
+			bucketIds: [directBucketId],
+			requiresBucketScope: true
+		};
+		const bucketName = requestStringField(body, "bucketName");
+		if (bucketName !== void 0) {
+			const bucket = [...this.buckets.values()].find((b) => b.info.bucketName === bucketName);
+			return {
+				bucketIds: bucket === void 0 ? [] : [bucket.info.bucketId],
+				requiresBucketScope: true
+			};
+		}
+		return {
+			bucketIds: [],
+			requiresBucketScope: true
+		};
+	}
+	fileVersionScope(body, directFileName) {
+		const fileScope = this.fileIdScope(requestStringField(body, "fileId"));
+		if (fileScope !== void 0) return fileScope;
+		return {
+			bucketIds: [],
+			...directFileName !== void 0 ? { fileNames: [directFileName] } : {},
+			requiresBucketScope: true
+		};
+	}
+	copyFileScope(body, directFileName) {
+		const sourceScope = this.fileIdScope(requestStringField(body, "sourceFileId"));
+		const destinationBucketId = requestStringField(body, "destinationBucketId");
+		const bucketIds = [...sourceScope?.bucketIds ?? [], ...destinationBucketId !== void 0 ? [destinationBucketId] : []];
+		const scopedFileNames = fileNames(...sourceScope?.fileNames ?? [], directFileName);
+		return {
+			bucketIds,
+			...scopedFileNames !== void 0 ? { fileNames: scopedFileNames } : {},
+			requiresBucketScope: true
+		};
+	}
+	copyPartScope(body) {
+		const sourceScope = this.fileIdScope(requestStringField(body, "sourceFileId"));
+		const largeScope = this.largeFileScope(requestStringField(body, "largeFileId"));
+		const scopedFileNames = fileNames(...sourceScope?.fileNames ?? [], ...largeScope?.fileNames ?? []);
+		return {
+			bucketIds: [...sourceScope?.bucketIds ?? [], ...largeScope?.bucketIds ?? []],
+			...scopedFileNames !== void 0 ? { fileNames: scopedFileNames } : {},
+			requiresBucketScope: true
+		};
+	}
+	notificationRulesScope(body, directBucketId, includeRequestRules) {
+		const existingPrefixes = directBucketId === void 0 ? [] : storedNotificationRulePrefixes(this.notificationRules.get(directBucketId));
+		const requestPrefixes = includeRequestRules ? notificationRulePrefixes(body) ?? [] : [];
+		const prefixes = [...existingPrefixes, ...requestPrefixes];
+		return {
+			bucketIds: directBucketId === void 0 ? [] : [directBucketId],
+			...prefixes.length > 0 ? { fileNames: prefixes } : {},
+			requiresBucketScope: true
+		};
+	}
+	defaultRequestScope(directBucketId, directFileName) {
+		if (directBucketId !== void 0) return {
+			bucketIds: [directBucketId],
+			...directFileName !== void 0 ? { fileNames: [directFileName] } : {},
+			requiresBucketScope: true
+		};
+		return directFileName !== void 0 ? {
+			bucketIds: [],
+			fileNames: [directFileName],
+			requiresBucketScope: false
+		} : void 0;
+	}
+	fileIdScope(fileId) {
+		if (fileId === void 0) return void 0;
+		const found = this.findFile(fileId);
+		if (found === null) return void 0;
+		return {
+			bucketIds: [found.bucketId],
+			fileNames: [found.stored.fileVersion.fileName],
+			requiresBucketScope: true
+		};
+	}
+	largeFileScope(fileId) {
+		if (fileId === void 0) return void 0;
+		const large = this.largeFiles.get(fileId);
+		if (large === void 0) return void 0;
+		return {
+			bucketIds: [large.bucketId],
+			fileNames: [large.fileName],
+			requiresBucketScope: true
+		};
+	}
+	async issueUploadAuthorization(options) {
+		const now = this.now();
+		this.pruneExpiredUploadTokens(now);
+		const endpoint = options.kind === "file" ? "b2_upload_file" : "b2_upload_part";
+		const idParam = options.kind === "file" ? "bucketId" : "fileId";
+		const scopedId = options.kind === "file" ? options.bucketId : options.fileId;
+		const uploadId = this.genId(options.kind === "file" ? "upload_file" : "upload_part");
+		const uploadUrl = new URL(b2Url("http://localhost:0", {
+			version: "v3",
+			endpoint
+		}));
+		uploadUrl.searchParams.set(idParam, scopedId);
+		uploadUrl.searchParams.set("uploadId", uploadId);
+		const sourceToken = options.sourceAuthToken === void 0 ? void 0 : this.issuedTokens.get(options.sourceAuthToken);
+		const token = {
+			kind: options.kind,
+			fileName: options.kind === "part" ? options.fileName : null,
+			uploadUrl: uploadUrl.toString(),
+			namePrefix: this.strictAuth ? sourceToken?.namePrefix ?? null : null,
+			applicationKeyId: sourceToken?.applicationKeyId ?? null,
+			expiresAt: now + this.authTokenTtlMs,
+			cleanupAt: now + this.authTokenTtlMs,
+			invalidated: false
+		};
+		const authorizationToken = await this.encodeUploadAuthorizationToken(token);
+		this.uploadTokens.set(authorizationToken, token);
+		return {
+			uploadUrl: uploadUrl.toString(),
+			authorizationToken
+		};
+	}
+	async validateUploadAuthorization(kind, uploadUrl, authToken, fileName) {
+		if (authToken === void 0 || authToken === "") return this.error(401, "bad_auth_token", "missing upload Authorization header");
+		const token = await this.uploadTokenState(authToken);
+		if (token === null) {
+			this.pruneExpiredUploadTokens();
+			return this.error(401, "bad_auth_token", "unknown upload authorization token");
+		}
+		const now = this.now();
+		if (now >= token.expiresAt) {
+			if (now >= token.cleanupAt) this.uploadTokens.delete(authToken);
+			else this.uploadTokens.set(authToken, token);
+			this.pruneExpiredUploadTokens(now);
+			return this.error(401, "expired_auth_token", "upload authorization token has expired; get a new upload URL");
+		}
+		if (token.invalidated) {
+			this.uploadTokens.set(authToken, token);
+			this.pruneExpiredUploadTokens(now);
+			return this.error(401, "bad_auth_token", "upload authorization token has been invalidated");
+		}
+		if (token.kind !== kind) {
+			this.pruneExpiredUploadTokens(now);
+			return this.error(401, "bad_auth_token", "upload authorization token type mismatch");
+		}
+		this.pruneExpiredUploadTokens(now);
+		if (!this.uploadUrlMatches(token, uploadUrl)) return this.error(401, "bad_auth_token", "upload authorization token is not valid for this upload URL");
+		const scopedName = kind === "file" ? fileName : token.fileName ?? void 0;
+		if (token.namePrefix !== null && scopedName !== void 0) {
+			if (!scopedName.startsWith(token.namePrefix)) return this.error(403, "unauthorized", `application key is scoped to prefix "${token.namePrefix}"; "${scopedName}" is outside scope`);
+		}
+		return null;
+	}
+	uploadUrlMatches(token, uploadUrl) {
+		let expected;
+		let actual;
+		try {
+			expected = new URL(token.uploadUrl);
+			actual = new URL(uploadUrl);
+		} catch {
+			return false;
+		}
+		if (actual.origin !== expected.origin || actual.pathname !== expected.pathname) return false;
+		const scopeParam = token.kind === "file" ? "bucketId" : "fileId";
+		return actual.searchParams.get(scopeParam) === expected.searchParams.get(scopeParam) && actual.searchParams.get("uploadId") === expected.searchParams.get("uploadId");
+	}
+	allowedBuckets(bucketIds) {
+		if (bucketIds === void 0 || bucketIds === null) return null;
+		return bucketIds.map((id) => ({
+			id: bucketId(id),
+			name: this.buckets.get(id)?.info.bucketName ?? null
+		}));
+	}
+	/**
+	* Resolve the application key matching the `Authorization` header on
+	* an `authorize_account` request. The header is in the form
+	* `Basic base64(applicationKeyId:applicationKey)`.
+	*
+	* The simulator has two implicit full-access storage credentials:
+	* the documented `test-key-id:test-key` pair used by SDK tests and
+	* `master-key-id:master-key`. In default permissive mode, any other
+	* well-formed Basic credential whose applicationKeyId is not a stored
+	* key also receives that implicit master grant for backward
+	* compatibility. A credential whose applicationKeyId matches a stored
+	* key must use the stored secret and must not be expired.
+	*
+	* @param authzHeader - Raw HTTP `Authorization` header value.
+	*
+	* @returns The authorizing key's grant scope or the rejection reason.
+	*/
+	findAuthorizationGrant(authzHeader) {
+		const credentials = parseBasicAuthorizationHeader(authzHeader);
+		if (credentials === null) return { kind: "invalid" };
+		const stored = this.keys.get(credentials.applicationKeyId);
+		if (stored !== void 0) {
+			if (!timingSafeStringEqual(stored.applicationKey, credentials.applicationKey)) return { kind: "invalid" };
+			if (this.isStoredKeyExpired(stored)) return { kind: "expired" };
+			return {
+				kind: "ok",
+				grant: {
+					capabilities: stored.capabilities,
+					bucketIds: stored.bucketIds,
+					namePrefix: stored.namePrefix,
+					applicationKeyId: credentials.applicationKeyId,
+					accountId: stored.accountId,
+					expirationTimestamp: stored.expirationTimestamp
+				}
+			};
+		}
+		if (isSimulatorApplicationKeyId(credentials.applicationKeyId)) return { kind: "invalid" };
+		if (isImplicitStorageMasterCredential(credentials) || !this.strictAuth) return {
+			kind: "ok",
+			grant: {
+				capabilities: SIMULATOR_MASTER_CAPABILITIES,
+				bucketIds: null,
+				namePrefix: null,
+				applicationKeyId: null,
+				accountId: this.accountId,
+				expirationTimestamp: null
+			}
+		};
+		return { kind: "invalid" };
+	}
+	canAuthorizePartner(authzHeader) {
+		const credentials = parseBasicAuthorizationHeader(authzHeader);
+		if (credentials === null) return false;
+		if (isImplicitPartnerMasterCredential(credentials)) return true;
+		const stored = this.keys.get(credentials.applicationKeyId);
+		return stored !== void 0 && stored.accountId === this.accountId && !this.isStoredKeyExpired(stored) && timingSafeStringEqual(stored.applicationKey, credentials.applicationKey);
+	}
+	/**
+	* Creates an {@link HttpTransport} that routes requests to this simulator.
+	* @returns A transport instance backed by this in-memory simulator.
+	*/
+	transport() {
+		return new SimulatorTransport(this);
+	}
+	/**
+	* Register a synthetic failure to inject on requests whose URL contains
+	* `spec.on`. Use this to exercise retry / backoff / error-handling
+	* paths in tests without hand-rolling a wrapping `HttpTransport`. The
+	* fault is consumed in registration order on each matched request;
+	* once its `count` budget is exhausted it auto-retires.
+	*
+	* Faults are checked BEFORE the simulator's real handlers run, so a
+	* matched request never touches in-memory state — failed uploads
+	* don't create partial parts, failed deletes don't remove anything.
+	*
+	* @param spec - The failure to inject. See {@link FaultSpec}.
+	*
+	* @returns A handle whose `clear()` method removes this specific
+	*   fault registration (other faults remain in effect).
+	*
+	* @example
+	* ```ts
+	* // Fail the next 2 b2_upload_part calls with 503, then succeed.
+	* sim.injectFailure({ on: 'b2_upload_part', status: 503, count: 2 })
+	*
+	* // Fail every b2_authorize_account with 401 + Retry-After: 5.
+	* const handle = sim.injectFailure({
+	*   on: 'b2_authorize_account',
+	*   status: 401,
+	*   code: 'expired_auth_token',
+	*   retryAfter: 5,
+	* })
+	* // ... later
+	* handle.clear()
+	* ```
+	*/
+	injectFailure(spec) {
+		const id = this.nextFaultId++;
+		const fault = {
+			id,
+			spec,
+			remainingSkip: spec.skip ?? 0,
+			remainingCount: spec.count ?? Number.POSITIVE_INFINITY
+		};
+		this.faults.push(fault);
+		return { clear: () => {
+			const idx = this.faults.findIndex((f) => f.id === id);
+			if (idx !== -1) this.faults.splice(idx, 1);
+		} };
+	}
+	/**
+	* Remove every registered fault. Equivalent to calling `.clear()` on
+	* every handle returned by {@link injectFailure}, plus a defensive
+	* reset for tests that re-use a simulator across cases.
+	*/
+	clearFaults() {
+		this.faults.length = 0;
+	}
+	/**
+	* Internal: checks the registered faults for a match on the given URL
+	* and consumes one if it should fire. Called from
+	* {@link SimulatorTransport.send} before any real handler runs.
+	*
+	* @param url - The request URL to match against each fault's `on`
+	*   substring.
+	*
+	* @returns The fault to apply, or `null` if no fault should fire.
+	*
+	* @internal
+	*/
+	consumeMatchingFault(url) {
+		for (let i = 0; i < this.faults.length; i++) {
+			const fault = this.faults[i];
+			if (!url.includes(fault.spec.on)) continue;
+			if (fault.remainingSkip > 0) {
+				fault.remainingSkip -= 1;
+				continue;
+			}
+			if (fault.remainingCount <= 0) continue;
+			fault.remainingCount -= 1;
+			if (fault.remainingCount <= 0) this.faults.splice(i, 1);
+			return fault.spec;
+		}
+		return null;
+	}
+	/**
+	* Dispatches a JSON API request to the appropriate handler.
+	* @param method - The HTTP method.
+	* @param origin - The request URL origin used for simulator-issued endpoints.
+	* @param path - The request URL path containing the B2 endpoint name.
+	* @param headers - The HTTP request headers; consulted by the
+	*   strict-auth gate to look up the issued auth token.
+	* @param body - The parsed JSON request body.
+	*
+	* @returns An object with HTTP status and JSON response body.
+	*/
+	async handleRequest(method, origin, path, headers, body) {
+		const { endpoint, version } = apiPathParts(path);
+		if (!jsonEndpointAllowsMethod(method, endpoint)) return this.error(405, "method_not_allowed", `${endpoint} does not support ${method.toUpperCase()}`);
+		if (this.strictAuth && !this.partner.isEndpoint(endpoint)) {
+			const authError = this.authorizeRequest(headers["authorization"], endpoint, this.requestScope(endpoint, body));
+			if (authError !== null) return authError;
+		}
+		switch (endpoint) {
+			case "b2_authorize_account":
+				if (version === "v3" && this.partner.isAuthorizeEnabled()) return this.partner.authorize(headers["authorization"], origin);
+				return this.authorize(headers["authorization"], origin);
+			case "b2_create_group_member": return this.partner.createGroupMember(body, headers["authorization"]);
+			case "b2_eject_group_member": return this.partner.ejectGroupMember(body, headers["authorization"]);
+			case "b2_list_groups": return this.partner.listGroups(body, headers["authorization"]);
+			case "b2_list_group_members": return this.partner.listGroupMembers(body, headers["authorization"]);
+			case "b2_reserve_trial_create_account": return this.partner.reserveTrialCreateAccount(body, headers["authorization"]);
+			case "bz_list_computers": return this.partner.listComputers(body, headers["authorization"]);
+			case "bz_delete_computer": return this.partner.deleteComputer(body, headers["authorization"]);
+			case "b2_create_bucket": return this.createBucket(body);
+			case "b2_list_buckets": return this.listBuckets(body);
+			case "b2_delete_bucket": return this.deleteBucket(body);
+			case "b2_update_bucket": return this.updateBucket(body);
+			case "b2_get_upload_url": return await this.getUploadUrl(body, headers["authorization"]);
+			case "b2_list_file_names": return this.listFileNames(body);
+			case "b2_list_file_versions": return this.listFileVersions(body);
+			case "b2_get_file_info": return this.getFileInfo(body);
+			case "b2_hide_file": return this.hideFile(body);
+			case "b2_delete_file_version": return this.deleteFileVersion(body, headers["authorization"]);
+			case "b2_copy_file": return await this.copyFile(body);
+			case "b2_start_large_file": return await this.startLargeFile(body);
+			case "b2_get_upload_part_url": return await this.getUploadPartUrl(body, headers["authorization"]);
+			case "b2_finish_large_file": return this.finishLargeFile(body);
+			case "b2_cancel_large_file": return this.cancelLargeFile(body);
+			case "b2_list_unfinished_large_files": return this.listUnfinishedLargeFiles(body);
+			case "b2_list_parts": return this.listParts(body);
+			case "b2_copy_part": return await this.copyPart(body);
+			case "b2_get_download_authorization": return this.getDownloadAuthorization(body);
+			case "b2_create_key": return this.createKey(body, version, headers["authorization"]);
+			case "b2_list_keys": return this.listKeys(body);
+			case "b2_delete_key": return this.deleteKey(body);
+			case "b2_update_file_retention": return this.updateFileRetention(body, headers["authorization"]);
+			case "b2_update_file_legal_hold": return this.updateFileLegalHold(body);
+			case "b2_get_bucket_notification_rules": return this.getBucketNotificationRules(body);
+			case "b2_set_bucket_notification_rules": return this.setBucketNotificationRules(body);
+			default: return {
+				status: 400,
+				body: {
+					status: 400,
+					code: "bad_request",
+					message: `Unknown endpoint: ${endpoint}`
+				}
+			};
+		}
+	}
+	/**
+	* Handles file and part upload requests (`b2_upload_file`, `b2_upload_part`).
+	* Dispatches to the appropriate internal handler based on the URL.
+	* @param url - The upload endpoint URL used to determine the upload type.
+	* @param headers - The HTTP headers containing file metadata and authorization.
+	* @param data - The raw file or part content as bytes.
+	*
+	* @returns A promise resolving to an object with HTTP status and JSON response body.
+	*/
+	async handleUpload(url, headers, data) {
+		const endpoint = new URL(url).pathname.split("/").pop() ?? "";
+		const kind = endpoint === "b2_upload_file" ? "file" : endpoint === "b2_upload_part" ? "part" : null;
+		if (kind === null) return this.error(400, "bad_request", `Unknown upload endpoint: ${endpoint}`);
+		const fileName = kind === "part" || headers["x-bz-file-name"] === void 0 ? void 0 : decodeHeaderValue(headers["x-bz-file-name"]);
+		const authError = await this.validateUploadAuthorization(kind, url, headers["authorization"], fileName);
+		if (authError !== null) return authError;
+		const contentLengthError = this.validateContentLength(headers, data.byteLength);
+		if (contentLengthError !== null) return contentLengthError;
+		if (kind === "part") return await this.handleUploadPart(url, headers, data);
+		return await this.handleUploadFile(url, headers, data);
+	}
+	validateContentLength(headers, actualLength) {
+		const parsed = parseContentLengthHeader(headers);
+		if (parsed.kind === "absent") return null;
+		if (parsed.kind === "error") return this.error(400, "bad_request", parsed.message);
+		if (parsed.expectedLength !== actualLength) return this.error(400, "bad_request", contentLengthMismatchMessage(parsed.expectedLength, actualLength));
+		return null;
+	}
+	parseCustomUploadTimestamp(value) {
+		if (value === void 0 || value === null) return { timestamp: null };
+		if (!this.customUploadTimestampsEnabled) return this.error(400, "custom_timestamp_not_allowed", "Custom upload timestamps are not enabled for this account.");
+		const timestamp = typeof value === "string" && /^\d+$/.test(value) ? Number(value) : NaN;
+		if (!Number.isSafeInteger(timestamp) || timestamp < 0 || timestamp > this.now()) return this.error(400, "custom_timestamp_invalid", "The request has an invalid custom upload timestamp.");
+		return { timestamp };
+	}
+	/**
+	* Handles file download requests (`b2_download_file_by_id`, `/file/` by name).
+	* Returns the file data along with B2 response headers.
+	* @param path - The request URL path identifying the file to download.
+	* @param headers - The HTTP request headers for range or authorization.
+	* @param method - The HTTP method; `'HEAD'` suppresses the response body.
+	*
+	* @returns The download response containing file data and B2 headers.
+	*/
+	handleDownload(path, headers, method = "GET") {
+		if (path.includes("b2_download_file_by_id")) {
+			const url = new URL(`http://localhost${path}`);
+			if (this.strictAuth) {
+				const authError = this.authorizeDownloadRequest(this.downloadAuthorizationFromRequest(headers, url, { allowQueryAuthorization: false }), "b2_download_file_by_id", this.fileIdScope(url.searchParams.get("fileId") ?? void 0) ?? {
+					bucketIds: [],
+					requiresBucketScope: true
+				}, url);
+				if (authError !== null) return this.errorAsDownload(authError);
+			}
+			const fileId = url.searchParams.get("fileId") ?? "";
+			return this.finalizeDownload(this.downloadById(fileId, headers, requestHeaderValue(headers, "range")), url, method);
+		}
+		const fileMatch = path.match(/^([^?]+)/)?.[1]?.match(/\/file\/([^/]+)\/(.+)/);
+		if (fileMatch) {
+			const bucketName = decodeURIComponent(fileMatch[1] ?? "");
+			const fileName = decodeURIComponent(fileMatch[2] ?? "");
+			const url = new URL(`http://localhost${path}`);
+			if (this.strictAuth) {
+				const bucket = [...this.buckets.values()].find((b) => b.info.bucketName === bucketName);
+				const authError = this.authorizeDownloadRequest(this.downloadAuthorizationFromRequest(headers, url, { allowQueryAuthorization: true }), "b2_download_file_by_name", {
+					bucketIds: bucket === void 0 ? [] : [bucket.info.bucketId],
+					fileNames: [fileName],
+					requiresBucketScope: true
+				}, url);
+				if (authError !== null) return this.errorAsDownload(authError);
+			}
+			return this.finalizeDownload(this.downloadByName(bucketName, fileName, headers, requestHeaderValue(headers, "range")), url, method);
+		}
+		return {
+			status: 404,
+			headers: {},
+			data: null
+		};
+	}
+	/**
+	* Convert a synthetic JSON error body into a `SimulatorDownloadResponse`
+	* shape so the strict-auth gate on download paths can surface 401/403s
+	* through the same transport plumbing as a regular failed download.
+	*
+	* @param json - The JSON error from {@link authorizeRequest}.
+	*
+	* @returns A download-shaped response with the error body bytes inline.
+	*/
+	errorAsDownload(json) {
+		return {
+			status: json.status,
+			headers: { "Content-Type": "application/json" },
+			data: utf8Encoder.encode(JSON.stringify(json.body))
+		};
+	}
+	/**
+	* Applies HEAD-method body suppression and `b2Content*` response-header
+	* overrides parsed from the download URL's query string. Mirrors what the
+	* real B2 service does: any `b2Content*` query parameter is echoed back as
+	* the corresponding response header.
+	*
+	* @param response - The download response produced by {@link downloadById} or {@link downloadByName}.
+	* @param url - The parsed download URL (used to read `b2Content*` query params).
+	* @param method - The HTTP method of the originating request.
+	*
+	* @returns The response with overrides applied.
+	*/
+	finalizeDownload(response, url, method) {
+		const newHeaders = { ...response.headers };
+		for (const [param, header] of Object.entries(DOWNLOAD_RESPONSE_OVERRIDE_HEADERS)) {
+			const value = url.searchParams.get(param);
+			if (value !== null) newHeaders[header] = value;
+		}
+		const data = method === "HEAD" ? null : response.data;
+		return {
+			status: response.status,
+			headers: newHeaders,
+			data
+		};
+	}
+	async handleUploadFile(url, headers, data) {
+		const bucketId = new URL(url).searchParams.get("bucketId");
+		if (!bucketId) return this.error(400, "bad_request", "Missing bucketId");
+		const bucket = this.buckets.get(bucketId);
+		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const fileName = decodeHeaderValue(headers["x-bz-file-name"] ?? "");
+		const contentType = headers["content-type"] ?? "application/octet-stream";
+		const fileNameError = validateFileName(fileName);
+		if (fileNameError) return this.error(400, fileNameError.code, fileNameError.message);
+		const fileInfo = parseFileInfoHeaders(headers);
+		const fileInfoError = validateFileInfo(fileInfo);
+		if (fileInfoError) return this.error(400, fileInfoError.code, fileInfoError.message);
+		const resolved = await this.resolveUploadSha1(headers["x-bz-content-sha1"], data);
+		if ("status" in resolved) return resolved;
+		const { sha1: contentSha1, data: storedData } = resolved;
+		const serverSideEncryption = await uploadServerSideEncryption(headers, bucket.info.defaultServerSideEncryption);
+		if ("status" in serverSideEncryption) return serverSideEncryption;
+		const customUploadTimestamp = this.parseCustomUploadTimestamp(requestHeaderValue(headers, "x-bz-custom-upload-timestamp"));
+		if ("status" in customUploadTimestamp) return customUploadTimestamp;
+		const fileVersion = this.makeFileVersion({
+			bucketId,
+			fileName,
+			contentType,
+			contentLength: storedData.byteLength,
+			contentSha1,
+			fileInfo,
+			action: FileAction.Upload,
+			serverSideEncryption,
+			...this.newReplicationStatusField(bucketId, fileName),
+			...customUploadTimestamp.timestamp !== null ? { uploadTimestamp: customUploadTimestamp.timestamp } : {}
+		});
+		const stored = {
+			fileVersion,
+			data: storedData,
+			serverSideEncryption
+		};
+		const existing = bucket.files.get(fileName);
+		if (existing) existing.push(stored);
+		else bucket.files.set(fileName, [stored]);
+		this.firePostUploadHooks(fileVersion, bucketId, "b2:ObjectCreated:Upload");
+		return {
+			status: 200,
+			body: fileVersion
+		};
+	}
+	/**
+	* Resolve the `X-Bz-Content-Sha1` header into the SHA-1 to store, verifying
+	* it against the uploaded bytes where B2 would. Returns the SHA-1 string to
+	* persist, or a `400 bad_request` response when a verifiable hash does not
+	* match the data received.
+	*
+	* @param header - The raw `X-Bz-Content-Sha1` header value, if any.
+	* @param data - The uploaded bytes.
+	*
+	* @returns The SHA-1 string to store, or an error response on mismatch.
+	*/
+	async resolveUploadSha1(header, data) {
+		const value = header ?? "none";
+		if (value === "none" || value === "do_not_verify") return {
+			sha1: "none",
+			data
+		};
+		if (value.startsWith("unverified:")) return {
+			sha1: value.slice(11).toLowerCase(),
+			data
+		};
+		if (value === "hex_digits_at_end") {
+			if (data.byteLength < 40) return this.error(400, "bad_request", "Sha1 did not match data received");
+			const body = data.subarray(0, data.byteLength - 40);
+			const trailer = utf8Decoder.decode(data.subarray(data.byteLength - 40)).toLowerCase();
+			const actual = await sha1Hex(body);
+			if (actual !== trailer) return this.error(400, "bad_request", "Sha1 did not match data received");
+			return {
+				sha1: actual,
+				data: body
+			};
+		}
+		const expected = value.toLowerCase();
+		if (await sha1Hex(data) !== expected) return this.error(400, "bad_request", "Sha1 did not match data received");
+		return {
+			sha1: expected,
+			data
+		};
+	}
+	async validateUploadPartEncryption(large, headers) {
+		if (large.serverSideEncryption.mode !== EncryptionMode.SseC) {
+			if (!hasCustomerEncryptionHeaders(headers)) return null;
+			return this.error(400, "bad_request", "SSE-C upload part headers require an SSE-C large file");
+		}
+		const supplied = await storedServerSideEncryption({
+			mode: EncryptionMode.SseC,
+			algorithm: headers["x-bz-server-side-encryption-customer-algorithm"],
+			customerKey: headers["x-bz-server-side-encryption-customer-key"],
+			customerKeyMd5: headers["x-bz-server-side-encryption-customer-key-md5"]
+		});
+		if ("status" in supplied) return supplied;
+		if (!sameStoredServerSideEncryption(large.serverSideEncryption, supplied)) return this.error(400, "bad_request", "SSE-C upload parts require matching customer encryption headers");
+		return null;
+	}
+	async handleUploadPart(url, headers, data) {
+		const fileId = new URL(url).searchParams.get("fileId");
+		if (!fileId) return this.error(400, "bad_request", "Missing fileId");
+		const large = this.largeFiles.get(fileId);
+		if (!large) return this.error(400, "bad_request", "Large file not found");
+		const partNumber = this.parsePartNumberHeader(requestHeaderValue(headers, "x-bz-part-number"));
+		if (typeof partNumber !== "number") return partNumber;
+		const encryptionError = await this.validateUploadPartEncryption(large, headers);
+		if (encryptionError !== null) return encryptionError;
+		const resolved = await this.resolveUploadSha1(headers["x-bz-content-sha1"], data);
+		if ("status" in resolved) return resolved;
+		const { sha1, data: partData } = resolved;
+		const uploadTimestamp = this.monotonicTimestamp();
+		large.parts.set(partNumber, {
+			data: partData,
+			sha1,
+			contentMd5: null,
+			uploadTimestamp
+		});
+		return {
+			status: 200,
+			body: {
+				fileId: large.fileId,
+				partNumber,
+				contentLength: partData.byteLength,
+				contentSha1: sha1,
+				contentMd5: null,
+				serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
+				uploadTimestamp
+			}
+		};
+	}
+	parsePartNumberHeader(header) {
+		if (header === void 0) return this.error(400, "bad_request", "X-Bz-Part-Number header is required");
+		if (!/^\d+$/.test(header)) return this.error(400, "bad_request", `X-Bz-Part-Number must be an integer between ${B2_MIN_PART_NUMBER} and ${B2_MAX_PART_NUMBER}; received ${header}`);
+		const partNumber = Number(header);
+		return this.validatePartNumber(partNumber) ?? partNumber;
+	}
+	validatePartNumber(partNumber) {
+		if (Number.isInteger(partNumber) && partNumber >= B2_MIN_PART_NUMBER && partNumber <= B2_MAX_PART_NUMBER) return null;
+		return this.error(400, "bad_request", `partNumber must be an integer between ${B2_MIN_PART_NUMBER} and ${B2_MAX_PART_NUMBER}; received ${String(partNumber)}`);
+	}
+	downloadById(fileId, headers, range) {
+		const found = this.findFile(fileId);
+		if (found === null) return {
+			status: 404,
+			headers: {},
+			data: null
+		};
+		return this.serveFile(found.stored, headers, range);
+	}
+	downloadByName(bucketName, fileName, headers, range) {
+		for (const bucket of this.buckets.values()) {
+			if (bucket.info.bucketName !== bucketName) continue;
+			const versions = bucket.files.get(fileName);
+			if (!versions || versions.length === 0) break;
+			const latest = versions[versions.length - 1];
+			if (!latest || latest.fileVersion.action === FileAction.Hide) return {
+				status: 404,
+				headers: {},
+				data: null
+			};
+			return this.serveFile(latest, headers, range);
+		}
+		return {
+			status: 404,
+			headers: {},
+			data: null
+		};
+	}
+	validateDownloadEncryption(stored, headers) {
+		const encryption = stored.serverSideEncryption;
+		if (encryption.mode !== EncryptionMode.SseC) return null;
+		const algorithm = headers["x-bz-server-side-encryption-customer-algorithm"];
+		const customerKey = headers["x-bz-server-side-encryption-customer-key"];
+		const customerKeyMd5 = headers["x-bz-server-side-encryption-customer-key-md5"];
+		const customerKeyBytes = customerKey === void 0 ? null : base64ToBytes(customerKey, 32);
+		const normalizedCustomerKeyMd5 = customerKeyMd5 === void 0 ? null : normalizeSizedBase64(customerKeyMd5, 16);
+		if (algorithm !== encryption.algorithm || customerKeyBytes === null || normalizedCustomerKeyMd5 === null || md5Base64Sync(customerKeyBytes) !== normalizedCustomerKeyMd5) return this.errorAsDownload(this.error(400, "bad_request", "SSE-C downloads require matching customer encryption headers"));
+		if (normalizedCustomerKeyMd5 !== encryption.customerKeyMd5 || customerKeyDigest(customerKeyBytes) !== encryption.customerKeyDigest) return this.errorAsDownload(this.error(403, "access_denied", "SSE-C customer encryption key does not match the stored file"));
+		return null;
+	}
+	async validateSourceServerSideEncryption(stored, encryption) {
+		const expected = stored.serverSideEncryption;
+		if (expected.mode !== EncryptionMode.SseC) return null;
+		if (encryption?.mode !== EncryptionMode.SseC) return this.error(400, "bad_request", "SSE-C source copies require customer encryption");
+		const supplied = await storedServerSideEncryption(encryption);
+		if ("status" in supplied) return supplied;
+		if (!sameStoredServerSideEncryption(expected, supplied)) return this.error(400, "bad_request", "SSE-C source customer encryption does not match");
+		return null;
+	}
+	async resolveCopyDestinationEncryption(destinationBucket, requested) {
+		if (requested !== void 0) return await storedServerSideEncryption(requested);
+		return await storedServerSideEncryption(destinationBucket.info.defaultServerSideEncryption);
+	}
+	async validateCopyPartDestinationEncryption(large, encryption) {
+		if (encryption === void 0) return large.serverSideEncryption.mode === EncryptionMode.SseC ? this.error(400, "bad_request", "SSE-C destination copies require customer encryption") : null;
+		const supplied = await storedServerSideEncryption(encryption);
+		if ("status" in supplied) return supplied;
+		if (!sameStoredServerSideEncryption(large.serverSideEncryption, supplied)) return this.error(400, "bad_request", "Destination server-side encryption does not match");
+		return null;
+	}
+	serveFile(stored, requestHeaders, range) {
+		const encryptionError = this.validateDownloadEncryption(stored, requestHeaders);
+		if (encryptionError !== null) return encryptionError;
+		const fullData = stored.data;
+		let data = fullData;
+		let status = 200;
+		let contentRange = null;
+		if (range) {
+			const parsed = parseRangeHeader(range, fullData.byteLength);
+			if (parsed.kind === "ok") {
+				data = fullData.subarray(parsed.start, parsed.end + 1);
+				status = 206;
+				contentRange = `bytes ${parsed.start}-${parsed.end}/${fullData.byteLength}`;
+			} else if (parsed.kind === "unsatisfiable") return {
+				status: 416,
+				headers: {
+					"Content-Type": stored.fileVersion.contentType,
+					"Content-Range": `bytes */${fullData.byteLength}`
+				},
+				data: /* @__PURE__ */ new Uint8Array(0)
+			};
+		}
+		const fv = stored.fileVersion;
+		const headers = {
+			"Content-Type": fv.contentType,
+			"Content-Length": String(data.byteLength),
+			"X-Bz-File-Id": fv.fileId,
+			"X-Bz-File-Name": encodeFileName(fv.fileName),
+			"X-Bz-Content-Sha1": fv.contentSha1 ?? "none",
+			"X-Bz-Upload-Timestamp": String(fv.uploadTimestamp)
+		};
+		for (const [key, value] of Object.entries(fv.fileInfo)) headers[`X-Bz-Info-${encodeFileName(key)}`] = encodeFileName(value);
+		if (!("src_last_modified_millis" in fv.fileInfo)) headers["X-Bz-Info-src_last_modified_millis"] = String(fv.uploadTimestamp);
+		const unauthorizedToRead = [];
+		this.addDownloadEncryptionHeaders(headers, stored.serverSideEncryption, requestHeaders, unauthorizedToRead);
+		this.addDownloadObjectLockHeaders(headers, fv, requestHeaders, unauthorizedToRead);
+		if (unauthorizedToRead.length > 0) headers[DownloadHeaderName.ClientUnauthorizedToRead] = unauthorizedToRead.join(",");
+		if (contentRange !== null) headers["Content-Range"] = contentRange;
+		return {
+			status,
+			headers,
+			data
+		};
+	}
+	addDownloadEncryptionHeaders(headers, encryption, requestHeaders, unauthorizedToRead) {
+		if (encryption.mode === EncryptionMode.None) return;
+		if (!this.requestHasCapability(requestHeaderValue(requestHeaders, "authorization"), Capability.ReadBucketEncryption)) {
+			if (encryption.mode === EncryptionMode.SseB2) unauthorizedToRead.push(DownloadClientUnauthorizedToReadMarker.ServerSideEncryption);
+			else unauthorizedToRead.push(DownloadClientUnauthorizedToReadMarker.ServerSideEncryptionCustomerAlgorithm, DownloadClientUnauthorizedToReadMarker.ServerSideEncryptionCustomerKeyMd5);
+			return;
+		}
+		if (encryption.mode === EncryptionMode.SseB2) {
+			headers[DownloadHeaderName.ServerSideEncryption] = encryption.algorithm;
+			return;
+		}
+		headers[DownloadHeaderName.ServerSideEncryptionCustomerAlgorithm] = encryption.algorithm;
+		headers[DownloadHeaderName.ServerSideEncryptionCustomerKeyMd5] = encryption.customerKeyMd5;
+	}
+	addDownloadObjectLockHeaders(headers, fileVersion, requestHeaders, unauthorizedToRead) {
+		const authToken = requestHeaderValue(requestHeaders, "authorization");
+		const retention = fileVersion.fileRetention.value;
+		if (retention !== null && retention.mode !== null && retention.retainUntilTimestamp !== null) {
+			if (this.requestHasCapability(authToken, Capability.ReadFileRetentions)) {
+				headers[DownloadHeaderName.FileRetentionMode] = retention.mode;
+				headers[DownloadHeaderName.FileRetentionRetainUntilTimestamp] = String(retention.retainUntilTimestamp);
+			} else unauthorizedToRead.push(DownloadClientUnauthorizedToReadMarker.FileRetentionMode, DownloadClientUnauthorizedToReadMarker.FileRetentionRetainUntilTimestamp);
+		}
+		const legalHold = fileVersion.legalHold.value;
+		if (legalHold === null) return;
+		if (this.requestHasCapability(authToken, Capability.ReadFileLegalHolds)) {
+			headers[DownloadHeaderName.FileLegalHold] = legalHold;
+			return;
+		}
+		unauthorizedToRead.push(DownloadClientUnauthorizedToReadMarker.FileLegalHold);
+	}
+	authorize(authzHeader, origin = "http://localhost:0") {
+		const resolution = this.findAuthorizationGrant(authzHeader);
+		if (resolution.kind === "invalid") return this.error(401, "unauthorized", "application key is not valid");
+		if (resolution.kind === "expired") return this.error(401, "unauthorized", "application key is expired");
+		const { grant } = resolution;
+		const allowedBuckets = this.allowedBuckets(grant.bucketIds);
+		const legacyBucketId = singleBucketId(grant.bucketIds);
+		const legacyBucketName = legacyBucketId === null ? null : this.buckets.get(legacyBucketId)?.info.bucketName ?? null;
+		const tokenStr = `sim_auth_token_${this.nextId++}`;
+		this.issuedTokens.set(tokenStr, {
+			accountId: grant.accountId,
+			capabilities: grant.capabilities,
+			bucketIds: grant.bucketIds,
+			namePrefix: grant.namePrefix,
+			expiresAt: this.now() + this.authTokenTtlMs,
+			applicationKeyId: grant.applicationKeyId
+		});
+		return {
+			status: 200,
+			body: {
+				accountId: accountId(grant.accountId),
+				authorizationToken: tokenStr,
+				apiInfo: { storageApi: {
+					absoluteMinimumPartSize: this.minimumPartSize,
+					apiUrl: origin,
+					bucketId: legacyBucketId === null ? null : bucketId(legacyBucketId),
+					bucketName: legacyBucketName,
+					downloadUrl: origin,
+					infoType: "storageApi",
+					namePrefix: grant.namePrefix,
+					recommendedPartSize: this.recommendedPartSize,
+					s3ApiUrl: origin,
+					allowed: {
+						capabilities: cloneCapabilities(grant.capabilities),
+						buckets: allowedBuckets,
+						bucketId: legacyBucketId === null ? null : bucketId(legacyBucketId),
+						bucketName: legacyBucketName,
+						namePrefix: grant.namePrefix
+					}
+				} },
+				applicationKeyExpirationTimestamp: grant.expirationTimestamp
+			}
+		};
+	}
+	createBucket(req) {
+		const nameError = validateBucketName(req.bucketName);
+		if (nameError) return this.error(400, nameError.code, nameError.message);
+		const objectLockEnabled = nextObjectLockEnabled(false, req.fileLockEnabled);
+		if (typeof objectLockEnabled !== "boolean") return this.error(400, objectLockEnabled.code, objectLockEnabled.message);
+		const configError = validateBucketConfigurationFields(req, { objectLockEnabled });
+		if (configError) return this.error(400, configError.code, configError.message);
+		const replicationKeyError = this.validateReplicationApplicationKeys(req.replicationConfiguration, void 0);
+		if (replicationKeyError !== null) return replicationKeyError;
+		for (const b of this.buckets.values()) if (b.info.bucketName === req.bucketName) return this.error(400, "duplicate_bucket_name", "Bucket name already in use");
+		const bid = bucketId(this.genId("b2_bucket"));
+		const defaultRetention = req.defaultRetention ?? {
+			mode: BucketRetentionMode.None,
+			period: null
+		};
+		const info = {
+			accountId: accountId(req.accountId),
+			bucketId: bid,
+			bucketName: req.bucketName,
+			bucketType: req.bucketType,
+			bucketInfo: req.bucketInfo ?? {},
+			corsRules: req.corsRules ?? [],
+			defaultServerSideEncryption: req.defaultServerSideEncryption ?? { mode: EncryptionMode.None },
+			fileLockConfiguration: {
+				isClientAuthorizedToRead: true,
+				value: {
+					isFileLockEnabled: objectLockEnabled,
+					defaultRetention
+				}
+			},
+			lifecycleRules: req.lifecycleRules ?? [],
+			options: [],
+			revision: 1,
+			defaultRetention,
+			replicationConfiguration: req.replicationConfiguration === void 0 ? {
+				asReplicationSource: null,
+				asReplicationDestination: null
+			} : normalizeReplicationConfiguration(req.replicationConfiguration)
+		};
+		this.buckets.set(bid, {
+			info,
+			files: /* @__PURE__ */ new Map()
+		});
+		return {
+			status: 200,
+			body: info
+		};
+	}
+	listBuckets(req) {
+		const bucketTypesError = validateBucketTypes(req.bucketTypes);
+		if (bucketTypesError) return this.error(400, bucketTypesError.code, bucketTypesError.message);
+		return {
+			status: 200,
+			body: { buckets: [...this.buckets.values()].map((b) => b.info).filter((bucket) => req.bucketId === void 0 || bucket.bucketId === req.bucketId).filter((bucket) => req.bucketName === void 0 || bucket.bucketName === req.bucketName).filter((bucket) => req.bucketTypes === void 0 || req.bucketTypes.includes(bucket.bucketType)) }
+		};
+	}
+	deleteBucket(req) {
+		const bucket = this.buckets.get(req.bucketId);
+		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		if (this.bucketHasContents(bucket)) return this.error(400, "cannot_delete_non_empty_bucket", "Bucket is not empty and cannot be deleted");
+		this.buckets.delete(req.bucketId);
+		return {
+			status: 200,
+			body: bucket.info
+		};
+	}
+	bucketHasContents(bucket) {
+		for (const versions of bucket.files.values()) if (versions.length > 0) return true;
+		for (const large of this.largeFiles.values()) if (large.bucketId === bucket.info.bucketId) return true;
+		return false;
+	}
+	updateBucket(req) {
+		const bucket = this.buckets.get(req["bucketId"]);
+		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const revisionGuard = req["ifRevisionIs"];
+		if (revisionGuard !== void 0) {
+			if (typeof revisionGuard !== "number" || !Number.isInteger(revisionGuard)) return this.error(400, "bad_request", "ifRevisionIs must be an integer");
+			if (revisionGuard !== bucket.info.revision) return this.error(409, "conflict", "ifRevisionIs test failed");
+		}
+		const objectLockEnabled = nextObjectLockEnabled(bucket.info.fileLockConfiguration.value?.isFileLockEnabled ?? false, req["fileLockEnabled"]);
+		if (typeof objectLockEnabled !== "boolean") return this.error(400, objectLockEnabled.code, objectLockEnabled.message);
+		const configError = validateBucketConfigurationFields({
+			bucketInfo: req["bucketInfo"],
+			corsRules: req["corsRules"],
+			defaultRetention: req["defaultRetention"],
+			lifecycleRules: req["lifecycleRules"],
+			replicationConfiguration: req["replicationConfiguration"]
+		}, { objectLockEnabled });
+		if (configError) return this.error(400, configError.code, configError.message);
+		const replicationKeyError = this.validateReplicationApplicationKeys(req["replicationConfiguration"], req["bucketId"]);
+		if (replicationKeyError !== null) return replicationKeyError;
+		const updated = {
+			...bucket.info,
+			...req["bucketType"] !== void 0 ? { bucketType: req["bucketType"] } : {},
+			...req["bucketInfo"] !== void 0 ? { bucketInfo: req["bucketInfo"] } : {},
+			...req["lifecycleRules"] !== void 0 ? { lifecycleRules: req["lifecycleRules"] } : {},
+			...req["corsRules"] !== void 0 ? { corsRules: req["corsRules"] } : {},
+			...req["replicationConfiguration"] !== void 0 ? { replicationConfiguration: normalizeReplicationConfiguration(req["replicationConfiguration"]) } : {},
+			...req["defaultRetention"] !== void 0 ? {
+				defaultRetention: req["defaultRetention"],
+				fileLockConfiguration: {
+					isClientAuthorizedToRead: true,
+					value: {
+						isFileLockEnabled: objectLockEnabled,
+						defaultRetention: req["defaultRetention"]
+					}
+				}
+			} : {},
+			...req["fileLockEnabled"] !== void 0 && req["defaultRetention"] === void 0 ? { fileLockConfiguration: {
+				isClientAuthorizedToRead: true,
+				value: {
+					isFileLockEnabled: objectLockEnabled,
+					defaultRetention: bucket.info.defaultRetention
+				}
+			} } : {},
+			...req["defaultServerSideEncryption"] !== void 0 ? { defaultServerSideEncryption: req["defaultServerSideEncryption"] } : {},
+			revision: bucket.info.revision + 1
+		};
+		this.buckets.set(req["bucketId"], {
+			info: updated,
+			files: bucket.files
+		});
+		return {
+			status: 200,
+			body: updated
+		};
+	}
+	async getUploadUrl(req, authToken) {
+		if (!this.buckets.get(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const uploadAuth = await this.issueUploadAuthorization({
+			kind: "file",
+			sourceAuthToken: authToken,
+			bucketId: req.bucketId
+		});
+		return {
+			status: 200,
+			body: {
+				bucketId: req.bucketId,
+				uploadUrl: uploadAuth.uploadUrl,
+				authorizationToken: uploadAuth.authorizationToken
+			}
+		};
+	}
+	listFileNames(req) {
+		const bucket = this.buckets.get(req.bucketId);
+		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const countError = validateMaxCount(req.maxFileCount, "b2_list_file_names");
+		if (countError) return this.error(400, countError.code, countError.message);
+		const max = req.maxFileCount ?? 1e3;
+		const prefix = req.prefix ?? "";
+		let allFiles = [...bucket.files.entries()].filter(([name]) => name.startsWith(prefix)).map(([_, versions]) => versions[versions.length - 1]).filter((v) => v !== void 0).map((v) => v.fileVersion).sort((a, b) => compareB2FileNames(a.fileName, b.fileName));
+		if (req.startFileName) {
+			const start = req.startFileName;
+			allFiles = allFiles.filter((f) => f.fileName >= start);
+		}
+		return {
+			status: 200,
+			body: {
+				files: allFiles.slice(0, max),
+				nextFileName: allFiles.length > max ? allFiles[max]?.fileName ?? null : null
+			}
+		};
+	}
+	listFileVersions(req) {
+		const bucket = this.buckets.get(req.bucketId);
+		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const countError = validateMaxCount(req.maxFileCount, "b2_list_file_versions");
+		if (countError) return this.error(400, countError.code, countError.message);
+		const max = req.maxFileCount ?? 1e3;
+		const prefix = req.prefix ?? "";
+		const allVersions = [...bucket.files.entries()].filter(([name]) => name.startsWith(prefix)).flatMap(([_, versions]) => versions.map((v) => v.fileVersion)).sort((a, b) => {
+			const nameCmp = compareB2FileNames(a.fileName, b.fileName);
+			if (nameCmp !== 0) return nameCmp;
+			return b.uploadTimestamp - a.uploadTimestamp;
+		});
+		let startIdx = 0;
+		if (req.startFileName !== void 0) {
+			const startName = req.startFileName;
+			const startId = req.startFileId;
+			const nameIdx = allVersions.findIndex((f) => f.fileName >= startName);
+			if (nameIdx === -1) startIdx = allVersions.length;
+			else if (startId !== void 0) {
+				const exactIdx = allVersions.findIndex((f, i) => i >= nameIdx && f.fileId === startId);
+				startIdx = exactIdx !== -1 ? exactIdx : nameIdx;
+			} else startIdx = nameIdx;
+		}
+		const sliced = allVersions.slice(startIdx, startIdx + max);
+		const hasMore = startIdx + max < allVersions.length;
+		return {
+			status: 200,
+			body: {
+				files: sliced,
+				nextFileName: hasMore ? allVersions[startIdx + max]?.fileName ?? null : null,
+				nextFileId: hasMore ? allVersions[startIdx + max]?.fileId ?? null : null
+			}
+		};
+	}
+	getFileInfo(req) {
+		const found = this.findFile(req.fileId);
+		if (found === null) return this.error(404, "file_not_present", "File not found");
+		return {
+			status: 200,
+			body: found.stored.fileVersion
+		};
+	}
+	hideFile(req) {
+		const bucket = this.buckets.get(req.bucketId);
+		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const nameError = validateFileName(req.fileName);
+		if (nameError) return this.error(400, nameError.code, nameError.message);
+		const fileVersion = this.makeFileVersion({
+			bucketId: req.bucketId,
+			fileName: req.fileName,
+			contentType: "application/octet-stream",
+			contentLength: 0,
+			contentSha1: "none",
+			action: FileAction.Hide
+		});
+		const existing = bucket.files.get(req.fileName);
+		const stored = {
+			fileVersion,
+			data: /* @__PURE__ */ new Uint8Array(0),
+			serverSideEncryption: { mode: EncryptionMode.None }
+		};
+		if (existing) existing.push(stored);
+		else bucket.files.set(req.fileName, [stored]);
+		return {
+			status: 200,
+			body: fileVersion
+		};
+	}
+	deleteFileVersion(req, authToken) {
+		const found = this.findFile(req.fileId);
+		if (found === null || found.stored.fileVersion.fileName !== req.fileName) return this.error(400, "file_not_present", "File version not found");
+		const fv = found.stored.fileVersion;
+		const retention = fv.fileRetention?.value;
+		const legalHold = fv.legalHold?.value;
+		const now = Date.now();
+		if (legalHold === LegalHoldValue.On) return this.error(400, "file_lock_legal_hold_protected", "File is on legal hold and cannot be deleted");
+		if (retention?.mode === RetentionMode.Compliance && retention.retainUntilTimestamp !== null && retention.retainUntilTimestamp > now) return this.error(400, "file_lock_compliance_protected", `File is under compliance-mode retention and cannot be deleted until ${new Date(retention.retainUntilTimestamp).toISOString()}`);
+		if (retention?.mode === RetentionMode.Governance && retention.retainUntilTimestamp !== null && retention.retainUntilTimestamp > now) {
+			const bypassError = this.requireGovernanceBypass(req, authToken, "File is under governance-mode retention; pass bypassGovernance: true to delete");
+			if (bypassError !== null) return bypassError;
+		}
+		found.versions.splice(found.index, 1);
+		if (found.versions.length === 0) found.bucket.files.delete(req.fileName);
+		return {
+			status: 200,
+			body: {
+				fileId: req.fileId,
+				fileName: req.fileName
+			}
+		};
+	}
+	async copyFile(req) {
+		const nameError = validateFileName(req.fileName);
+		if (nameError) return this.error(400, nameError.code, nameError.message);
+		const found = this.findFile(req.sourceFileId);
+		if (found === null) return this.error(404, "file_not_present", "Source file not found");
+		const sourceStored = found.stored;
+		const destBucketId = req.destinationBucketId ?? found.bucketId;
+		const destBucket = this.buckets.get(destBucketId);
+		if (!destBucket) return this.error(400, "bad_bucket_id", "Destination bucket not found");
+		const sourceEncryptionError = await this.validateSourceServerSideEncryption(sourceStored, req.sourceServerSideEncryption);
+		if (sourceEncryptionError !== null) return sourceEncryptionError;
+		const destinationEncryption = await this.resolveCopyDestinationEncryption(destBucket, req.destinationServerSideEncryption);
+		if ("status" in destinationEncryption) return destinationEncryption;
+		let data = sourceStored.data;
+		let contentSha1 = sourceStored.fileVersion.contentSha1 ?? "none";
+		if (req.range !== void 0) {
+			const parsed = parseRangeHeader(req.range, sourceStored.data.byteLength);
+			if (parsed.kind === "malformed") return this.error(400, "bad_request", `Malformed copy range: ${req.range}`);
+			if (parsed.kind === "unsatisfiable") return this.error(416, "range_not_satisfiable", `Unsatisfiable copy range: ${req.range}`);
+			data = sourceStored.data.subarray(parsed.start, parsed.end + 1);
+			contentSha1 = await sha1Hex(data);
+		}
+		const directive = req.metadataDirective;
+		if (directive !== void 0 && directive !== "COPY" && directive !== "REPLACE") return this.error(400, "bad_request", `Invalid metadataDirective: ${directive}`);
+		let contentType;
+		let fileInfo;
+		if (directive === "REPLACE") {
+			if (req.contentType === void 0) return this.error(400, "bad_request", "contentType is required when metadataDirective is REPLACE");
+			const replaceFileInfo = req.fileInfo ?? {};
+			const fileInfoError = validateFileInfo(replaceFileInfo);
+			if (fileInfoError) return this.error(400, fileInfoError.code, fileInfoError.message);
+			contentType = req.contentType;
+			fileInfo = replaceFileInfo;
+		} else {
+			if (req.contentType !== void 0 || req.fileInfo !== void 0) return this.error(400, "bad_request", "contentType and fileInfo may only be set when metadataDirective is REPLACE");
+			contentType = sourceStored.fileVersion.contentType;
+			fileInfo = sourceStored.fileVersion.fileInfo;
+		}
+		const fileVersion = this.makeFileVersion({
+			bucketId: destBucketId,
+			fileName: req.fileName,
+			contentType,
+			contentLength: data.byteLength,
+			contentSha1,
+			fileInfo,
+			action: FileAction.Copy,
+			serverSideEncryption: destinationEncryption,
+			...this.newReplicationStatusField(destBucketId, req.fileName)
+		});
+		const copied = {
+			fileVersion,
+			data: new Uint8Array(data),
+			serverSideEncryption: destinationEncryption
+		};
+		const existing = destBucket.files.get(req.fileName);
+		if (existing) existing.push(copied);
+		else destBucket.files.set(req.fileName, [copied]);
+		this.firePostUploadHooks(fileVersion, destBucketId, "b2:ObjectCreated:Copy");
+		return {
+			status: 200,
+			body: fileVersion
+		};
+	}
+	async startLargeFile(req) {
+		const bucket = this.buckets.get(req.bucketId);
+		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const nameError = validateFileName(req.fileName);
+		if (nameError) return this.error(400, nameError.code, nameError.message);
+		if (req.fileInfo !== void 0) {
+			const infoError = validateFileInfo(req.fileInfo);
+			if (infoError) return this.error(400, infoError.code, infoError.message);
+		}
+		const customUploadTimestamp = this.parseCustomUploadTimestamp(req.customUploadTimestamp);
+		if ("status" in customUploadTimestamp) return customUploadTimestamp;
+		const fid = this.genId("4_z");
+		const uploadTimestamp = customUploadTimestamp.timestamp ?? this.monotonicTimestamp();
+		const serverSideEncryption = await storedServerSideEncryption(req.serverSideEncryption ?? bucket.info.defaultServerSideEncryption);
+		if ("status" in serverSideEncryption) return serverSideEncryption;
+		const replicationStatus = this.replicationStatusForNewFile(req.bucketId, req.fileName);
+		const large = {
+			fileId: fid,
+			bucketId: req.bucketId,
+			fileName: req.fileName,
+			contentType: req.contentType,
+			fileInfo: req.fileInfo ?? {},
+			fileRetention: req.fileRetention ?? defaultFileRetention(bucket.info.defaultRetention, uploadTimestamp),
+			legalHold: req.legalHold ?? null,
+			...this.replicationStatusMetadataFor(replicationStatus),
+			serverSideEncryption,
+			uploadTimestamp,
+			parts: /* @__PURE__ */ new Map()
+		};
+		this.largeFiles.set(fid, large);
+		return {
+			status: 200,
+			body: {
+				fileId: fid,
+				fileName: req.fileName,
+				accountId: this.accountId,
+				bucketId: req.bucketId,
+				contentType: req.contentType,
+				fileInfo: large.fileInfo,
+				action: FileAction.Start,
+				contentLength: 0,
+				contentSha1: "none",
+				contentMd5: null,
+				fileRetention: {
+					isClientAuthorizedToRead: true,
+					value: large.fileRetention
+				},
+				legalHold: {
+					isClientAuthorizedToRead: true,
+					value: large.legalHold
+				},
+				...this.replicationStatusMetadataFor(large.replicationStatus),
+				serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
+				uploadTimestamp: large.uploadTimestamp
+			}
+		};
+	}
+	async getUploadPartUrl(req, authToken) {
+		const large = this.largeFiles.get(req.fileId);
+		if (large === void 0) return this.error(400, "bad_request", "Large file not found");
+		const uploadAuth = await this.issueUploadAuthorization({
+			kind: "part",
+			sourceAuthToken: authToken,
+			fileId: req.fileId,
+			fileName: large.fileName
+		});
+		return {
+			status: 200,
+			body: {
+				fileId: req.fileId,
+				uploadUrl: uploadAuth.uploadUrl,
+				authorizationToken: uploadAuth.authorizationToken
+			}
+		};
+	}
+	finishLargeFile(req) {
+		const large = this.largeFiles.get(req.fileId);
+		if (!large) return this.error(400, "bad_request", "Large file not found");
+		const bucket = this.buckets.get(large.bucketId);
+		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const sortedParts = [...large.parts.entries()].sort((a, b) => a[0] - b[0]);
+		if (sortedParts.length > B2_MAX_PART_NUMBER) return this.error(400, "bad_request", `multipart upload has ${sortedParts.length} parts; B2 caps at ${B2_MAX_PART_NUMBER}`);
+		for (const [partNumber] of sortedParts) if (!Number.isInteger(partNumber) || partNumber < B2_MIN_PART_NUMBER || partNumber > B2_MAX_PART_NUMBER) return this.error(400, "bad_request", `partNumber ${partNumber} is outside the [${B2_MIN_PART_NUMBER}, ${B2_MAX_PART_NUMBER}] range B2 accepts`);
+		if (req.partSha1Array.length !== sortedParts.length) return this.error(400, "bad_request", `partSha1Array has ${req.partSha1Array.length} entries but ${sortedParts.length} parts were uploaded`);
+		for (const [i, [partNumber, part]] of sortedParts.entries()) if (req.partSha1Array[i]?.toLowerCase() !== part.sha1) return this.error(400, "bad_request", `part ${partNumber} SHA-1 does not match the uploaded part`);
+		for (const [partNumber, part] of sortedParts.slice(0, -1)) if (part.data.byteLength < this.minimumPartSize) return this.error(400, "bad_request", `part ${partNumber} (${part.data.byteLength} bytes) is smaller than the minimum part size of ${this.minimumPartSize}`);
+		let totalSize = 0;
+		for (const [_, part] of sortedParts) totalSize += part.data.byteLength;
+		const combined = new Uint8Array(totalSize);
+		let offset = 0;
+		for (const [_, part] of sortedParts) {
+			combined.set(part.data, offset);
+			offset += part.data.byteLength;
+		}
+		const fileVersion = this.makeFileVersion({
+			bucketId: large.bucketId,
+			fileName: large.fileName,
+			contentType: large.contentType,
+			contentLength: totalSize,
+			contentSha1: "none",
+			fileInfo: large.fileInfo,
+			action: FileAction.Upload,
+			fileRetention: large.fileRetention,
+			legalHold: large.legalHold,
+			serverSideEncryption: large.serverSideEncryption,
+			uploadTimestamp: large.uploadTimestamp,
+			...this.replicationStatusMetadataFor(large.replicationStatus)
+		});
+		const stored = {
+			fileVersion,
+			data: combined,
+			serverSideEncryption: large.serverSideEncryption
+		};
+		const existing = bucket.files.get(large.fileName);
+		if (existing) existing.push(stored);
+		else bucket.files.set(large.fileName, [stored]);
+		this.largeFiles.delete(req.fileId);
+		this.firePostUploadHooks(fileVersion, large.bucketId, "b2:ObjectCreated:Upload");
+		return {
+			status: 200,
+			body: fileVersion
+		};
+	}
+	cancelLargeFile(req) {
+		const large = this.largeFiles.get(req.fileId);
+		if (!large) return this.error(400, "bad_request", "Large file not found");
+		this.largeFiles.delete(req.fileId);
+		return {
+			status: 200,
+			body: {
+				fileId: large.fileId,
+				accountId: this.accountId,
+				bucketId: large.bucketId,
+				fileName: large.fileName
+			}
+		};
+	}
+	listUnfinishedLargeFiles(req) {
+		const countError = validateMaxCount(req.maxFileCount, "b2_list_unfinished_large_files");
+		if (countError) return this.error(400, countError.code, countError.message);
+		const prefix = req.namePrefix ?? "";
+		const max = req.maxFileCount ?? 100;
+		const candidates = [...this.largeFiles.values()].filter((f) => f.bucketId === req.bucketId).filter((f) => f.fileName.startsWith(prefix)).sort((a, b) => compareB2FileNames(a.fileName, b.fileName));
+		let startIndex = 0;
+		if (req.startFileId !== void 0) {
+			const found = candidates.findIndex((f) => f.fileId === req.startFileId);
+			startIndex = found >= 0 ? found : 0;
+		}
+		return {
+			status: 200,
+			body: {
+				files: candidates.slice(startIndex, startIndex + max).map((f) => ({
+					fileId: f.fileId,
+					fileName: f.fileName,
+					accountId: this.accountId,
+					bucketId: f.bucketId,
+					contentType: f.contentType,
+					action: FileAction.Start,
+					contentLength: 0,
+					contentSha1: "none",
+					contentMd5: null,
+					fileInfo: f.fileInfo,
+					fileRetention: {
+						isClientAuthorizedToRead: true,
+						value: f.fileRetention
+					},
+					legalHold: {
+						isClientAuthorizedToRead: true,
+						value: f.legalHold
+					},
+					...this.replicationStatusMetadataFor(f.replicationStatus),
+					serverSideEncryption: publicServerSideEncryption(f.serverSideEncryption),
+					uploadTimestamp: f.uploadTimestamp
+				})),
+				nextFileId: startIndex + max < candidates.length ? candidates[startIndex + max]?.fileId ?? null : null
+			}
+		};
+	}
+	listParts(req) {
+		const large = this.largeFiles.get(req.fileId);
+		if (!large) return this.error(400, "bad_request", "Large file not found");
+		const countError = validateMaxCount(req.maxPartCount, "b2_list_parts");
+		if (countError) return this.error(400, countError.code, countError.message);
+		const start = req.startPartNumber ?? 1;
+		const max = req.maxPartCount ?? 1e3;
+		const allParts = [...large.parts.entries()].filter(([n]) => n >= start).sort((a, b) => a[0] - b[0]).map(([partNumber, part]) => ({
+			fileId: req.fileId,
+			partNumber,
+			contentLength: part.data.byteLength,
+			contentSha1: part.sha1,
+			contentMd5: part.contentMd5,
+			serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
+			uploadTimestamp: part.uploadTimestamp
+		}));
+		return {
+			status: 200,
+			body: {
+				parts: allParts.slice(0, max),
+				nextPartNumber: allParts.length > max ? allParts[max]?.partNumber ?? null : null
+			}
+		};
+	}
+	async copyPart(req) {
+		const large = this.largeFiles.get(req.largeFileId);
+		if (!large) return this.error(400, "bad_request", "Large file not found");
+		const partNumberError = this.validatePartNumber(req.partNumber);
+		if (partNumberError !== null) return partNumberError;
+		const found = this.findFile(req.sourceFileId);
+		if (found === null) return this.error(404, "file_not_present", "Source file not found");
+		const sourceStored = found.stored;
+		const sourceEncryptionError = await this.validateSourceServerSideEncryption(sourceStored, req.sourceServerSideEncryption);
+		if (sourceEncryptionError !== null) return sourceEncryptionError;
+		const destinationEncryptionError = await this.validateCopyPartDestinationEncryption(large, req.destinationServerSideEncryption);
+		if (destinationEncryptionError !== null) return destinationEncryptionError;
+		let partData = sourceStored.data;
+		if (req.range !== void 0) {
+			const parsed = parseRangeHeader(req.range, sourceStored.data.byteLength);
+			if (parsed.kind === "malformed") return this.error(400, "bad_request", `Malformed copy range: ${req.range}`);
+			if (parsed.kind === "unsatisfiable") return this.error(416, "range_not_satisfiable", `Unsatisfiable copy range: ${req.range}`);
+			partData = sourceStored.data.subarray(parsed.start, parsed.end + 1);
+		}
+		const sha1 = await sha1Hex(partData);
+		const uploadTimestamp = this.monotonicTimestamp();
+		large.parts.set(req.partNumber, {
+			data: new Uint8Array(partData),
+			sha1,
+			contentMd5: null,
+			uploadTimestamp
+		});
+		return {
+			status: 200,
+			body: {
+				fileId: req.largeFileId,
+				partNumber: req.partNumber,
+				contentLength: partData.byteLength,
+				contentSha1: sha1,
+				contentMd5: null,
+				serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
+				uploadTimestamp
+			}
+		};
+	}
+	getDownloadAuthorization(req) {
+		this.purgeExpiredDownloadAuthorizationTokens();
+		if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const prefixError = validateDownloadAuthorizationPrefix(req.fileNamePrefix);
+		if (prefixError) return this.error(400, prefixError.code, prefixError.message);
+		const durationError = validateDownloadAuthorizationDuration(req.validDurationInSeconds);
+		if (durationError) return this.error(400, durationError.code, durationError.message);
+		const overrideError = validateDownloadResponseOverrides(req);
+		if (overrideError) return this.error(400, overrideError.code, overrideError.message);
+		let authorizationToken = randomDownloadAuthorizationToken();
+		while (this.downloadAuthorizationTokens.has(authorizationToken)) authorizationToken = randomDownloadAuthorizationToken();
+		const expiresAt = this.now() + req.validDurationInSeconds * 1e3;
+		this.downloadAuthorizationTokens.set(authorizationToken, {
+			bucketId: req.bucketId,
+			fileNamePrefix: req.fileNamePrefix,
+			expiresAt,
+			responseHeaderOverrides: pickDownloadResponseOverrides(req)
+		});
+		this.pushDownloadAuthorizationExpiry({
+			token: authorizationToken,
+			expiresAt
+		});
+		return {
+			status: 200,
+			body: {
+				bucketId: req.bucketId,
+				fileNamePrefix: req.fileNamePrefix,
+				authorizationToken
+			}
+		};
+	}
+	createKeyCapabilitiesOutsideGrant(authToken, requested) {
+		const creator = authToken === void 0 ? void 0 : this.issuedTokens.get(authToken);
+		if (creator === void 0) return this.strictAuth ? requested : [];
+		if (creator.applicationKeyId === null) return [];
+		const granted = new Set(creator.capabilities);
+		return requested.filter((capability) => !granted.has(capability));
+	}
+	createKeyCreatorAccountId(authToken) {
+		return (authToken === void 0 ? void 0 : this.issuedTokens.get(authToken))?.accountId ?? this.accountId;
+	}
+	createKey(req, version, authToken) {
+		if (version === "v4" && hasOwnField(req, "bucketId")) return this.error(400, "bad_request", "bucketId is not accepted by v4 b2_create_key; use bucketIds");
+		if (version !== "v4" && req.bucketId !== void 0 && req.bucketIds !== void 0) return this.error(400, "bad_request", "b2_create_key accepts either bucketIds or bucketId");
+		const bucketIds = version !== "v4" && req.bucketId !== void 0 ? Object.freeze([req.bucketId]) : normalizeKeyBucketIds(req);
+		const namePrefix = req.namePrefix === void 0 || req.namePrefix === "" ? null : req.namePrefix;
+		const creatorAccountId = this.createKeyCreatorAccountId(authToken);
+		if (req.accountId !== creatorAccountId) return this.error(400, "bad_request", "accountId must match authorized account");
+		const keyNameError = validateCreateKeyName(req.keyName);
+		if (keyNameError) return this.error(400, keyNameError.code, keyNameError.message);
+		const keyName = req.keyName;
+		const capabilitiesError = validateCreateKeyCapabilities(req.capabilities);
+		if (capabilitiesError) return this.error(400, capabilitiesError.code, capabilitiesError.message);
+		const capabilities = normalizeCreateKeyCapabilities(req.capabilities);
+		const unauthorizedCapabilities = this.createKeyCapabilitiesOutsideGrant(authToken, capabilities);
+		if (unauthorizedCapabilities.length > 0) return this.error(400, "bad_request", `requested capabilities exceed creator grant: ${unauthorizedCapabilities.join(", ")}`);
+		if (hasKeyManagementCapability(capabilities) && (bucketIds !== null || namePrefix !== null)) return this.error(400, "bad_request", "key-management capabilities are account-level and cannot be bucket or name-prefix scoped");
+		const kid = this.genId("sim_key");
+		const stored = {
+			applicationKeyId: kid,
+			keyName,
+			capabilities,
+			accountId: creatorAccountId,
+			applicationKey: this.genId("sim_secret"),
+			bucketIds,
+			namePrefix,
+			expirationTimestamp: req.validDurationInSeconds !== void 0 ? this.now() + req.validDurationInSeconds * 1e3 : null
+		};
+		this.keys.set(kid, stored);
+		return {
+			status: 200,
+			body: {
+				keyName: stored.keyName,
+				applicationKeyId: stored.applicationKeyId,
+				applicationKey: stored.applicationKey,
+				capabilities: cloneCapabilities(stored.capabilities),
+				accountId: stored.accountId,
+				expirationTimestamp: stored.expirationTimestamp,
+				bucketIds: cloneBucketIds(stored.bucketIds),
+				bucketId: singleBucketId(stored.bucketIds),
+				namePrefix: stored.namePrefix,
+				options: []
+			}
+		};
+	}
+	listKeys(req) {
+		const countError = validateMaxCount(req.maxKeyCount, "b2_list_keys");
+		if (countError) return this.error(400, countError.code, countError.message);
+		const max = req.maxKeyCount ?? 1e3;
+		let allKeys = [...this.keys.values()].sort((a, b) => a.applicationKeyId.localeCompare(b.applicationKeyId));
+		if (req.startApplicationKeyId) {
+			const start = req.startApplicationKeyId;
+			allKeys = allKeys.filter((k) => k.applicationKeyId >= start);
+		}
+		return {
+			status: 200,
+			body: {
+				keys: allKeys.slice(0, max).map((k) => ({
+					keyName: k.keyName,
+					applicationKeyId: k.applicationKeyId,
+					capabilities: cloneCapabilities(k.capabilities),
+					accountId: k.accountId,
+					expirationTimestamp: k.expirationTimestamp,
+					bucketIds: cloneBucketIds(k.bucketIds),
+					bucketId: singleBucketId(k.bucketIds),
+					namePrefix: k.namePrefix,
+					options: []
+				})),
+				nextApplicationKeyId: allKeys.length > max ? allKeys[max]?.applicationKeyId ?? null : null
+			}
+		};
+	}
+	deleteKey(req) {
+		const key = this.keys.get(req.applicationKeyId);
+		if (!key) return this.error(400, "bad_request", "Key not found");
+		this.keys.delete(req.applicationKeyId);
+		for (const [token, scope] of this.issuedTokens.entries()) if (scope.applicationKeyId === req.applicationKeyId) this.issuedTokens.delete(token);
+		for (const [token, scope] of this.uploadTokens.entries()) if (scope.applicationKeyId === req.applicationKeyId) {
+			scope.invalidated = true;
+			this.uploadTokens.set(token, scope);
+		}
+		return {
+			status: 200,
+			body: {
+				keyName: key.keyName,
+				applicationKeyId: key.applicationKeyId,
+				capabilities: cloneCapabilities(key.capabilities),
+				accountId: key.accountId,
+				expirationTimestamp: key.expirationTimestamp,
+				bucketIds: cloneBucketIds(key.bucketIds),
+				bucketId: singleBucketId(key.bucketIds),
+				namePrefix: key.namePrefix,
+				options: []
+			}
+		};
+	}
+	updateFileRetention(req, authToken) {
+		const found = this.findFile(req.fileId);
+		if (found === null || found.stored.fileVersion.fileName !== req.fileName) return this.error(404, "file_not_present", "File not found");
+		const fileLockError = this.requireFileLockEnabled(found.bucket);
+		if (fileLockError !== null) return fileLockError;
+		const fileRetention = parseFileRetentionValue(req.fileRetention, Date.now());
+		if (fileRetention === null) return this.error(400, "bad_request", "fileRetention must use a valid mode and retainUntilTimestamp pair");
+		const current = found.stored.fileVersion.fileRetention?.value;
+		if (current?.mode === RetentionMode.Compliance && (fileRetention.mode !== RetentionMode.Compliance || isRetentionWeakened(current, fileRetention))) return this.error(400, "file_lock_compliance_protected", "Compliance-mode retention cannot be shortened or removed");
+		if (requiresGovernanceBypass(current, fileRetention)) {
+			const bypassError = this.requireGovernanceBypass(req, authToken, "Governance-mode retention cannot be shortened, removed, or converted without bypassGovernance");
+			if (bypassError !== null) return bypassError;
+		}
+		found.versions[found.index] = {
+			fileVersion: {
+				...found.stored.fileVersion,
+				fileRetention: {
+					isClientAuthorizedToRead: true,
+					value: fileRetention
+				}
+			},
+			data: found.stored.data,
+			serverSideEncryption: found.stored.serverSideEncryption
+		};
+		return {
+			status: 200,
+			body: {
+				fileName: req.fileName,
+				fileId: req.fileId,
+				fileRetention
+			}
+		};
+	}
+	updateFileLegalHold(req) {
+		const found = this.findFile(req.fileId);
+		if (found === null || found.stored.fileVersion.fileName !== req.fileName) return this.error(404, "file_not_present", "File not found");
+		const fileLockError = this.requireFileLockEnabled(found.bucket);
+		if (fileLockError !== null) return fileLockError;
+		if (req.legalHold !== LegalHoldValue.On && req.legalHold !== LegalHoldValue.Off) return this.error(400, "bad_request", "legalHold must be \"on\" or \"off\"");
+		found.versions[found.index] = {
+			fileVersion: {
+				...found.stored.fileVersion,
+				legalHold: {
+					isClientAuthorizedToRead: true,
+					value: req.legalHold
+				}
+			},
+			data: found.stored.data,
+			serverSideEncryption: found.stored.serverSideEncryption
+		};
+		return {
+			status: 200,
+			body: {
+				fileName: req.fileName,
+				fileId: req.fileId,
+				legalHold: req.legalHold
+			}
+		};
+	}
+	getBucketNotificationRules(req) {
+		if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const rules = this.notificationRules.get(req.bucketId) ?? [];
+		return {
+			status: 200,
+			body: {
+				bucketId: req.bucketId,
+				eventNotificationRules: rules
+			}
+		};
+	}
+	setBucketNotificationRules(req) {
+		if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const rulesError = validateNotificationRules(req.eventNotificationRules);
+		if (rulesError) return this.error(400, rulesError.code, rulesError.message);
+		this.notificationRules.set(req.bucketId, req.eventNotificationRules);
+		return {
+			status: 200,
+			body: {
+				bucketId: req.bucketId,
+				eventNotificationRules: req.eventNotificationRules
+			}
+		};
+	}
+	/**
+	* Locates a stored file version by its `fileId`, scanning every bucket.
+	*
+	* Returns enough context to support read-only inspection (`stored`,
+	* `bucketId`) AND in-place mutation (`versions`, `index`) so callers
+	* that need to splice the version out can do so without re-scanning.
+	*
+	* Real B2 fileIds embed the bucketId, so production lookups are O(1);
+	* the simulator's flat ID generator (`this.genId('4_z')`) doesn't, so this
+	* is O(buckets × files × versions). Acceptable for tests.
+	*
+	* @param fileId - The file version ID to locate.
+	*
+	* @returns The location of the matching version, or `null` if not found.
+	*/
+	findFile(fileId) {
+		for (const [bid, bucket] of this.buckets.entries()) for (const versions of bucket.files.values()) {
+			const idx = versions.findIndex((v) => v.fileVersion.fileId === fileId);
+			if (idx !== -1) return {
+				stored: versions[idx],
+				bucketId: bid,
+				bucket,
+				versions,
+				index: idx
+			};
+		}
+		return null;
+	}
+	makeFileVersion(params) {
+		return {
+			accountId: accountId(this.accountId),
+			action: params.action,
+			bucketId: bucketId(params.bucketId),
+			contentLength: params.contentLength,
+			contentMd5: null,
+			contentSha1: params.contentSha1,
+			contentType: params.contentType,
+			fileId: fileId(this.genId("4_z")),
+			fileInfo: params.fileInfo ?? {},
+			fileName: params.fileName,
+			fileRetention: {
+				isClientAuthorizedToRead: true,
+				value: params.fileRetention ?? null
+			},
+			legalHold: {
+				isClientAuthorizedToRead: true,
+				value: params.legalHold ?? null
+			},
+			...this.replicationStatusMetadataFor(params.replicationStatus),
+			serverSideEncryption: publicServerSideEncryption(params.serverSideEncryption ?? { mode: EncryptionMode.None }),
+			uploadTimestamp: params.uploadTimestamp ?? this.monotonicTimestamp()
+		};
+	}
+	newReplicationStatusField(bucketId, fileName) {
+		return this.replicationStatusMetadataFor(this.replicationStatusForNewFile(bucketId, fileName));
+	}
+	replicationStatusMetadataFor(replicationStatus) {
+		return replicationStatus === void 0 ? {} : { replicationStatus };
+	}
+	replicationStatusForNewFile(bucketId, fileName) {
+		return this.matchingEnabledReplicationRules(bucketId, fileName).length > 0 ? "PENDING" : void 0;
+	}
+	matchingEnabledReplicationRules(bucketId, fileName) {
+		return (this.buckets.get(bucketId)?.info.replicationConfiguration.asReplicationSource?.replicationRules)?.filter((rule) => rule.isEnabled && fileName.startsWith(rule.fileNamePrefix)) ?? [];
+	}
+	error(status, code, message) {
+		return {
+			status,
+			body: {
+				status,
+				code,
+				message
+			}
+		};
+	}
+	/**
+	* Fire the pluggable post-upload hooks for a file that just landed in
+	* a bucket: matching event-notification rules → `onWebhookDeliver`,
+	* configured replication source rules → `onReplicate`. Errors thrown
+	* from user-supplied hooks are swallowed so a buggy listener never
+	* masks an otherwise-successful API response.
+	*
+	* Fired-and-forgotten (no await) by the handler so the synthetic
+	* response is returned to the caller as fast as production B2 would
+	* acknowledge the write.
+	*
+	* @param fileVersion - The freshly-stored file metadata.
+	* @param bucketId - The bucket the upload landed in.
+	* @param eventType - The B2 event-type tag (e.g. `'b2:ObjectCreated:Upload'`)
+	*   used to match against `EventNotificationRule.eventTypes` globs.
+	*/
+	firePostUploadHooks(fileVersion, bucketId, eventType) {
+		if (!this.buckets.get(bucketId)) return;
+		if (this.onWebhookDeliver !== void 0) {
+			const rules = this.notificationRules.get(bucketId) ?? [];
+			for (const rule of rules) {
+				if (!rule.isEnabled) continue;
+				if (!rule.eventTypes.some((pattern) => eventTypeMatches(pattern, eventType))) continue;
+				const hook = this.onWebhookDeliver;
+				this.dispatchHook("webhook", () => hook({
+					rule,
+					fileVersion,
+					bucketId
+				}));
+			}
+		}
+		if (this.onReplicate !== void 0) for (const rule of this.matchingEnabledReplicationRules(bucketId, fileVersion.fileName)) {
+			const hook = this.onReplicate;
+			this.dispatchHook("replication", () => hook({
+				sourceFileVersion: fileVersion,
+				sourceBucketId: bucketId,
+				destinationBucketId: rule.destinationBucketId
+			}));
+		}
+	}
+	/**
+	* Schedule a user-supplied hook callback. Errors are routed to
+	* `onHookError` if configured, swallowed otherwise. The returned
+	* promise is tracked in {@link pendingHooks} so `flushHooks()` can
+	* wait for every dispatched hook to settle.
+	*
+	* @param kind - Which hook this is (`'webhook'` or `'replication'`).
+	* @param fn - Thunk that performs the hook invocation.
+	*/
+	dispatchHook(kind, fn) {
+		const task = Promise.resolve().then(() => fn()).catch((err) => {
+			if (this.onHookError !== void 0) this.onHookError({
+				kind,
+				error: toError(err)
+			});
+		}).finally(() => {
+			this.pendingHooks.delete(task);
+		});
+		this.pendingHooks.add(task);
+	}
+};
+/**
+* Module-local cache of compiled glob regexes. Avoids recompiling the
+* same `eventTypes` pattern on every upload's hook dispatch — patterns
+* are stable for the lifetime of a `setBucketNotificationRules` call
+* and typically reused across thousands of uploads.
+*/
+var eventTypeRegexCache = /* @__PURE__ */ new Map();
+/**
+* Wildcard match for B2 event-type globs. Supports the prefix-glob form
+* the B2 docs document: `b2:ObjectCreated:*` matches
+* `b2:ObjectCreated:Upload`, `b2:ObjectCreated:Copy`, etc. Exact
+* matches without `*` match literally.
+*
+* @param pattern - Glob from an `EventNotificationRule.eventTypes` entry.
+* @param eventType - Concrete event type produced by the simulator.
+*
+* @returns `true` when the pattern matches the event type.
+*/
 function eventTypeMatches(pattern, eventType) {
-  if (!pattern.includes("*")) return pattern === eventType;
-  let compiled = eventTypeRegexCache.get(pattern);
-  if (compiled === void 0) {
-    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-    compiled = new RegExp(`^${escaped}$`);
-    eventTypeRegexCache.set(pattern, compiled);
-  }
-  return compiled.test(eventType);
+	if (!pattern.includes("*")) return pattern === eventType;
+	let compiled = eventTypeRegexCache.get(pattern);
+	if (compiled === void 0) {
+		const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+		compiled = new RegExp(`^${escaped}$`);
+		eventTypeRegexCache.set(pattern, compiled);
+	}
+	return compiled.test(eventType);
 }
+/**
+* Build a synthetic {@link HttpResponse} from a consumed {@link FaultSpec}.
+* Mirrors the shape of real B2 error responses so the SDK's
+* `RetryTransport` / `classifyError` paths see realistic input.
+*
+* @param fault - The fault spec to render.
+*
+* @returns An `HttpResponse` ready to return from `transport.send`.
+*/
 function buildFaultResponse(fault) {
-  const status = fault.status ?? 503;
-  const code = fault.code ?? "service_unavailable";
-  const message = fault.message ?? "simulated failure";
-  const body = JSON.stringify({ status, code, message });
-  const headers = new Headers({ "Content-Type": "application/json" });
-  if (fault.retryAfter !== void 0) {
-    headers.set("Retry-After", String(fault.retryAfter));
-  }
-  return {
-    status,
-    headers,
-    body: new ReadableStream({
-      start(controller) {
-        controller.enqueue(utf8Encoder.encode(body));
-        controller.close();
-      }
-    }),
-    json: () => Promise.resolve(JSON.parse(body)),
-    text: () => Promise.resolve(body),
-    arrayBuffer: () => Promise.resolve(utf8Encoder.encode(body).buffer)
-  };
+	const status = fault.status ?? 503;
+	const code = fault.code ?? "service_unavailable";
+	const message = fault.message ?? "simulated failure";
+	const body = JSON.stringify({
+		status,
+		code,
+		message
+	});
+	const headers = new Headers({ "Content-Type": "application/json" });
+	if (fault.retryAfter !== void 0) headers.set("Retry-After", String(fault.retryAfter));
+	return {
+		status,
+		headers,
+		body: new ReadableStream({ start(controller) {
+			controller.enqueue(utf8Encoder.encode(body));
+			controller.close();
+		} }),
+		json: () => Promise.resolve(JSON.parse(body)),
+		text: () => Promise.resolve(body),
+		arrayBuffer: () => Promise.resolve(utf8Encoder.encode(body).buffer)
+	};
+}
+function rawUrlPathContainsLiteralBackslash(rawUrl) {
+	const schemeEnd = rawUrl.indexOf("://");
+	const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+	const urlEndCandidates = [rawUrl.indexOf("?", authorityStart), rawUrl.indexOf("#", authorityStart)].filter((index) => index !== -1);
+	const urlEnd = urlEndCandidates.length === 0 ? rawUrl.length : Math.min(...urlEndCandidates);
+	const pathStartCandidates = [rawUrl.indexOf("/", authorityStart), rawUrl.indexOf("\\", authorityStart)].filter((index) => index !== -1 && index < urlEnd);
+	if (pathStartCandidates.length === 0) return false;
+	const pathStart = Math.min(...pathStartCandidates);
+	const pathEndCandidates = [rawUrl.indexOf("?", pathStart), rawUrl.indexOf("#", pathStart)].filter((index) => index !== -1);
+	const pathEnd = pathEndCandidates.length === 0 ? rawUrl.length : Math.min(...pathEndCandidates);
+	return rawUrl.slice(pathStart, pathEnd).includes("\\");
+}
+function badRequestJson(message) {
+	return {
+		status: 400,
+		body: {
+			status: 400,
+			code: "bad_request",
+			message
+		}
+	};
+}
+function checkedUploadBody(data, expectedLength) {
+	if (expectedLength !== null && data.byteLength !== expectedLength) return { error: badRequestJson(contentLengthMismatchMessage(expectedLength, data.byteLength)) };
+	return { data };
+}
+function copyBytes(bytes) {
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return copy;
+}
+function concatenateChunks(chunks, totalLength) {
+	if (chunks.length === 0) return /* @__PURE__ */ new Uint8Array(0);
+	if (chunks.length === 1) return copyBytes(chunks[0]);
+	const data = new Uint8Array(totalLength);
+	let offset = 0;
+	for (const chunk of chunks) {
+		data.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return data;
+}
+async function readStreamingUploadBody(stream, expectedLength) {
+	const reader = stream.getReader();
+	const chunks = [];
+	let totalLength = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (value === void 0) continue;
+			const chunk = value instanceof Uint8Array ? value : new Uint8Array(value);
+			totalLength += chunk.byteLength;
+			if (expectedLength !== null && totalLength > expectedLength) {
+				await reader.cancel().catch(() => void 0);
+				return { error: badRequestJson(contentLengthMismatchMessage(expectedLength, totalLength)) };
+			}
+			chunks.push(chunk);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	if (expectedLength !== null && totalLength !== expectedLength) return { error: badRequestJson(contentLengthMismatchMessage(expectedLength, totalLength)) };
+	return { data: concatenateChunks(chunks, totalLength) };
 }
-class SimulatorTransport {
-  constructor(sim) {
-    this.sim = sim;
-  }
-  async send(request) {
-    const url = request.url;
-    const fault = this.sim.consumeMatchingFault(url);
-    if (fault !== null) {
-      return buildFaultResponse(fault);
-    }
-    const headers = {};
-    if (request.headers) {
-      for (const [k, v] of Object.entries(request.headers)) {
-        headers[k.toLowerCase()] = v;
-      }
-    }
-    const isUpload = url.includes("b2_upload_file") || url.includes("b2_upload_part");
-    const parsedUrl = new URL(url);
-    const isDownload = parsedUrl.pathname.includes("b2_download_file_by_id") || parsedUrl.pathname.includes("/file/");
-    if (isDownload) {
-      const method = request.method === "HEAD" ? "HEAD" : "GET";
-      const result2 = this.sim.handleDownload(parsedUrl.pathname + parsedUrl.search, headers, method);
-      const data = result2.data ?? new Uint8Array(0);
-      const responseHeaders = new Headers(result2.headers);
-      responseHeaders.set(
-        "Content-Type",
-        result2.headers["Content-Type"] ?? "application/octet-stream"
-      );
-      const body = method === "HEAD" || result2.data === null ? null : new ReadableStream({
-        start(controller) {
-          controller.enqueue(data);
-          controller.close();
-        }
-      });
-      return {
-        status: result2.status,
-        headers: responseHeaders,
-        body,
-        json: () => Promise.reject(new Error("Download response is not JSON")),
-        text: () => Promise.resolve(utf8Decoder.decode(data)),
-        arrayBuffer: () => Promise.resolve(
-          data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength)
-        )
-      };
-    }
-    let result;
-    if (isUpload && request.body) {
-      const data = new Uint8Array(
-        request.body instanceof ArrayBuffer ? request.body : request.body instanceof Uint8Array ? request.body.buffer.slice(
-          request.body.byteOffset,
-          request.body.byteOffset + request.body.byteLength
-        ) : await new Response(request.body).arrayBuffer()
-      );
-      result = this.sim.handleUpload(url, headers, data);
-    } else {
-      let body = null;
-      if (request.body) {
-        const text = typeof request.body === "string" ? request.body : await new Response(request.body).text();
-        try {
-          body = JSON.parse(text);
-        } catch {
-          body = text;
-        }
-      }
-      result = await this.sim.handleRequest(request.method, parsedUrl.pathname, headers, body);
-    }
-    const responseBody = JSON.stringify(result.body);
-    return {
-      status: result.status,
-      headers: new Headers({ "Content-Type": "application/json" }),
-      body: new ReadableStream({
-        start(controller) {
-          controller.enqueue(utf8Encoder.encode(responseBody));
-          controller.close();
-        }
-      }),
-      json: () => Promise.resolve(result.body),
-      text: () => Promise.resolve(responseBody),
-      arrayBuffer: () => Promise.resolve(utf8Encoder.encode(responseBody).buffer)
-    };
-  }
+async function readUploadBody(body, expectedLength) {
+	if (body instanceof ReadableStream) return readStreamingUploadBody(body, expectedLength);
+	if (body instanceof ArrayBuffer) return checkedUploadBody(new Uint8Array(body), expectedLength);
+	if (ArrayBuffer.isView(body)) {
+		const view = body;
+		return checkedUploadBody(copyBytes(new Uint8Array(view.buffer, view.byteOffset, view.byteLength)), expectedLength);
+	}
+	if (typeof Blob !== "undefined" && body instanceof Blob) {
+		if (expectedLength !== null && body.size !== expectedLength) return { error: badRequestJson(contentLengthMismatchMessage(expectedLength, body.size)) };
+	}
+	return checkedUploadBody(new Uint8Array(await new Response(body).arrayBuffer()), expectedLength);
 }
-export {
-  B2Simulator,
-  BUCKET_INFO_MAX_KEYS,
-  BUCKET_INFO_VALUE_MAX,
-  BUCKET_NAME_MAX,
-  BUCKET_NAME_MIN,
-  FILE_INFO_TOTAL_MAX,
-  FILE_INFO_VALUE_MAX,
-  FILE_NAME_MAX_BYTES,
-  LIST_ENDPOINT_CAPS
+var SimulatorTransport = class {
+	sim;
+	constructor(sim) {
+		this.sim = sim;
+	}
+	async send(request) {
+		const url = request.url;
+		const fault = this.sim.consumeMatchingFault(url);
+		if (fault !== null) return buildFaultResponse(fault);
+		if (rawUrlPathContainsLiteralBackslash(url)) return buildFaultResponse({
+			on: "\\",
+			status: 400,
+			code: "bad_request",
+			message: "URL path must not contain literal backslashes"
+		});
+		const headers = {};
+		if (request.headers) for (const [k, v] of Object.entries(request.headers)) headers[k.toLowerCase()] = v;
+		const parsedUrl = new URL(url);
+		const endpoint = parsedUrl.pathname.split("/").pop() ?? "";
+		const isUpload = endpoint === "b2_upload_file" || endpoint === "b2_upload_part";
+		if (parsedUrl.pathname.includes("b2_download_file_by_id") || parsedUrl.pathname.includes("/file/")) {
+			const method = request.method === "HEAD" ? "HEAD" : "GET";
+			const result = await this.sim.handleDownload(parsedUrl.pathname + parsedUrl.search, headers, method);
+			const data = result.data ?? /* @__PURE__ */ new Uint8Array(0);
+			const responseHeaders = new Headers(result.headers);
+			responseHeaders.set("Content-Type", result.headers["Content-Type"] ?? "application/octet-stream");
+			let decodedText = null;
+			const text = () => {
+				decodedText ??= utf8Decoder.decode(data);
+				return decodedText;
+			};
+			const body = method === "HEAD" || result.data === null ? null : new ReadableStream({ start(controller) {
+				controller.enqueue(data);
+				controller.close();
+			} });
+			return {
+				status: result.status,
+				headers: responseHeaders,
+				body,
+				json: () => {
+					try {
+						return Promise.resolve(JSON.parse(text()));
+					} catch {
+						return Promise.reject(/* @__PURE__ */ new Error("Download response is not JSON"));
+					}
+				},
+				text: () => Promise.resolve(text()),
+				arrayBuffer: () => Promise.resolve(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength))
+			};
+		}
+		let result;
+		if (isUpload) {
+			const parsedContentLength = parseContentLengthHeader(headers);
+			if (parsedContentLength.kind === "error") result = badRequestJson(parsedContentLength.message);
+			else {
+				const uploadBody = await readUploadBody(request.body ?? /* @__PURE__ */ new Uint8Array(0), parsedContentLength.kind === "ok" ? parsedContentLength.expectedLength : null);
+				result = "error" in uploadBody ? uploadBody.error : await this.sim.handleUpload(url, headers, uploadBody.data);
+			}
+		} else {
+			let body = null;
+			if (request.body) {
+				const text = typeof request.body === "string" ? request.body : await new Response(request.body).text();
+				try {
+					body = JSON.parse(text);
+				} catch {
+					body = text;
+				}
+			} else if (request.method.toUpperCase() === "GET" && isPartnerQueryEndpoint(apiPathParts(parsedUrl.pathname).endpoint)) body = queryParamsBody(parsedUrl.searchParams);
+			result = await this.sim.handleRequest(request.method, parsedUrl.origin, parsedUrl.pathname, headers, body);
+		}
+		const responseBody = JSON.stringify(result.body);
+		return {
+			status: result.status,
+			headers: new Headers({ "Content-Type": "application/json" }),
+			body: new ReadableStream({ start(controller) {
+				controller.enqueue(utf8Encoder.encode(responseBody));
+				controller.close();
+			} }),
+			json: () => Promise.resolve(result.body),
+			text: () => Promise.resolve(responseBody),
+			arrayBuffer: () => Promise.resolve(utf8Encoder.encode(responseBody).buffer)
+		};
+	}
 };
-//# sourceMappingURL=index.js.map
+//#endregion
+export { B2Simulator, BUCKET_INFO_MAX_KEYS, BUCKET_INFO_VALUE_MAX, BUCKET_NAME_MAX, BUCKET_NAME_MIN, DOWNLOAD_AUTH_DURATION_MAX_SECONDS, DOWNLOAD_AUTH_DURATION_MIN_SECONDS, FILE_INFO_TOTAL_MAX, FILE_INFO_VALUE_MAX, FILE_NAME_MAX_BYTES, KEY_NAME_MAX, KEY_NAME_MIN, LIST_ENDPOINT_CAPS };
+
+//# sourceMappingURL=index.js.map