@backblaze-labs/b2-sdk 0.2.0 → 0.3.0

package/dist/simulator/index.js

@@ -2,17 +2,83 @@ import { FileAction } from "../types/file.js";
 import { accountId, bucketId, fileId } from "../types/ids.js";
 import { utf8Decoder, utf8Encoder } from "../util/text-codec.js";
 import { encodeFileName } from "../raw/encoding.js";
-import { hmacSha256 } from "../util/crypto.js";
+import { DownloadClientUnauthorizedToReadMarker, DownloadHeaderName } from "../types/download.js";
+import { md5Base64, md5Base64Sync } from "../util/md5.js";
+import { EncryptionAlgorithm, EncryptionMode } from "../types/encryption.js";
+import { LegalHoldValue, RetentionMode } from "../types/lock.js";
+import { hexEncode, hmacSha256 } from "../util/crypto.js";
 import { sha1Hex } from "../streams/hash.js";
 import { BucketRetentionMode } from "../types/bucket.js";
-import { EncryptionAlgorithm, EncryptionMode } from "../types/encryption.js";
 import { toError } from "../util/to-error.js";
+import { b2Url, isB2ApiVersion } from "../raw/url.js";
 import { Capability } from "../types/auth.js";
+import { PartnerSimulator, isPartnerQueryEndpoint } from "./partner.js";
 import { missingCapabilitiesFor } from "./capabilities.js";
 import { BUCKET_NAME_MAX, BUCKET_NAME_MIN, FILE_NAME_MAX_BYTES } from "../internal/b2-naming.js";
-import { BUCKET_INFO_MAX_KEYS, BUCKET_INFO_VALUE_MAX, FILE_INFO_TOTAL_MAX, FILE_INFO_VALUE_MAX, LIST_ENDPOINT_CAPS, validateBucketInfo, validateBucketName, validateFileInfo, validateFileName, validateMaxCount } from "./validation.js";
+import { BUCKET_INFO_MAX_KEYS, BUCKET_INFO_VALUE_MAX, DOWNLOAD_AUTH_DURATION_MAX_SECONDS, DOWNLOAD_AUTH_DURATION_MIN_SECONDS, FILE_INFO_TOTAL_MAX, FILE_INFO_VALUE_MAX, KEY_NAME_MAX, KEY_NAME_MIN, LIST_ENDPOINT_CAPS, normalizeCreateKeyCapabilities, validateBucketInfo, validateBucketName, validateBucketTypes, validateCorsRules, validateCreateKeyCapabilities, validateCreateKeyName, validateDefaultRetention, validateDownloadAuthorizationDuration, validateDownloadAuthorizationPrefix, validateFileInfo, validateFileName, validateLifecycleRules, validateMaxCount, validateNotificationRules, validateReplicationConfiguration } from "./validation.js";
 //#region src/simulator/index.ts
-var UPLOAD_TOKEN_SIGNING_KEY = "b2-sdk-typescript-simulator-upload-token-v1";
+var UPLOAD_TOKEN_SIGNING_KEY = [
+	"b2 sdk typescript",
+	"simulator upload authorization",
+	"v1"
+].join(":");
+var SIMULATOR_MASTER_APPLICATION_KEY_ID = "master-key-id";
+var SIMULATOR_MASTER_APPLICATION_KEY = "master-key";
+var SIMULATOR_TEST_APPLICATION_KEY_ID = "test-key-id";
+var SIMULATOR_TEST_APPLICATION_KEY = "test-key";
+var SIMULATOR_APPLICATION_KEY_ID_PREFIX = "sim_key_";
+var SIMULATOR_MASTER_CAPABILITIES = [
+	Capability.ListBuckets,
+	Capability.ListAllBucketNames,
+	Capability.ReadBuckets,
+	Capability.WriteBuckets,
+	Capability.DeleteBuckets,
+	Capability.ReadBucketEncryption,
+	Capability.WriteBucketEncryption,
+	Capability.ReadBucketReplications,
+	Capability.WriteBucketReplications,
+	Capability.ReadBucketNotifications,
+	Capability.WriteBucketNotifications,
+	Capability.ReadBucketLogging,
+	Capability.WriteBucketLogging,
+	Capability.ReadBucketLifecycleRules,
+	Capability.WriteBucketLifecycleRules,
+	Capability.ListFiles,
+	Capability.ReadFiles,
+	Capability.WriteFiles,
+	Capability.DeleteFiles,
+	Capability.ListKeys,
+	Capability.WriteKeys,
+	Capability.DeleteKeys,
+	Capability.ShareFiles
+];
+function apiPathParts(path) {
+	const segments = path.split("/").filter((segment) => segment.length > 0);
+	const candidate = segments.at(-2);
+	return {
+		endpoint: segments.at(-1) ?? "",
+		version: candidate !== void 0 && isB2ApiVersion(candidate) ? candidate : "v3"
+	};
+}
+function parseBasicAuthorizationHeader(authzHeader) {
+	if (!authzHeader?.startsWith("Basic ")) return null;
+	const decoded = (() => {
+		try {
+			return atob(authzHeader.slice(6));
+		} catch {
+			return null;
+		}
+	})();
+	if (decoded === null) return null;
+	const idx = decoded.indexOf(":");
+	if (idx <= 0 || idx === decoded.length - 1) return null;
+	return {
+		applicationKeyId: decoded.slice(0, idx),
+		applicationKey: decoded.slice(idx + 1)
+	};
+}
+var B2_MIN_PART_NUMBER = 1;
+var B2_MAX_PART_NUMBER = 1e4;
 function base64UrlEncode(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCharCode(byte);
@@ -34,6 +100,11 @@ function timingSafeStringEqual(left, right) {
 	for (let i = 0; i < max; i++) mismatch |= (left.charCodeAt(i) || 0) ^ (right.charCodeAt(i) || 0);
 	return mismatch === 0;
 }
+var MS_PER_DAY = 864e5;
+var MAX_JS_DATE_MS = 864e13;
+function isValidRetentionTimestamp(timestamp, now = Date.now()) {
+	return Number.isFinite(timestamp) && timestamp <= MAX_JS_DATE_MS && timestamp > now;
+}
 /**
 * Parse an RFC 7233 `Range` header value into inclusive start/end byte
 * offsets clamped to the file size. Supports closed (`bytes=0-999`),
@@ -119,6 +190,51 @@ function compareB2FileNames(a, b) {
 	if (a > b) return 1;
 	return 0;
 }
+var DOWNLOAD_AUTH_TOKEN_BYTES = 32;
+var DOWNLOAD_AUTH_TOKEN_PREFIX = "sim_dl_auth_";
+var DOWNLOAD_AUTH_PURGE_BATCH_SIZE = 128;
+var DOWNLOAD_RESPONSE_OVERRIDE_PARAMS = [
+	"b2ContentDisposition",
+	"b2ContentLanguage",
+	"b2ContentEncoding",
+	"b2ContentType",
+	"b2CacheControl",
+	"b2Expires"
+];
+var DOWNLOAD_RESPONSE_OVERRIDE_HEADERS = {
+	b2ContentDisposition: DownloadHeaderName.ContentDisposition,
+	b2ContentLanguage: DownloadHeaderName.ContentLanguage,
+	b2ContentEncoding: DownloadHeaderName.ContentEncoding,
+	b2ContentType: DownloadHeaderName.ContentType,
+	b2CacheControl: DownloadHeaderName.CacheControl,
+	b2Expires: DownloadHeaderName.Expires
+};
+function randomDownloadAuthorizationToken() {
+	const crypto = globalThis.crypto;
+	if (typeof crypto?.getRandomValues !== "function") throw new Error("Download authorization tokens require globalThis.crypto.getRandomValues");
+	const bytes = new Uint8Array(DOWNLOAD_AUTH_TOKEN_BYTES);
+	crypto.getRandomValues(bytes);
+	return `${DOWNLOAD_AUTH_TOKEN_PREFIX}${hexEncode(bytes)}`;
+}
+function pickDownloadResponseOverrides(req) {
+	const overrides = {};
+	for (const param of DOWNLOAD_RESPONSE_OVERRIDE_PARAMS) {
+		const value = req[param];
+		if (typeof value === "string") overrides[param] = value;
+	}
+	return overrides;
+}
+function validateDownloadResponseOverrides(req) {
+	for (const param of DOWNLOAD_RESPONSE_OVERRIDE_PARAMS) {
+		const value = req[param];
+		if (value === void 0 || typeof value === "string") continue;
+		return {
+			code: "bad_request",
+			message: `${param} must be a string`
+		};
+	}
+	return null;
+}
 function normalizeKeyBucketIds(req) {
 	return req.bucketIds === void 0 || req.bucketIds === null ? null : Object.freeze([...req.bucketIds]);
 }
@@ -128,6 +244,18 @@ function singleBucketId(bucketIds) {
 function cloneBucketIds(bucketIds) {
 	return bucketIds === null ? null : [...bucketIds];
 }
+function cloneCapabilities(capabilities) {
+	return [...capabilities];
+}
+function isImplicitStorageMasterCredential(credentials) {
+	return credentials.applicationKeyId === SIMULATOR_MASTER_APPLICATION_KEY_ID && credentials.applicationKey === SIMULATOR_MASTER_APPLICATION_KEY || credentials.applicationKeyId === SIMULATOR_TEST_APPLICATION_KEY_ID && credentials.applicationKey === SIMULATOR_TEST_APPLICATION_KEY;
+}
+function isImplicitPartnerMasterCredential(credentials) {
+	return credentials.applicationKeyId === SIMULATOR_MASTER_APPLICATION_KEY_ID && credentials.applicationKey === SIMULATOR_MASTER_APPLICATION_KEY;
+}
+function isSimulatorApplicationKeyId(applicationKeyId) {
+	return applicationKeyId.startsWith(SIMULATOR_APPLICATION_KEY_ID_PREFIX);
+}
 function hasOwnField(body, field) {
 	return typeof body === "object" && body !== null && Object.hasOwn(body, field);
 }
@@ -136,10 +264,148 @@ function requestStringField(body, field) {
 	const value = body[field];
 	return typeof value === "string" ? value : void 0;
 }
+function requestRecord(body) {
+	return typeof body === "object" && body !== null && !Array.isArray(body) ? body : null;
+}
+function replicationDestinationBucketIds(body) {
+	const rules = requestRecord(requestRecord(requestRecord(body)?.["replicationConfiguration"])?.["asReplicationSource"])?.["replicationRules"];
+	if (!Array.isArray(rules)) return [];
+	const bucketIds = [];
+	for (const rule of rules) {
+		const destinationBucketId = requestRecord(rule)?.["destinationBucketId"];
+		if (typeof destinationBucketId === "string") bucketIds.push(destinationBucketId);
+	}
+	return [...new Set(bucketIds)];
+}
+function normalizeReplicationConfiguration(config) {
+	return {
+		asReplicationSource: config.asReplicationSource ?? null,
+		asReplicationDestination: config.asReplicationDestination ?? null
+	};
+}
+function validateBucketConfigurationFields(fields, options) {
+	if (fields.bucketInfo !== void 0) {
+		const infoError = validateBucketInfo(fields.bucketInfo);
+		if (infoError) return infoError;
+	}
+	if (fields.corsRules !== void 0) {
+		const corsError = validateCorsRules(fields.corsRules);
+		if (corsError) return corsError;
+	}
+	if (fields.lifecycleRules !== void 0) {
+		const lifecycleError = validateLifecycleRules(fields.lifecycleRules);
+		if (lifecycleError) return lifecycleError;
+	}
+	if (fields.replicationConfiguration !== void 0) {
+		const replicationError = validateReplicationConfiguration(fields.replicationConfiguration);
+		if (replicationError) return replicationError;
+	}
+	if (fields.defaultRetention !== void 0) {
+		const retentionError = validateDefaultRetention(fields.defaultRetention);
+		if (retentionError) return retentionError;
+		if (requestRecord(fields.defaultRetention)?.["mode"] !== BucketRetentionMode.None && !options.objectLockEnabled) return {
+			code: "file_lock_not_enabled",
+			message: "Bucket must have Object Lock enabled to set defaultRetention"
+		};
+	}
+	return null;
+}
+function nextObjectLockEnabled(current, requested) {
+	if (requested === void 0) return current;
+	if (typeof requested !== "boolean") return {
+		code: "bad_request",
+		message: "fileLockEnabled must be a boolean"
+	};
+	if (current && requested === false) return {
+		code: "file_lock_conflict",
+		message: "Object Lock cannot be disabled"
+	};
+	return current || requested;
+}
+function requestHeaderValue(headers, name) {
+	const exact = headers[name];
+	if (exact !== void 0) return exact;
+	const lowerName = name.toLowerCase();
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === lowerName) return value;
+}
+function parseContentLengthHeader(headers) {
+	const header = requestHeaderValue(headers, "content-length");
+	if (header === void 0) return { kind: "absent" };
+	if (!/^\d+$/.test(header)) return {
+		kind: "error",
+		message: `Content-Length must be a byte count: ${header}`
+	};
+	const expectedLength = Number(header);
+	if (!Number.isSafeInteger(expectedLength)) return {
+		kind: "error",
+		message: `Content-Length is too large: ${header}`
+	};
+	return {
+		kind: "ok",
+		expectedLength
+	};
+}
+function contentLengthMismatchMessage(expectedLength, actualLength) {
+	return `Content-Length ${expectedLength} does not match request body length ${actualLength}`;
+}
 function fileNames(...names) {
 	const present = names.filter((name) => name !== void 0);
 	return present.length > 0 ? present : void 0;
 }
+function queryParamsBody(params) {
+	const body = Object.create(null);
+	let hasParams = false;
+	for (const [key, value] of params) {
+		if (body[key] !== void 0) continue;
+		body[key] = value;
+		hasParams = true;
+	}
+	return hasParams ? body : null;
+}
+var JSON_GET_ENDPOINTS = /* @__PURE__ */ new Set([
+	"b2_authorize_account",
+	"b2_list_groups",
+	"b2_list_group_members",
+	"bz_list_computers"
+]);
+var JSON_POST_ENDPOINTS = /* @__PURE__ */ new Set([
+	"b2_create_group_member",
+	"b2_eject_group_member",
+	"b2_reserve_trial_create_account",
+	"bz_delete_computer",
+	"b2_create_bucket",
+	"b2_list_buckets",
+	"b2_delete_bucket",
+	"b2_update_bucket",
+	"b2_get_upload_url",
+	"b2_list_file_names",
+	"b2_list_file_versions",
+	"b2_get_file_info",
+	"b2_hide_file",
+	"b2_delete_file_version",
+	"b2_copy_file",
+	"b2_start_large_file",
+	"b2_get_upload_part_url",
+	"b2_finish_large_file",
+	"b2_cancel_large_file",
+	"b2_list_unfinished_large_files",
+	"b2_list_parts",
+	"b2_copy_part",
+	"b2_get_download_authorization",
+	"b2_create_key",
+	"b2_list_keys",
+	"b2_delete_key",
+	"b2_update_file_retention",
+	"b2_update_file_legal_hold",
+	"b2_get_bucket_notification_rules",
+	"b2_set_bucket_notification_rules"
+]);
+function jsonEndpointAllowsMethod(method, endpoint) {
+	const normalizedMethod = method.toUpperCase();
+	if (JSON_GET_ENDPOINTS.has(endpoint)) return normalizedMethod === "GET";
+	if (JSON_POST_ENDPOINTS.has(endpoint)) return normalizedMethod === "POST";
+	return true;
+}
 function notificationRulePrefixes(body) {
 	if (typeof body !== "object" || body === null) return void 0;
 	const rules = body["eventNotificationRules"];
@@ -156,6 +422,13 @@ function storedNotificationRulePrefixes(rules) {
 function hasKeyManagementCapability(capabilities) {
 	return capabilities.some((capability) => capability === Capability.ListKeys || capability === Capability.WriteKeys || capability === Capability.DeleteKeys);
 }
+function missingStoredKeyCapabilities(key, required) {
+	const capabilities = new Set(key.capabilities);
+	return required.filter((capability) => !capabilities.has(capability));
+}
+function storedKeyAllowsBucket(key, bucketId) {
+	return key.bucketIds === null || key.bucketIds.includes(bucketId);
+}
 function publicServerSideEncryption(encryption) {
 	if (encryption.mode === EncryptionMode.SseC) return {
 		mode: encryption.mode,
@@ -167,26 +440,164 @@ function publicServerSideEncryption(encryption) {
 	};
 	return encryption;
 }
-function uploadServerSideEncryption(headers, fallback) {
-	if (headers["x-bz-server-side-encryption-customer-algorithm"] === EncryptionAlgorithm.Aes256) return {
-		mode: EncryptionMode.SseC,
-		algorithm: EncryptionAlgorithm.Aes256,
-		customerKey: headers["x-bz-server-side-encryption-customer-key"] ?? "",
-		customerKeyMd5: headers["x-bz-server-side-encryption-customer-key-md5"] ?? ""
-	};
-	if (headers["x-bz-server-side-encryption"] === EncryptionAlgorithm.Aes256) return {
-		mode: EncryptionMode.SseB2,
-		algorithm: EncryptionAlgorithm.Aes256
+function customerKeyDigest(customerKey) {
+	let first = 2166136261;
+	let second = 668265261;
+	for (const byte of customerKey) {
+		first = Math.imul(first ^ byte, 16777619) >>> 0;
+		second = Math.imul(second ^ byte, 2246822507) >>> 0;
+	}
+	return `${first.toString(16).padStart(8, "0")}${second.toString(16).padStart(8, "0")}`;
+}
+var BASE64_ALPHABET = /^[A-Za-z0-9+/]+$/;
+function normalizeSizedBase64(value, decodedByteLength) {
+	const paddedLength = Math.ceil(decodedByteLength / 3) * 4;
+	const noPaddingLength = Math.ceil(decodedByteLength * 8 / 6);
+	const padding = "=".repeat(paddedLength - noPaddingLength);
+	if (value.length === noPaddingLength && BASE64_ALPHABET.test(value)) return value.padEnd(paddedLength, "=");
+	if (value.length === paddedLength && value.endsWith(padding) && BASE64_ALPHABET.test(value.slice(0, noPaddingLength))) return value;
+	return null;
+}
+function base64ToBytes(value, decodedByteLength) {
+	const normalized = normalizeSizedBase64(value, decodedByteLength);
+	if (normalized === null) return null;
+	try {
+		const decoded = atob(normalized);
+		if (decoded.length !== decodedByteLength) return null;
+		const bytes = new Uint8Array(decoded.length);
+		for (let i = 0; i < decoded.length; i++) bytes[i] = decoded.charCodeAt(i);
+		return bytes;
+	} catch {
+		return null;
+	}
+}
+function encryptionValidationError(message) {
+	return {
+		status: 400,
+		body: {
+			status: 400,
+			code: "bad_request",
+			message
+		}
 	};
-	return fallback;
+}
+function sameStoredServerSideEncryption(a, b) {
+	if (a.mode !== b.mode) return false;
+	if (a.mode === EncryptionMode.None) return true;
+	if (a.mode === EncryptionMode.SseB2 && b.mode === EncryptionMode.SseB2) return a.algorithm === b.algorithm;
+	if (a.mode === EncryptionMode.SseC && b.mode === EncryptionMode.SseC) return a.algorithm === b.algorithm && a.customerKeyDigest === b.customerKeyDigest && a.customerKeyMd5 === b.customerKeyMd5;
+	return false;
+}
+function hasCustomerEncryptionFields(encryption) {
+	return encryption["customerKey"] !== void 0 || encryption["customerKeyMd5"] !== void 0 || encryption["customerAlgorithm"] !== void 0;
+}
+function hasCustomerEncryptionHeaders(headers) {
+	return headers["x-bz-server-side-encryption-customer-algorithm"] !== void 0 || headers["x-bz-server-side-encryption-customer-key"] !== void 0 || headers["x-bz-server-side-encryption-customer-key-md5"] !== void 0;
+}
+async function storedServerSideEncryption(encryption) {
+	const runtimeEncryption = encryption;
+	if (encryption.mode === EncryptionMode.SseC) {
+		if (runtimeEncryption["algorithm"] === void 0) return encryptionValidationError("SSE-C customer algorithm is required");
+		if (encryption.algorithm !== EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-C customer algorithm must be AES256");
+		const customerKey = encryption.customerKey;
+		const customerKeyMd5 = encryption.customerKeyMd5;
+		if (typeof customerKey !== "string" || customerKey === "") return encryptionValidationError("SSE-C customer key is required");
+		if (typeof customerKeyMd5 !== "string" || customerKeyMd5 === "") return encryptionValidationError("SSE-C customer key MD5 is required");
+		const customerKeyBytes = base64ToBytes(customerKey, 32);
+		if (customerKeyBytes === null) return encryptionValidationError("SSE-C customer key must be a base64-encoded 256-bit key");
+		const normalizedCustomerKeyMd5 = normalizeSizedBase64(customerKeyMd5, 16);
+		if (normalizedCustomerKeyMd5 === null) return encryptionValidationError("SSE-C customer key MD5 must be a base64-encoded 128-bit digest");
+		if (await md5Base64(customerKeyBytes) !== normalizedCustomerKeyMd5) return encryptionValidationError("SSE-C customer key MD5 does not match the key");
+		return {
+			mode: encryption.mode,
+			algorithm: encryption.algorithm,
+			customerKeyDigest: customerKeyDigest(customerKeyBytes),
+			customerKeyMd5: normalizedCustomerKeyMd5
+		};
+	}
+	if (encryption.mode === EncryptionMode.SseB2) {
+		if (hasCustomerEncryptionFields(runtimeEncryption)) return encryptionValidationError("SSE-B2 settings must not include SSE-C customer keys");
+		if (encryption.algorithm !== EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-B2 algorithm must be AES256");
+		return {
+			mode: encryption.mode,
+			algorithm: encryption.algorithm
+		};
+	}
+	if (encryption.mode === EncryptionMode.None) {
+		if (hasCustomerEncryptionFields(runtimeEncryption)) return encryptionValidationError("No-encryption settings must not include SSE-C customer keys");
+		return { mode: EncryptionMode.None };
+	}
+	return encryptionValidationError(`Unsupported server-side encryption mode: ${String(runtimeEncryption["mode"])}`);
+}
+async function uploadServerSideEncryption(headers, fallback) {
+	const customerAlgorithm = headers["x-bz-server-side-encryption-customer-algorithm"];
+	const customerKey = headers["x-bz-server-side-encryption-customer-key"];
+	const customerKeyMd5 = headers["x-bz-server-side-encryption-customer-key-md5"];
+	const managedEncryption = headers["x-bz-server-side-encryption"];
+	if (hasCustomerEncryptionHeaders(headers)) {
+		if (managedEncryption !== void 0) return encryptionValidationError("SSE-B2 settings must not include SSE-C customer keys");
+		if (customerAlgorithm === void 0) return encryptionValidationError("SSE-C customer algorithm is required");
+		if (customerAlgorithm !== EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-C customer algorithm must be AES256");
+		if (!customerKey || !customerKeyMd5) return encryptionValidationError("SSE-C customer key and MD5 are required");
+		return await storedServerSideEncryption({
+			mode: EncryptionMode.SseC,
+			algorithm: EncryptionAlgorithm.Aes256,
+			customerKey,
+			customerKeyMd5
+		});
+	}
+	if (managedEncryption !== void 0) {
+		if (managedEncryption !== EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-B2 algorithm must be AES256");
+		return {
+			mode: EncryptionMode.SseB2,
+			algorithm: EncryptionAlgorithm.Aes256
+		};
+	}
+	return await storedServerSideEncryption(fallback);
 }
 function defaultFileRetention(policy, uploadTimestamp) {
 	if (policy.mode === BucketRetentionMode.None || policy.period === null) return null;
-	const days = policy.period.unit === "days" ? policy.period.duration : policy.period.duration * 365;
+	const retainUntilTimestamp = uploadTimestamp + (policy.period.unit === "days" ? policy.period.duration : policy.period.duration * 365) * MS_PER_DAY;
+	if (!isValidRetentionTimestamp(retainUntilTimestamp, uploadTimestamp)) return null;
 	return {
 		mode: policy.mode,
-		retainUntilTimestamp: uploadTimestamp + days * 24 * 60 * 60 * 1e3
+		retainUntilTimestamp
+	};
+}
+function isRetentionMode(value) {
+	return value === RetentionMode.Compliance || value === RetentionMode.Governance;
+}
+function parseFileRetentionValue(value, now) {
+	if (typeof value !== "object" || value === null) return null;
+	const candidate = value;
+	const mode = candidate["mode"];
+	const retainUntilTimestamp = candidate["retainUntilTimestamp"];
+	if (mode === null && retainUntilTimestamp === null) return {
+		mode,
+		retainUntilTimestamp
 	};
+	if (isRetentionMode(mode) && typeof retainUntilTimestamp === "number") {
+		if (!isValidRetentionTimestamp(retainUntilTimestamp, now)) return null;
+		return {
+			mode,
+			retainUntilTimestamp
+		};
+	}
+	return null;
+}
+function isRetentionWeakened(current, next) {
+	if (current === null || current === void 0) return false;
+	if (current.mode === null) return false;
+	if (next.mode === null) return true;
+	if (current.mode === RetentionMode.Compliance && next.mode !== RetentionMode.Compliance) return true;
+	if (current.retainUntilTimestamp === null) return next.mode !== current.mode;
+	if (next.retainUntilTimestamp === null) return true;
+	return next.retainUntilTimestamp < current.retainUntilTimestamp;
+}
+function requiresGovernanceBypass(current, next) {
+	if (current?.mode !== RetentionMode.Governance) return false;
+	if (next.mode === RetentionMode.Compliance) return true;
+	return isRetentionWeakened(current, next);
 }
 /**
 * In-memory B2 simulator for testing. Implements the B2 native API at the
@@ -203,6 +614,15 @@ function defaultFileRetention(policy, uploadTimestamp) {
 * })
 * await client.authorize()
 * ```
+*
+* `test-key-id:test-key` is the documented implicit full-access
+* storage credential. `master-key-id:master-key` is also accepted for
+* tests that share storage and Partner simulator credentials. In the
+* default permissive mode, other well-formed Basic credentials whose
+* applicationKeyId was not minted by `b2_create_key` receive the same
+* implicit master grant for backward compatibility. A simulator-created
+* key always authorizes with its own capabilities, bucket restrictions,
+* name prefix, and expiration.
 */
 var B2Simulator = class {
 	buckets = /* @__PURE__ */ new Map();
@@ -219,6 +639,8 @@ var B2Simulator = class {
 	onHookError;
 	strictAuth;
 	authTokenTtlMs;
+	customUploadTimestampsEnabled;
+	partner;
 	/**
 	* Issued auth tokens with their associated grant scope + expiry. In
 	* permissive mode (`strictAuth: false`) this is still populated by
@@ -234,6 +656,8 @@ var B2Simulator = class {
 	* state for tests.
 	*/
 	uploadTokens = /* @__PURE__ */ new Map();
+	downloadAuthorizationTokens = /* @__PURE__ */ new Map();
+	downloadAuthorizationExpiryHeap = [];
 	/**
 	* Virtual-clock offset applied to `Date.now()` for expiry checks.
 	* Defaults to 0. Tests advance via {@link advanceTime} to fast-forward
@@ -277,7 +701,23 @@ var B2Simulator = class {
 		if (options.onReplicate !== void 0) this.onReplicate = options.onReplicate;
 		if (options.onHookError !== void 0) this.onHookError = options.onHookError;
 		this.strictAuth = options.strictAuth ?? false;
-		this.authTokenTtlMs = options.authTokenTtlMs ?? 1440 * 60 * 1e3;
+		this.customUploadTimestampsEnabled = options.customUploadTimestampsEnabled ?? false;
+		this.authTokenTtlMs = options.authTokenTtlMs ?? 864e5;
+		this.partner = new PartnerSimulator({
+			accountId: this.accountId,
+			authTokenTtlMs: this.authTokenTtlMs,
+			minimumPartSize: this.minimumPartSize,
+			recommendedPartSize: this.recommendedPartSize,
+			canAuthorize: (authzHeader) => this.canAuthorizePartner(authzHeader),
+			createBucket: (req) => this.createBucket(req),
+			error: (status, code, message) => this.error(status, code, message),
+			genId: (prefix) => this.genId(prefix),
+			monotonicTimestamp: () => this.monotonicTimestamp(),
+			now: () => this.now(),
+			storeKey: (key) => {
+				this.keys.set(key.applicationKeyId, key);
+			}
+		}, options);
 	}
 	/**
 	* Advance the simulator's virtual clock by `ms` milliseconds. Used in
@@ -335,6 +775,9 @@ var B2Simulator = class {
 	now() {
 		return Date.now() + this.clockOffsetMs;
 	}
+	isStoredKeyExpired(key) {
+		return key.expirationTimestamp !== null && key.expirationTimestamp <= this.now();
+	}
 	pruneExpiredUploadTokens(now = this.now()) {
 		for (const [authorizationToken, token] of this.uploadTokens.entries()) if (now >= token.cleanupAt) this.uploadTokens.delete(authorizationToken);
 	}
@@ -458,15 +901,195 @@ var B2Simulator = class {
 		const token = this.issuedTokens.get(authToken);
 		if (!token) return this.error(401, "bad_auth_token", "unknown auth token");
 		if (this.now() > token.expiresAt) return this.error(401, "expired_auth_token", "auth token has expired; reauthorize");
+		if (token.applicationKeyId !== null) {
+			const key = this.keys.get(token.applicationKeyId);
+			if (key === void 0) return this.error(401, "bad_auth_token", "application key has been deleted; reauthorize");
+			if (this.isStoredKeyExpired(key)) return this.error(401, "expired_auth_token", "application key has expired; reauthorize");
+		}
 		const missing = missingCapabilitiesFor(endpoint, token.capabilities);
 		if (missing.length > 0) return this.error(403, "unauthorized", `application key lacks required capabilities: ${missing.join(", ")}`);
-		if (token.bucketIds !== null) {
-			if ((scope?.bucketIds.length ?? 0) === 0 && scope?.requiresBucketScope === true) return this.error(403, "unauthorized", `application key is scoped to buckets ${token.bucketIds.join(", ")}; bucket scope is required`);
-			for (const bucketId of scope?.bucketIds ?? []) if (!token.bucketIds.includes(bucketId)) return this.error(403, "unauthorized", `application key is scoped to buckets ${token.bucketIds.join(", ")}; cannot access ${bucketId}`);
+		return this.authorizeScopeGrant(scope, {
+			bucketIds: token.bucketIds,
+			namePrefix: token.namePrefix,
+			bucketScopeRequiredMessage: () => `application key is scoped to buckets ${token.bucketIds?.join(", ")}; bucket scope is required`,
+			bucketMismatchMessage: (bucketId) => `application key is scoped to buckets ${token.bucketIds?.join(", ")}; cannot access ${bucketId}`,
+			prefixMismatchMessage: (fileName) => `application key is scoped to prefix "${token.namePrefix}"; "${fileName}" is outside scope`
+		});
+	}
+	authorizeScopeGrant(scope, grant) {
+		if (grant.bucketIds !== null) {
+			if (scope?.requiresAccountLevelBucketAccess === true) return this.error(403, "unauthorized", grant.bucketScopeRequiredMessage());
+			if ((scope?.bucketIds.length ?? 0) === 0 && scope?.requiresBucketScope === true) return this.error(403, "unauthorized", grant.bucketScopeRequiredMessage());
+			for (const bucketId of scope?.bucketIds ?? []) {
+				if (grant.bucketIds.includes(bucketId)) continue;
+				return this.error(403, "unauthorized", grant.bucketMismatchMessage(bucketId));
+			}
+		}
+		if (grant.namePrefix !== null) for (const fileName of scope?.fileNames ?? []) {
+			if (fileName.startsWith(grant.namePrefix)) continue;
+			return this.error(403, "unauthorized", grant.prefixMismatchMessage(fileName));
+		}
+		return null;
+	}
+	authorizeDownloadRequest(authToken, endpoint, scope, url) {
+		if (authToken === void 0 || authToken === "") return this.error(401, "bad_auth_token", "missing authorization token");
+		const downloadAuth = this.downloadAuthorizationTokens.get(authToken);
+		if (downloadAuth === void 0) {
+			this.purgeExpiredDownloadAuthorizationTokens();
+			return this.authorizeRequest(authToken, endpoint, scope);
+		}
+		if (this.isExpiredDownloadAuthorizationToken(downloadAuth)) {
+			this.downloadAuthorizationTokens.delete(authToken);
+			this.purgeExpiredDownloadAuthorizationTokens();
+			return this.error(401, "expired_auth_token", "download authorization token has expired");
+		}
+		if (endpoint === "b2_download_file_by_id") return this.error(403, "unauthorized", "download authorization tokens cannot be used with b2_download_file_by_id");
+		const overrideError = this.authorizeDownloadResponseOverrides(downloadAuth, url);
+		if (overrideError !== null) return overrideError;
+		return this.authorizeScopeGrant(scope, {
+			bucketIds: [downloadAuth.bucketId],
+			namePrefix: downloadAuth.fileNamePrefix,
+			bucketScopeRequiredMessage: () => `download authorization is scoped to bucket ${downloadAuth.bucketId}; bucket scope is required`,
+			bucketMismatchMessage: (bucketId) => `download authorization is scoped to bucket ${downloadAuth.bucketId}; cannot access ${bucketId}`,
+			prefixMismatchMessage: (fileName) => `download authorization is scoped to prefix "${downloadAuth.fileNamePrefix}"; "${fileName}" is outside scope`
+		});
+	}
+	isExpiredDownloadAuthorizationToken(token, now = this.now()) {
+		return now >= token.expiresAt;
+	}
+	purgeExpiredDownloadAuthorizationTokens() {
+		const now = this.now();
+		for (let i = 0; i < DOWNLOAD_AUTH_PURGE_BATCH_SIZE; i++) {
+			const next = this.downloadAuthorizationExpiryHeap[0];
+			if (next === void 0 || next.expiresAt > now) return;
+			this.popDownloadAuthorizationExpiry();
+			if (this.downloadAuthorizationTokens.get(next.token)?.expiresAt === next.expiresAt) this.downloadAuthorizationTokens.delete(next.token);
+		}
+	}
+	pushDownloadAuthorizationExpiry(entry) {
+		const heap = this.downloadAuthorizationExpiryHeap;
+		heap.push(entry);
+		let idx = heap.length - 1;
+		while (idx > 0) {
+			const parentIdx = Math.floor((idx - 1) / 2);
+			const parent = heap[parentIdx];
+			if (parent.expiresAt <= entry.expiresAt) break;
+			heap[idx] = parent;
+			idx = parentIdx;
+		}
+		heap[idx] = entry;
+	}
+	popDownloadAuthorizationExpiry() {
+		const heap = this.downloadAuthorizationExpiryHeap;
+		const root = heap[0];
+		const last = heap.pop();
+		if (root === void 0 || last === void 0 || heap.length === 0) return root;
+		let idx = 0;
+		while (true) {
+			const leftIdx = idx * 2 + 1;
+			const rightIdx = leftIdx + 1;
+			const left = heap[leftIdx];
+			const right = heap[rightIdx];
+			if (left === void 0) break;
+			const childIdx = right !== void 0 && right.expiresAt < left.expiresAt ? rightIdx : leftIdx;
+			const child = heap[childIdx];
+			if (child.expiresAt >= last.expiresAt) break;
+			heap[idx] = child;
+			idx = childIdx;
+		}
+		heap[idx] = last;
+		return root;
+	}
+	authorizeDownloadResponseOverrides(downloadAuth, url) {
+		for (const param of DOWNLOAD_RESPONSE_OVERRIDE_PARAMS) {
+			const expected = downloadAuth.responseHeaderOverrides[param];
+			if (expected === void 0) continue;
+			const actual = url.searchParams.get(param);
+			if (actual === expected) continue;
+			const expectedText = JSON.stringify(expected);
+			const actualText = actual === null ? "absent" : JSON.stringify(actual);
+			return this.error(403, "unauthorized", `download authorization requires ${param}=${expectedText}; got ${actualText}`);
+		}
+		return null;
+	}
+	downloadAuthorizationFromRequest(headers, url, options = {}) {
+		const headerToken = requestHeaderValue(headers, "authorization");
+		if (headerToken !== void 0) return headerToken;
+		if (options.allowQueryAuthorization !== true) return void 0;
+		const queryToken = url.searchParams.get("Authorization") ?? url.searchParams.get("authorization");
+		return queryToken?.startsWith(DOWNLOAD_AUTH_TOKEN_PREFIX) ? queryToken : void 0;
+	}
+	requestHasCapability(authToken, capability) {
+		if (!this.strictAuth) return true;
+		if (authToken === void 0) return false;
+		return this.issuedTokens.get(authToken)?.capabilities.includes(capability) === true;
+	}
+	requireFileLockEnabled(bucket) {
+		if (bucket.info.fileLockConfiguration.value?.isFileLockEnabled === true) return null;
+		return this.error(400, "file_lock_not_enabled", "Bucket does not have file lock enabled");
+	}
+	requireGovernanceBypass(req, authToken, message) {
+		if (req.bypassGovernance !== true) return this.error(400, "file_lock_governance_protected", message);
+		if (!this.requestHasCapability(authToken, Capability.BypassGovernance)) return this.error(403, "unauthorized", `application key lacks required capabilities: ${Capability.BypassGovernance}`);
+		return null;
+	}
+	validateReplicationApplicationKey(applicationKeyId, requiredCapabilities, options) {
+		const key = this.keys.get(applicationKeyId);
+		if (key === void 0) return this.invalidReplicationApplicationKey(options.role);
+		if (missingStoredKeyCapabilities(key, requiredCapabilities).length > 0) return this.invalidReplicationApplicationKey(options.role);
+		if (options.bucketId !== void 0 && !storedKeyAllowsBucket(key, options.bucketId)) return this.invalidReplicationApplicationKey(options.role);
+		return null;
+	}
+	invalidReplicationApplicationKey(role) {
+		return this.error(400, "bad_request", `${role} application key is invalid or not authorized for this replication configuration`);
+	}
+	invalidReplicationDestinationBucket() {
+		return this.error(400, "bad_request", "replication destination bucket is invalid or not configured for this source application key");
+	}
+	validateReplicationDestinationBuckets(sourceApplicationKeyId, rules) {
+		for (const rule of rules) {
+			const destinationBucketId = requestRecord(rule)?.["destinationBucketId"];
+			if (typeof destinationBucketId !== "string") continue;
+			const destinationApplicationKeyId = this.buckets.get(destinationBucketId)?.info.replicationConfiguration.asReplicationDestination?.sourceToDestinationKeyMapping[sourceApplicationKeyId];
+			if (destinationApplicationKeyId === void 0) return this.invalidReplicationDestinationBucket();
+			const destinationKeyError = this.validateReplicationApplicationKey(destinationApplicationKeyId, [Capability.WriteFiles], {
+				bucketId: destinationBucketId,
+				role: "replication destination"
+			});
+			if (destinationKeyError !== null) return destinationKeyError;
 		}
-		if (token.namePrefix !== null) for (const fileName of scope?.fileNames ?? []) {
-			if (fileName.startsWith(token.namePrefix)) continue;
-			return this.error(403, "unauthorized", `application key is scoped to prefix "${token.namePrefix}"; "${fileName}" is outside scope`);
+		return null;
+	}
+	validateReplicationApplicationKeys(config, bucketId) {
+		if (!this.strictAuth || config === void 0) return null;
+		const replicationConfiguration = requestRecord(config);
+		const source = requestRecord(replicationConfiguration?.["asReplicationSource"]);
+		if (source !== null) {
+			const sourceApplicationKeyId = source["sourceApplicationKeyId"];
+			if (typeof sourceApplicationKeyId === "string") {
+				const sourceKeyError = this.validateReplicationApplicationKey(sourceApplicationKeyId, [Capability.ReadFiles, Capability.ListFiles], {
+					bucketId,
+					role: "replication source"
+				});
+				if (sourceKeyError !== null) return sourceKeyError;
+			}
+			const rules = source["replicationRules"];
+			if (typeof sourceApplicationKeyId === "string" && Array.isArray(rules)) {
+				const destinationError = this.validateReplicationDestinationBuckets(sourceApplicationKeyId, rules);
+				if (destinationError !== null) return destinationError;
+			}
+		}
+		const mapping = requestRecord(requestRecord(replicationConfiguration?.["asReplicationDestination"])?.["sourceToDestinationKeyMapping"]);
+		if (mapping !== null) for (const [sourceApplicationKeyId, destinationApplicationKeyId] of Object.entries(mapping)) {
+			const sourceKeyError = this.validateReplicationApplicationKey(sourceApplicationKeyId, [Capability.ReadFiles, Capability.ListFiles], { role: "replication source" });
+			if (sourceKeyError !== null) return sourceKeyError;
+			if (typeof destinationApplicationKeyId === "string") {
+				const destinationKeyError = this.validateReplicationApplicationKey(destinationApplicationKeyId, [Capability.WriteFiles], {
+					bucketId,
+					role: "replication destination"
+				});
+				if (destinationKeyError !== null) return destinationKeyError;
+			}
 		}
 		return null;
 	}
@@ -474,10 +1097,7 @@ var B2Simulator = class {
 		const directBucketId = requestStringField(body, "bucketId");
 		const directFileName = requestStringField(body, "fileName");
 		switch (endpoint) {
-			case "b2_create_bucket": return {
-				bucketIds: [],
-				requiresBucketScope: true
-			};
+			case "b2_create_bucket": return this.createBucketScope(body);
 			case "b2_list_buckets": return this.listBucketsScope(body, directBucketId);
 			case "b2_list_file_names":
 			case "b2_list_file_versions": return {
@@ -513,9 +1133,23 @@ var B2Simulator = class {
 			};
 			case "b2_get_bucket_notification_rules": return this.notificationRulesScope(body, directBucketId, false);
 			case "b2_set_bucket_notification_rules": return this.notificationRulesScope(body, directBucketId, true);
+			case "b2_update_bucket": return this.updateBucketScope(body, directBucketId);
 			default: return this.defaultRequestScope(directBucketId, directFileName);
 		}
 	}
+	createBucketScope(body) {
+		return {
+			bucketIds: replicationDestinationBucketIds(body),
+			requiresBucketScope: true,
+			requiresAccountLevelBucketAccess: true
+		};
+	}
+	updateBucketScope(body, directBucketId) {
+		return {
+			bucketIds: [...directBucketId === void 0 ? [] : [directBucketId], ...replicationDestinationBucketIds(body)],
+			requiresBucketScope: true
+		};
+	}
 	listBucketsScope(body, directBucketId) {
 		if (directBucketId !== void 0) return {
 			bucketIds: [directBucketId],
@@ -613,7 +1247,10 @@ var B2Simulator = class {
 		const idParam = options.kind === "file" ? "bucketId" : "fileId";
 		const scopedId = options.kind === "file" ? options.bucketId : options.fileId;
 		const uploadId = this.genId(options.kind === "file" ? "upload_file" : "upload_part");
-		const uploadUrl = new URL(`http://localhost:0/b2api/v3/${endpoint}`);
+		const uploadUrl = new URL(b2Url("http://localhost:0", {
+			version: "v3",
+			endpoint
+		}));
 		uploadUrl.searchParams.set(idParam, scopedId);
 		uploadUrl.searchParams.set("uploadId", uploadId);
 		const sourceToken = options.sourceAuthToken === void 0 ? void 0 : this.issuedTokens.get(options.sourceAuthToken);
@@ -686,40 +1323,61 @@ var B2Simulator = class {
 		}));
 	}
 	/**
-	* Look up the application key matching the `Authorization` header on
+	* Resolve the application key matching the `Authorization` header on
 	* an `authorize_account` request. The header is in the form
 	* `Basic base64(applicationKeyId:applicationKey)`.
 	*
-	* Returns `null` for the implicit master credential (anything that
-	* does not match a key minted via `b2_create_key`); in that case
-	* `authorize` grants the full master capability set.
+	* The simulator has two implicit full-access storage credentials:
+	* the documented `test-key-id:test-key` pair used by SDK tests and
+	* `master-key-id:master-key`. In default permissive mode, any other
+	* well-formed Basic credential whose applicationKeyId is not a stored
+	* key also receives that implicit master grant for backward
+	* compatibility. A credential whose applicationKeyId matches a stored
+	* key must use the stored secret and must not be expired.
 	*
 	* @param authzHeader - Raw HTTP `Authorization` header value.
 	*
-	* @returns The matching key's grant scope, or `null` for the master.
+	* @returns The authorizing key's grant scope or the rejection reason.
 	*/
-	findKeyForAuthHeader(authzHeader) {
-		if (!authzHeader?.startsWith("Basic ")) return null;
-		const decoded = (() => {
-			try {
-				return atob(authzHeader.slice(6));
-			} catch {
-				return null;
+	findAuthorizationGrant(authzHeader) {
+		const credentials = parseBasicAuthorizationHeader(authzHeader);
+		if (credentials === null) return { kind: "invalid" };
+		const stored = this.keys.get(credentials.applicationKeyId);
+		if (stored !== void 0) {
+			if (!timingSafeStringEqual(stored.applicationKey, credentials.applicationKey)) return { kind: "invalid" };
+			if (this.isStoredKeyExpired(stored)) return { kind: "expired" };
+			return {
+				kind: "ok",
+				grant: {
+					capabilities: stored.capabilities,
+					bucketIds: stored.bucketIds,
+					namePrefix: stored.namePrefix,
+					applicationKeyId: credentials.applicationKeyId,
+					accountId: stored.accountId,
+					expirationTimestamp: stored.expirationTimestamp
+				}
+			};
+		}
+		if (isSimulatorApplicationKeyId(credentials.applicationKeyId)) return { kind: "invalid" };
+		if (isImplicitStorageMasterCredential(credentials) || !this.strictAuth) return {
+			kind: "ok",
+			grant: {
+				capabilities: SIMULATOR_MASTER_CAPABILITIES,
+				bucketIds: null,
+				namePrefix: null,
+				applicationKeyId: null,
+				accountId: this.accountId,
+				expirationTimestamp: null
 			}
-		})();
-		if (decoded === null) return null;
-		const idx = decoded.indexOf(":");
-		if (idx === -1) return null;
-		const applicationKeyId = decoded.slice(0, idx);
-		const applicationKey = decoded.slice(idx + 1);
-		const stored = this.keys.get(applicationKeyId);
-		if (!stored || stored.applicationKey !== applicationKey) return null;
-		return {
-			capabilities: stored.capabilities,
-			bucketIds: stored.bucketIds,
-			namePrefix: stored.namePrefix,
-			applicationKeyId
 		};
+		return { kind: "invalid" };
+	}
+	canAuthorizePartner(authzHeader) {
+		const credentials = parseBasicAuthorizationHeader(authzHeader);
+		if (credentials === null) return false;
+		if (isImplicitPartnerMasterCredential(credentials)) return true;
+		const stored = this.keys.get(credentials.applicationKeyId);
+		return stored !== void 0 && stored.accountId === this.accountId && !this.isStoredKeyExpired(stored) && timingSafeStringEqual(stored.applicationKey, credentials.applicationKey);
 	}
 	/**
 	* Creates an {@link HttpTransport} that routes requests to this simulator.
@@ -811,7 +1469,7 @@ var B2Simulator = class {
 	}
 	/**
 	* Dispatches a JSON API request to the appropriate handler.
-	* @param _method - The HTTP method (unused).
+	* @param method - The HTTP method.
 	* @param origin - The request URL origin used for simulator-issued endpoints.
 	* @param path - The request URL path containing the B2 endpoint name.
 	* @param headers - The HTTP request headers; consulted by the
@@ -820,15 +1478,24 @@ var B2Simulator = class {
 	*
 	* @returns An object with HTTP status and JSON response body.
 	*/
-	async handleRequest(_method, origin, path, headers, body) {
-		const endpoint = path.split("/").pop() ?? "";
-		const apiVersion = path.match(/\/b2api\/(v\d+)\//)?.[1] ?? "v3";
-		if (this.strictAuth) {
+	async handleRequest(method, origin, path, headers, body) {
+		const { endpoint, version } = apiPathParts(path);
+		if (!jsonEndpointAllowsMethod(method, endpoint)) return this.error(405, "method_not_allowed", `${endpoint} does not support ${method.toUpperCase()}`);
+		if (this.strictAuth && !this.partner.isEndpoint(endpoint)) {
 			const authError = this.authorizeRequest(headers["authorization"], endpoint, this.requestScope(endpoint, body));
 			if (authError !== null) return authError;
 		}
 		switch (endpoint) {
-			case "b2_authorize_account": return this.authorize(headers["authorization"], origin);
+			case "b2_authorize_account":
+				if (version === "v3" && this.partner.isAuthorizeEnabled()) return this.partner.authorize(headers["authorization"], origin);
+				return this.authorize(headers["authorization"], origin);
+			case "b2_create_group_member": return this.partner.createGroupMember(body, headers["authorization"]);
+			case "b2_eject_group_member": return this.partner.ejectGroupMember(body, headers["authorization"]);
+			case "b2_list_groups": return this.partner.listGroups(body, headers["authorization"]);
+			case "b2_list_group_members": return this.partner.listGroupMembers(body, headers["authorization"]);
+			case "b2_reserve_trial_create_account": return this.partner.reserveTrialCreateAccount(body, headers["authorization"]);
+			case "bz_list_computers": return this.partner.listComputers(body, headers["authorization"]);
+			case "bz_delete_computer": return this.partner.deleteComputer(body, headers["authorization"]);
 			case "b2_create_bucket": return this.createBucket(body);
 			case "b2_list_buckets": return this.listBuckets(body);
 			case "b2_delete_bucket": return this.deleteBucket(body);
@@ -838,9 +1505,9 @@ var B2Simulator = class {
 			case "b2_list_file_versions": return this.listFileVersions(body);
 			case "b2_get_file_info": return this.getFileInfo(body);
 			case "b2_hide_file": return this.hideFile(body);
-			case "b2_delete_file_version": return this.deleteFileVersion(body);
+			case "b2_delete_file_version": return this.deleteFileVersion(body, headers["authorization"]);
 			case "b2_copy_file": return await this.copyFile(body);
-			case "b2_start_large_file": return this.startLargeFile(body);
+			case "b2_start_large_file": return await this.startLargeFile(body);
 			case "b2_get_upload_part_url": return await this.getUploadPartUrl(body, headers["authorization"]);
 			case "b2_finish_large_file": return this.finishLargeFile(body);
 			case "b2_cancel_large_file": return this.cancelLargeFile(body);
@@ -848,10 +1515,10 @@ var B2Simulator = class {
 			case "b2_list_parts": return this.listParts(body);
 			case "b2_copy_part": return await this.copyPart(body);
 			case "b2_get_download_authorization": return this.getDownloadAuthorization(body);
-			case "b2_create_key": return this.createKey(body, apiVersion);
+			case "b2_create_key": return this.createKey(body, version, headers["authorization"]);
 			case "b2_list_keys": return this.listKeys(body);
 			case "b2_delete_key": return this.deleteKey(body);
-			case "b2_update_file_retention": return this.updateFileRetention(body);
+			case "b2_update_file_retention": return this.updateFileRetention(body, headers["authorization"]);
 			case "b2_update_file_legal_hold": return this.updateFileLegalHold(body);
 			case "b2_get_bucket_notification_rules": return this.getBucketNotificationRules(body);
 			case "b2_set_bucket_notification_rules": return this.setBucketNotificationRules(body);
@@ -881,9 +1548,25 @@ var B2Simulator = class {
 		const fileName = kind === "part" || headers["x-bz-file-name"] === void 0 ? void 0 : decodeHeaderValue(headers["x-bz-file-name"]);
 		const authError = await this.validateUploadAuthorization(kind, url, headers["authorization"], fileName);
 		if (authError !== null) return authError;
+		const contentLengthError = this.validateContentLength(headers, data.byteLength);
+		if (contentLengthError !== null) return contentLengthError;
 		if (kind === "part") return await this.handleUploadPart(url, headers, data);
 		return await this.handleUploadFile(url, headers, data);
 	}
+	validateContentLength(headers, actualLength) {
+		const parsed = parseContentLengthHeader(headers);
+		if (parsed.kind === "absent") return null;
+		if (parsed.kind === "error") return this.error(400, "bad_request", parsed.message);
+		if (parsed.expectedLength !== actualLength) return this.error(400, "bad_request", contentLengthMismatchMessage(parsed.expectedLength, actualLength));
+		return null;
+	}
+	parseCustomUploadTimestamp(value) {
+		if (value === void 0 || value === null) return { timestamp: null };
+		if (!this.customUploadTimestampsEnabled) return this.error(400, "custom_timestamp_not_allowed", "Custom upload timestamps are not enabled for this account.");
+		const timestamp = typeof value === "string" && /^\d+$/.test(value) ? Number(value) : NaN;
+		if (!Number.isSafeInteger(timestamp) || timestamp < 0 || timestamp > this.now()) return this.error(400, "custom_timestamp_invalid", "The request has an invalid custom upload timestamp.");
+		return { timestamp };
+	}
 	/**
 	* Handles file download requests (`b2_download_file_by_id`, `/file/` by name).
 	* Returns the file data along with B2 response headers.
@@ -895,33 +1578,32 @@ var B2Simulator = class {
 	*/
 	handleDownload(path, headers, method = "GET") {
 		if (path.includes("b2_download_file_by_id")) {
+			const url = new URL(`http://localhost${path}`);
 			if (this.strictAuth) {
-				const url = new URL(`http://localhost${path}`);
-				const authError = this.authorizeRequest(headers["authorization"], "b2_download_file_by_id", this.fileIdScope(url.searchParams.get("fileId") ?? void 0) ?? {
+				const authError = this.authorizeDownloadRequest(this.downloadAuthorizationFromRequest(headers, url, { allowQueryAuthorization: false }), "b2_download_file_by_id", this.fileIdScope(url.searchParams.get("fileId") ?? void 0) ?? {
 					bucketIds: [],
 					requiresBucketScope: true
-				});
+				}, url);
 				if (authError !== null) return this.errorAsDownload(authError);
 			}
-			const url = new URL(`http://localhost${path}`);
 			const fileId = url.searchParams.get("fileId") ?? "";
-			return this.finalizeDownload(this.downloadById(fileId, headers["range"]), url, method);
+			return this.finalizeDownload(this.downloadById(fileId, headers, requestHeaderValue(headers, "range")), url, method);
 		}
 		const fileMatch = path.match(/^([^?]+)/)?.[1]?.match(/\/file\/([^/]+)\/(.+)/);
 		if (fileMatch) {
 			const bucketName = decodeURIComponent(fileMatch[1] ?? "");
 			const fileName = decodeURIComponent(fileMatch[2] ?? "");
+			const url = new URL(`http://localhost${path}`);
 			if (this.strictAuth) {
 				const bucket = [...this.buckets.values()].find((b) => b.info.bucketName === bucketName);
-				const authError = this.authorizeRequest(headers["authorization"], "b2_download_file_by_name", {
+				const authError = this.authorizeDownloadRequest(this.downloadAuthorizationFromRequest(headers, url, { allowQueryAuthorization: true }), "b2_download_file_by_name", {
 					bucketIds: bucket === void 0 ? [] : [bucket.info.bucketId],
 					fileNames: [fileName],
 					requiresBucketScope: true
-				});
+				}, url);
 				if (authError !== null) return this.errorAsDownload(authError);
 			}
-			const url = new URL(`http://localhost${path}`);
-			return this.finalizeDownload(this.downloadByName(bucketName, fileName, headers["range"]), url, method);
+			return this.finalizeDownload(this.downloadByName(bucketName, fileName, headers, requestHeaderValue(headers, "range")), url, method);
 		}
 		return {
 			status: 404,
@@ -958,16 +1640,8 @@ var B2Simulator = class {
 	* @returns The response with overrides applied.
 	*/
 	finalizeDownload(response, url, method) {
-		const overrideMap = {
-			b2ContentDisposition: "Content-Disposition",
-			b2ContentLanguage: "Content-Language",
-			b2ContentEncoding: "Content-Encoding",
-			b2ContentType: "Content-Type",
-			b2CacheControl: "Cache-Control",
-			b2Expires: "Expires"
-		};
 		const newHeaders = { ...response.headers };
-		for (const [param, header] of Object.entries(overrideMap)) {
+		for (const [param, header] of Object.entries(DOWNLOAD_RESPONSE_OVERRIDE_HEADERS)) {
 			const value = url.searchParams.get(param);
 			if (value !== null) newHeaders[header] = value;
 		}
@@ -993,6 +1667,10 @@ var B2Simulator = class {
 		const resolved = await this.resolveUploadSha1(headers["x-bz-content-sha1"], data);
 		if ("status" in resolved) return resolved;
 		const { sha1: contentSha1, data: storedData } = resolved;
+		const serverSideEncryption = await uploadServerSideEncryption(headers, bucket.info.defaultServerSideEncryption);
+		if ("status" in serverSideEncryption) return serverSideEncryption;
+		const customUploadTimestamp = this.parseCustomUploadTimestamp(requestHeaderValue(headers, "x-bz-custom-upload-timestamp"));
+		if ("status" in customUploadTimestamp) return customUploadTimestamp;
 		const fileVersion = this.makeFileVersion({
 			bucketId,
 			fileName,
@@ -1001,11 +1679,14 @@ var B2Simulator = class {
 			contentSha1,
 			fileInfo,
 			action: FileAction.Upload,
-			serverSideEncryption: uploadServerSideEncryption(headers, bucket.info.defaultServerSideEncryption)
+			serverSideEncryption,
+			...this.newReplicationStatusField(bucketId, fileName),
+			...customUploadTimestamp.timestamp !== null ? { uploadTimestamp: customUploadTimestamp.timestamp } : {}
 		});
 		const stored = {
 			fileVersion,
-			data: storedData
+			data: storedData,
+			serverSideEncryption
 		};
 		const existing = bucket.files.get(fileName);
 		if (existing) existing.push(stored);
@@ -1055,18 +1736,39 @@ var B2Simulator = class {
 			data
 		};
 	}
+	async validateUploadPartEncryption(large, headers) {
+		if (large.serverSideEncryption.mode !== EncryptionMode.SseC) {
+			if (!hasCustomerEncryptionHeaders(headers)) return null;
+			return this.error(400, "bad_request", "SSE-C upload part headers require an SSE-C large file");
+		}
+		const supplied = await storedServerSideEncryption({
+			mode: EncryptionMode.SseC,
+			algorithm: headers["x-bz-server-side-encryption-customer-algorithm"],
+			customerKey: headers["x-bz-server-side-encryption-customer-key"],
+			customerKeyMd5: headers["x-bz-server-side-encryption-customer-key-md5"]
+		});
+		if ("status" in supplied) return supplied;
+		if (!sameStoredServerSideEncryption(large.serverSideEncryption, supplied)) return this.error(400, "bad_request", "SSE-C upload parts require matching customer encryption headers");
+		return null;
+	}
 	async handleUploadPart(url, headers, data) {
 		const fileId = new URL(url).searchParams.get("fileId");
 		if (!fileId) return this.error(400, "bad_request", "Missing fileId");
 		const large = this.largeFiles.get(fileId);
 		if (!large) return this.error(400, "bad_request", "Large file not found");
-		const partNumber = Number.parseInt(headers["x-bz-part-number"] ?? "0", 10);
+		const partNumber = this.parsePartNumberHeader(requestHeaderValue(headers, "x-bz-part-number"));
+		if (typeof partNumber !== "number") return partNumber;
+		const encryptionError = await this.validateUploadPartEncryption(large, headers);
+		if (encryptionError !== null) return encryptionError;
 		const resolved = await this.resolveUploadSha1(headers["x-bz-content-sha1"], data);
 		if ("status" in resolved) return resolved;
 		const { sha1, data: partData } = resolved;
+		const uploadTimestamp = this.monotonicTimestamp();
 		large.parts.set(partNumber, {
 			data: partData,
-			sha1
+			sha1,
+			contentMd5: null,
+			uploadTimestamp
 		});
 		return {
 			status: 200,
@@ -1075,21 +1777,32 @@ var B2Simulator = class {
 				partNumber,
 				contentLength: partData.byteLength,
 				contentSha1: sha1,
+				contentMd5: null,
 				serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
-				uploadTimestamp: Date.now()
+				uploadTimestamp
 			}
 		};
 	}
-	downloadById(fileId, range) {
+	parsePartNumberHeader(header) {
+		if (header === void 0) return this.error(400, "bad_request", "X-Bz-Part-Number header is required");
+		if (!/^\d+$/.test(header)) return this.error(400, "bad_request", `X-Bz-Part-Number must be an integer between ${B2_MIN_PART_NUMBER} and ${B2_MAX_PART_NUMBER}; received ${header}`);
+		const partNumber = Number(header);
+		return this.validatePartNumber(partNumber) ?? partNumber;
+	}
+	validatePartNumber(partNumber) {
+		if (Number.isInteger(partNumber) && partNumber >= B2_MIN_PART_NUMBER && partNumber <= B2_MAX_PART_NUMBER) return null;
+		return this.error(400, "bad_request", `partNumber must be an integer between ${B2_MIN_PART_NUMBER} and ${B2_MAX_PART_NUMBER}; received ${String(partNumber)}`);
+	}
+	downloadById(fileId, headers, range) {
 		const found = this.findFile(fileId);
 		if (found === null) return {
 			status: 404,
 			headers: {},
 			data: null
 		};
-		return this.serveFile(found.stored, range);
+		return this.serveFile(found.stored, headers, range);
 	}
-	downloadByName(bucketName, fileName, range) {
+	downloadByName(bucketName, fileName, headers, range) {
 		for (const bucket of this.buckets.values()) {
 			if (bucket.info.bucketName !== bucketName) continue;
 			const versions = bucket.files.get(fileName);
@@ -1100,7 +1813,7 @@ var B2Simulator = class {
 				headers: {},
 				data: null
 			};
-			return this.serveFile(latest, range);
+			return this.serveFile(latest, headers, range);
 		}
 		return {
 			status: 404,
@@ -1108,7 +1821,41 @@ var B2Simulator = class {
 			data: null
 		};
 	}
-	serveFile(stored, range) {
+	validateDownloadEncryption(stored, headers) {
+		const encryption = stored.serverSideEncryption;
+		if (encryption.mode !== EncryptionMode.SseC) return null;
+		const algorithm = headers["x-bz-server-side-encryption-customer-algorithm"];
+		const customerKey = headers["x-bz-server-side-encryption-customer-key"];
+		const customerKeyMd5 = headers["x-bz-server-side-encryption-customer-key-md5"];
+		const customerKeyBytes = customerKey === void 0 ? null : base64ToBytes(customerKey, 32);
+		const normalizedCustomerKeyMd5 = customerKeyMd5 === void 0 ? null : normalizeSizedBase64(customerKeyMd5, 16);
+		if (algorithm !== encryption.algorithm || customerKeyBytes === null || normalizedCustomerKeyMd5 === null || md5Base64Sync(customerKeyBytes) !== normalizedCustomerKeyMd5) return this.errorAsDownload(this.error(400, "bad_request", "SSE-C downloads require matching customer encryption headers"));
+		if (normalizedCustomerKeyMd5 !== encryption.customerKeyMd5 || customerKeyDigest(customerKeyBytes) !== encryption.customerKeyDigest) return this.errorAsDownload(this.error(403, "access_denied", "SSE-C customer encryption key does not match the stored file"));
+		return null;
+	}
+	async validateSourceServerSideEncryption(stored, encryption) {
+		const expected = stored.serverSideEncryption;
+		if (expected.mode !== EncryptionMode.SseC) return null;
+		if (encryption?.mode !== EncryptionMode.SseC) return this.error(400, "bad_request", "SSE-C source copies require customer encryption");
+		const supplied = await storedServerSideEncryption(encryption);
+		if ("status" in supplied) return supplied;
+		if (!sameStoredServerSideEncryption(expected, supplied)) return this.error(400, "bad_request", "SSE-C source customer encryption does not match");
+		return null;
+	}
+	async resolveCopyDestinationEncryption(destinationBucket, requested) {
+		if (requested !== void 0) return await storedServerSideEncryption(requested);
+		return await storedServerSideEncryption(destinationBucket.info.defaultServerSideEncryption);
+	}
+	async validateCopyPartDestinationEncryption(large, encryption) {
+		if (encryption === void 0) return large.serverSideEncryption.mode === EncryptionMode.SseC ? this.error(400, "bad_request", "SSE-C destination copies require customer encryption") : null;
+		const supplied = await storedServerSideEncryption(encryption);
+		if ("status" in supplied) return supplied;
+		if (!sameStoredServerSideEncryption(large.serverSideEncryption, supplied)) return this.error(400, "bad_request", "Destination server-side encryption does not match");
+		return null;
+	}
+	serveFile(stored, requestHeaders, range) {
+		const encryptionError = this.validateDownloadEncryption(stored, requestHeaders);
+		if (encryptionError !== null) return encryptionError;
 		const fullData = stored.data;
 		let data = fullData;
 		let status = 200;
@@ -1139,6 +1886,10 @@ var B2Simulator = class {
 		};
 		for (const [key, value] of Object.entries(fv.fileInfo)) headers[`X-Bz-Info-${encodeFileName(key)}`] = encodeFileName(value);
 		if (!("src_last_modified_millis" in fv.fileInfo)) headers["X-Bz-Info-src_last_modified_millis"] = String(fv.uploadTimestamp);
+		const unauthorizedToRead = [];
+		this.addDownloadEncryptionHeaders(headers, stored.serverSideEncryption, requestHeaders, unauthorizedToRead);
+		this.addDownloadObjectLockHeaders(headers, fv, requestHeaders, unauthorizedToRead);
+		if (unauthorizedToRead.length > 0) headers[DownloadHeaderName.ClientUnauthorizedToRead] = unauthorizedToRead.join(",");
 		if (contentRange !== null) headers["Content-Range"] = contentRange;
 		return {
 			status,
@@ -1146,39 +1897,58 @@ var B2Simulator = class {
 			data
 		};
 	}
+	addDownloadEncryptionHeaders(headers, encryption, requestHeaders, unauthorizedToRead) {
+		if (encryption.mode === EncryptionMode.None) return;
+		if (!this.requestHasCapability(requestHeaderValue(requestHeaders, "authorization"), Capability.ReadBucketEncryption)) {
+			if (encryption.mode === EncryptionMode.SseB2) unauthorizedToRead.push(DownloadClientUnauthorizedToReadMarker.ServerSideEncryption);
+			else unauthorizedToRead.push(DownloadClientUnauthorizedToReadMarker.ServerSideEncryptionCustomerAlgorithm, DownloadClientUnauthorizedToReadMarker.ServerSideEncryptionCustomerKeyMd5);
+			return;
+		}
+		if (encryption.mode === EncryptionMode.SseB2) {
+			headers[DownloadHeaderName.ServerSideEncryption] = encryption.algorithm;
+			return;
+		}
+		headers[DownloadHeaderName.ServerSideEncryptionCustomerAlgorithm] = encryption.algorithm;
+		headers[DownloadHeaderName.ServerSideEncryptionCustomerKeyMd5] = encryption.customerKeyMd5;
+	}
+	addDownloadObjectLockHeaders(headers, fileVersion, requestHeaders, unauthorizedToRead) {
+		const authToken = requestHeaderValue(requestHeaders, "authorization");
+		const retention = fileVersion.fileRetention.value;
+		if (retention !== null && retention.mode !== null && retention.retainUntilTimestamp !== null) {
+			if (this.requestHasCapability(authToken, Capability.ReadFileRetentions)) {
+				headers[DownloadHeaderName.FileRetentionMode] = retention.mode;
+				headers[DownloadHeaderName.FileRetentionRetainUntilTimestamp] = String(retention.retainUntilTimestamp);
+			} else unauthorizedToRead.push(DownloadClientUnauthorizedToReadMarker.FileRetentionMode, DownloadClientUnauthorizedToReadMarker.FileRetentionRetainUntilTimestamp);
+		}
+		const legalHold = fileVersion.legalHold.value;
+		if (legalHold === null) return;
+		if (this.requestHasCapability(authToken, Capability.ReadFileLegalHolds)) {
+			headers[DownloadHeaderName.FileLegalHold] = legalHold;
+			return;
+		}
+		unauthorizedToRead.push(DownloadClientUnauthorizedToReadMarker.FileLegalHold);
+	}
 	authorize(authzHeader, origin = "http://localhost:0") {
-		const capabilities = [
-			Capability.ListBuckets,
-			Capability.ReadBuckets,
-			Capability.WriteBuckets,
-			Capability.DeleteBuckets,
-			Capability.ListFiles,
-			Capability.ReadFiles,
-			Capability.WriteFiles,
-			Capability.DeleteFiles,
-			Capability.ListKeys,
-			Capability.WriteKeys,
-			Capability.DeleteKeys,
-			Capability.ShareFiles,
-			Capability.ReadBucketNotifications,
-			Capability.WriteBucketNotifications
-		];
-		const keyForAuth = this.findKeyForAuthHeader(authzHeader);
-		const allowedBuckets = this.allowedBuckets(keyForAuth?.bucketIds);
-		const legacyBucketId = singleBucketId(keyForAuth?.bucketIds);
+		const resolution = this.findAuthorizationGrant(authzHeader);
+		if (resolution.kind === "invalid") return this.error(401, "unauthorized", "application key is not valid");
+		if (resolution.kind === "expired") return this.error(401, "unauthorized", "application key is expired");
+		const { grant } = resolution;
+		const allowedBuckets = this.allowedBuckets(grant.bucketIds);
+		const legacyBucketId = singleBucketId(grant.bucketIds);
 		const legacyBucketName = legacyBucketId === null ? null : this.buckets.get(legacyBucketId)?.info.bucketName ?? null;
 		const tokenStr = `sim_auth_token_${this.nextId++}`;
 		this.issuedTokens.set(tokenStr, {
-			capabilities: keyForAuth?.capabilities ?? capabilities,
-			bucketIds: keyForAuth?.bucketIds ?? null,
-			namePrefix: keyForAuth?.namePrefix ?? null,
+			accountId: grant.accountId,
+			capabilities: grant.capabilities,
+			bucketIds: grant.bucketIds,
+			namePrefix: grant.namePrefix,
 			expiresAt: this.now() + this.authTokenTtlMs,
-			applicationKeyId: keyForAuth?.applicationKeyId ?? null
+			applicationKeyId: grant.applicationKeyId
 		});
 		return {
 			status: 200,
 			body: {
-				accountId: accountId(this.accountId),
+				accountId: accountId(grant.accountId),
 				authorizationToken: tokenStr,
 				apiInfo: { storageApi: {
 					absoluteMinimumPartSize: this.minimumPartSize,
@@ -1187,28 +1957,30 @@ var B2Simulator = class {
 					bucketName: legacyBucketName,
 					downloadUrl: origin,
 					infoType: "storageApi",
-					namePrefix: keyForAuth?.namePrefix ?? null,
+					namePrefix: grant.namePrefix,
 					recommendedPartSize: this.recommendedPartSize,
 					s3ApiUrl: origin,
 					allowed: {
-						capabilities: keyForAuth?.capabilities ?? capabilities,
+						capabilities: cloneCapabilities(grant.capabilities),
 						buckets: allowedBuckets,
 						bucketId: legacyBucketId === null ? null : bucketId(legacyBucketId),
 						bucketName: legacyBucketName,
-						namePrefix: keyForAuth?.namePrefix ?? null
+						namePrefix: grant.namePrefix
 					}
 				} },
-				applicationKeyExpirationTimestamp: null
+				applicationKeyExpirationTimestamp: grant.expirationTimestamp
 			}
 		};
 	}
 	createBucket(req) {
 		const nameError = validateBucketName(req.bucketName);
 		if (nameError) return this.error(400, nameError.code, nameError.message);
-		if (req.bucketInfo !== void 0) {
-			const infoError = validateBucketInfo(req.bucketInfo);
-			if (infoError) return this.error(400, infoError.code, infoError.message);
-		}
+		const objectLockEnabled = nextObjectLockEnabled(false, req.fileLockEnabled);
+		if (typeof objectLockEnabled !== "boolean") return this.error(400, objectLockEnabled.code, objectLockEnabled.message);
+		const configError = validateBucketConfigurationFields(req, { objectLockEnabled });
+		if (configError) return this.error(400, configError.code, configError.message);
+		const replicationKeyError = this.validateReplicationApplicationKeys(req.replicationConfiguration, void 0);
+		if (replicationKeyError !== null) return replicationKeyError;
 		for (const b of this.buckets.values()) if (b.info.bucketName === req.bucketName) return this.error(400, "duplicate_bucket_name", "Bucket name already in use");
 		const bid = bucketId(this.genId("b2_bucket"));
 		const defaultRetention = req.defaultRetention ?? {
@@ -1226,7 +1998,7 @@ var B2Simulator = class {
 			fileLockConfiguration: {
 				isClientAuthorizedToRead: true,
 				value: {
-					isFileLockEnabled: req.fileLockEnabled ?? false,
+					isFileLockEnabled: objectLockEnabled,
 					defaultRetention
 				}
 			},
@@ -1234,10 +2006,10 @@ var B2Simulator = class {
 			options: [],
 			revision: 1,
 			defaultRetention,
-			replicationConfiguration: req.replicationConfiguration ?? {
+			replicationConfiguration: req.replicationConfiguration === void 0 ? {
 				asReplicationSource: null,
 				asReplicationDestination: null
-			}
+			} : normalizeReplicationConfiguration(req.replicationConfiguration)
 		};
 		this.buckets.set(bid, {
 			info,
@@ -1249,6 +2021,8 @@ var B2Simulator = class {
 		};
 	}
 	listBuckets(req) {
+		const bucketTypesError = validateBucketTypes(req.bucketTypes);
+		if (bucketTypesError) return this.error(400, bucketTypesError.code, bucketTypesError.message);
 		return {
 			status: 200,
 			body: { buckets: [...this.buckets.values()].map((b) => b.info).filter((bucket) => req.bucketId === void 0 || bucket.bucketId === req.bucketId).filter((bucket) => req.bucketName === void 0 || bucket.bucketName === req.bucketName).filter((bucket) => req.bucketTypes === void 0 || req.bucketTypes.includes(bucket.bucketType)) }
@@ -1257,36 +2031,62 @@ var B2Simulator = class {
 	deleteBucket(req) {
 		const bucket = this.buckets.get(req.bucketId);
 		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
+		if (this.bucketHasContents(bucket)) return this.error(400, "cannot_delete_non_empty_bucket", "Bucket is not empty and cannot be deleted");
 		this.buckets.delete(req.bucketId);
 		return {
 			status: 200,
 			body: bucket.info
 		};
 	}
+	bucketHasContents(bucket) {
+		for (const versions of bucket.files.values()) if (versions.length > 0) return true;
+		for (const large of this.largeFiles.values()) if (large.bucketId === bucket.info.bucketId) return true;
+		return false;
+	}
 	updateBucket(req) {
 		const bucket = this.buckets.get(req["bucketId"]);
 		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
-		if (req["bucketInfo"] !== void 0) {
-			const infoError = validateBucketInfo(req["bucketInfo"]);
-			if (infoError) return this.error(400, infoError.code, infoError.message);
+		const revisionGuard = req["ifRevisionIs"];
+		if (revisionGuard !== void 0) {
+			if (typeof revisionGuard !== "number" || !Number.isInteger(revisionGuard)) return this.error(400, "bad_request", "ifRevisionIs must be an integer");
+			if (revisionGuard !== bucket.info.revision) return this.error(409, "conflict", "ifRevisionIs test failed");
 		}
+		const objectLockEnabled = nextObjectLockEnabled(bucket.info.fileLockConfiguration.value?.isFileLockEnabled ?? false, req["fileLockEnabled"]);
+		if (typeof objectLockEnabled !== "boolean") return this.error(400, objectLockEnabled.code, objectLockEnabled.message);
+		const configError = validateBucketConfigurationFields({
+			bucketInfo: req["bucketInfo"],
+			corsRules: req["corsRules"],
+			defaultRetention: req["defaultRetention"],
+			lifecycleRules: req["lifecycleRules"],
+			replicationConfiguration: req["replicationConfiguration"]
+		}, { objectLockEnabled });
+		if (configError) return this.error(400, configError.code, configError.message);
+		const replicationKeyError = this.validateReplicationApplicationKeys(req["replicationConfiguration"], req["bucketId"]);
+		if (replicationKeyError !== null) return replicationKeyError;
 		const updated = {
 			...bucket.info,
 			...req["bucketType"] !== void 0 ? { bucketType: req["bucketType"] } : {},
 			...req["bucketInfo"] !== void 0 ? { bucketInfo: req["bucketInfo"] } : {},
 			...req["lifecycleRules"] !== void 0 ? { lifecycleRules: req["lifecycleRules"] } : {},
 			...req["corsRules"] !== void 0 ? { corsRules: req["corsRules"] } : {},
-			...req["replicationConfiguration"] !== void 0 ? { replicationConfiguration: req["replicationConfiguration"] } : {},
+			...req["replicationConfiguration"] !== void 0 ? { replicationConfiguration: normalizeReplicationConfiguration(req["replicationConfiguration"]) } : {},
 			...req["defaultRetention"] !== void 0 ? {
 				defaultRetention: req["defaultRetention"],
 				fileLockConfiguration: {
 					isClientAuthorizedToRead: true,
 					value: {
-						isFileLockEnabled: bucket.info.fileLockConfiguration.value?.isFileLockEnabled ?? false,
+						isFileLockEnabled: objectLockEnabled,
 						defaultRetention: req["defaultRetention"]
 					}
 				}
 			} : {},
+			...req["fileLockEnabled"] !== void 0 && req["defaultRetention"] === void 0 ? { fileLockConfiguration: {
+				isClientAuthorizedToRead: true,
+				value: {
+					isFileLockEnabled: objectLockEnabled,
+					defaultRetention: bucket.info.defaultRetention
+				}
+			} } : {},
 			...req["defaultServerSideEncryption"] !== void 0 ? { defaultServerSideEncryption: req["defaultServerSideEncryption"] } : {},
 			revision: bucket.info.revision + 1
 		};
@@ -1393,7 +2193,8 @@ var B2Simulator = class {
 		const existing = bucket.files.get(req.fileName);
 		const stored = {
 			fileVersion,
-			data: /* @__PURE__ */ new Uint8Array(0)
+			data: /* @__PURE__ */ new Uint8Array(0),
+			serverSideEncryption: { mode: EncryptionMode.None }
 		};
 		if (existing) existing.push(stored);
 		else bucket.files.set(req.fileName, [stored]);
@@ -1402,16 +2203,19 @@ var B2Simulator = class {
 			body: fileVersion
 		};
 	}
-	deleteFileVersion(req) {
+	deleteFileVersion(req, authToken) {
 		const found = this.findFile(req.fileId);
 		if (found === null || found.stored.fileVersion.fileName !== req.fileName) return this.error(400, "file_not_present", "File version not found");
 		const fv = found.stored.fileVersion;
 		const retention = fv.fileRetention?.value;
 		const legalHold = fv.legalHold?.value;
 		const now = Date.now();
-		if (legalHold === "on") return this.error(400, "file_lock_legal_hold_protected", "File is on legal hold and cannot be deleted");
-		if (retention?.mode === "compliance" && retention.retainUntilTimestamp !== null && retention.retainUntilTimestamp > now) return this.error(400, "file_lock_compliance_protected", `File is under compliance-mode retention and cannot be deleted until ${new Date(retention.retainUntilTimestamp).toISOString()}`);
-		if (retention?.mode === "governance" && retention.retainUntilTimestamp !== null && retention.retainUntilTimestamp > now && req.bypassGovernance !== true) return this.error(400, "file_lock_governance_protected", "File is under governance-mode retention; pass bypassGovernance: true to delete");
+		if (legalHold === LegalHoldValue.On) return this.error(400, "file_lock_legal_hold_protected", "File is on legal hold and cannot be deleted");
+		if (retention?.mode === RetentionMode.Compliance && retention.retainUntilTimestamp !== null && retention.retainUntilTimestamp > now) return this.error(400, "file_lock_compliance_protected", `File is under compliance-mode retention and cannot be deleted until ${new Date(retention.retainUntilTimestamp).toISOString()}`);
+		if (retention?.mode === RetentionMode.Governance && retention.retainUntilTimestamp !== null && retention.retainUntilTimestamp > now) {
+			const bypassError = this.requireGovernanceBypass(req, authToken, "File is under governance-mode retention; pass bypassGovernance: true to delete");
+			if (bypassError !== null) return bypassError;
+		}
 		found.versions.splice(found.index, 1);
 		if (found.versions.length === 0) found.bucket.files.delete(req.fileName);
 		return {
@@ -1431,6 +2235,10 @@ var B2Simulator = class {
 		const destBucketId = req.destinationBucketId ?? found.bucketId;
 		const destBucket = this.buckets.get(destBucketId);
 		if (!destBucket) return this.error(400, "bad_bucket_id", "Destination bucket not found");
+		const sourceEncryptionError = await this.validateSourceServerSideEncryption(sourceStored, req.sourceServerSideEncryption);
+		if (sourceEncryptionError !== null) return sourceEncryptionError;
+		const destinationEncryption = await this.resolveCopyDestinationEncryption(destBucket, req.destinationServerSideEncryption);
+		if ("status" in destinationEncryption) return destinationEncryption;
 		let data = sourceStored.data;
 		let contentSha1 = sourceStored.fileVersion.contentSha1 ?? "none";
 		if (req.range !== void 0) {
@@ -1463,11 +2271,14 @@ var B2Simulator = class {
 			contentLength: data.byteLength,
 			contentSha1,
 			fileInfo,
-			action: FileAction.Copy
+			action: FileAction.Copy,
+			serverSideEncryption: destinationEncryption,
+			...this.newReplicationStatusField(destBucketId, req.fileName)
 		});
 		const copied = {
 			fileVersion,
-			data: new Uint8Array(data)
+			data: new Uint8Array(data),
+			serverSideEncryption: destinationEncryption
 		};
 		const existing = destBucket.files.get(req.fileName);
 		if (existing) existing.push(copied);
@@ -1478,7 +2289,7 @@ var B2Simulator = class {
 			body: fileVersion
 		};
 	}
-	startLargeFile(req) {
+	async startLargeFile(req) {
 		const bucket = this.buckets.get(req.bucketId);
 		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
 		const nameError = validateFileName(req.fileName);
@@ -1487,8 +2298,13 @@ var B2Simulator = class {
 			const infoError = validateFileInfo(req.fileInfo);
 			if (infoError) return this.error(400, infoError.code, infoError.message);
 		}
+		const customUploadTimestamp = this.parseCustomUploadTimestamp(req.customUploadTimestamp);
+		if ("status" in customUploadTimestamp) return customUploadTimestamp;
 		const fid = this.genId("4_z");
-		const uploadTimestamp = this.monotonicTimestamp();
+		const uploadTimestamp = customUploadTimestamp.timestamp ?? this.monotonicTimestamp();
+		const serverSideEncryption = await storedServerSideEncryption(req.serverSideEncryption ?? bucket.info.defaultServerSideEncryption);
+		if ("status" in serverSideEncryption) return serverSideEncryption;
+		const replicationStatus = this.replicationStatusForNewFile(req.bucketId, req.fileName);
 		const large = {
 			fileId: fid,
 			bucketId: req.bucketId,
@@ -1497,7 +2313,8 @@ var B2Simulator = class {
 			fileInfo: req.fileInfo ?? {},
 			fileRetention: req.fileRetention ?? defaultFileRetention(bucket.info.defaultRetention, uploadTimestamp),
 			legalHold: req.legalHold ?? null,
-			serverSideEncryption: req.serverSideEncryption ?? bucket.info.defaultServerSideEncryption,
+			...this.replicationStatusMetadataFor(replicationStatus),
+			serverSideEncryption,
 			uploadTimestamp,
 			parts: /* @__PURE__ */ new Map()
 		};
@@ -1523,6 +2340,7 @@ var B2Simulator = class {
 					isClientAuthorizedToRead: true,
 					value: large.legalHold
 				},
+				...this.replicationStatusMetadataFor(large.replicationStatus),
 				serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
 				uploadTimestamp: large.uploadTimestamp
 			}
@@ -1552,17 +2370,11 @@ var B2Simulator = class {
 		const bucket = this.buckets.get(large.bucketId);
 		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
 		const sortedParts = [...large.parts.entries()].sort((a, b) => a[0] - b[0]);
-		if (sortedParts.length > 1e4) return this.error(400, "bad_request", `multipart upload has ${sortedParts.length} parts; B2 caps at 10000`);
-		for (const [partNumber] of sortedParts) if (!Number.isInteger(partNumber) || partNumber < 1 || partNumber > 1e4) return this.error(400, "bad_request", `partNumber ${partNumber} is outside the [1, 10000] range B2 accepts`);
+		if (sortedParts.length > B2_MAX_PART_NUMBER) return this.error(400, "bad_request", `multipart upload has ${sortedParts.length} parts; B2 caps at ${B2_MAX_PART_NUMBER}`);
+		for (const [partNumber] of sortedParts) if (!Number.isInteger(partNumber) || partNumber < B2_MIN_PART_NUMBER || partNumber > B2_MAX_PART_NUMBER) return this.error(400, "bad_request", `partNumber ${partNumber} is outside the [${B2_MIN_PART_NUMBER}, ${B2_MAX_PART_NUMBER}] range B2 accepts`);
 		if (req.partSha1Array.length !== sortedParts.length) return this.error(400, "bad_request", `partSha1Array has ${req.partSha1Array.length} entries but ${sortedParts.length} parts were uploaded`);
-		for (let i = 0; i < sortedParts.length; i++) {
-			const [partNumber, part] = sortedParts[i];
-			if (req.partSha1Array[i]?.toLowerCase() !== part.sha1) return this.error(400, "bad_request", `part ${partNumber} SHA-1 does not match the uploaded part`);
-		}
-		for (let i = 0; i < sortedParts.length - 1; i++) {
-			const [partNumber, part] = sortedParts[i];
-			if (part.data.byteLength < this.minimumPartSize) return this.error(400, "bad_request", `part ${partNumber} (${part.data.byteLength} bytes) is smaller than the minimum part size of ${this.minimumPartSize}`);
-		}
+		for (const [i, [partNumber, part]] of sortedParts.entries()) if (req.partSha1Array[i]?.toLowerCase() !== part.sha1) return this.error(400, "bad_request", `part ${partNumber} SHA-1 does not match the uploaded part`);
+		for (const [partNumber, part] of sortedParts.slice(0, -1)) if (part.data.byteLength < this.minimumPartSize) return this.error(400, "bad_request", `part ${partNumber} (${part.data.byteLength} bytes) is smaller than the minimum part size of ${this.minimumPartSize}`);
 		let totalSize = 0;
 		for (const [_, part] of sortedParts) totalSize += part.data.byteLength;
 		const combined = new Uint8Array(totalSize);
@@ -1581,11 +2393,14 @@ var B2Simulator = class {
 			action: FileAction.Upload,
 			fileRetention: large.fileRetention,
 			legalHold: large.legalHold,
-			serverSideEncryption: large.serverSideEncryption
+			serverSideEncryption: large.serverSideEncryption,
+			uploadTimestamp: large.uploadTimestamp,
+			...this.replicationStatusMetadataFor(large.replicationStatus)
 		});
 		const stored = {
 			fileVersion,
-			data: combined
+			data: combined,
+			serverSideEncryption: large.serverSideEncryption
 		};
 		const existing = bucket.files.get(large.fileName);
 		if (existing) existing.push(stored);
@@ -1644,6 +2459,7 @@ var B2Simulator = class {
 						isClientAuthorizedToRead: true,
 						value: f.legalHold
 					},
+					...this.replicationStatusMetadataFor(f.replicationStatus),
 					serverSideEncryption: publicServerSideEncryption(f.serverSideEncryption),
 					uploadTimestamp: f.uploadTimestamp
 				})),
@@ -1663,7 +2479,9 @@ var B2Simulator = class {
 			partNumber,
 			contentLength: part.data.byteLength,
 			contentSha1: part.sha1,
-			uploadTimestamp: Date.now()
+			contentMd5: part.contentMd5,
+			serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
+			uploadTimestamp: part.uploadTimestamp
 		}));
 		return {
 			status: 200,
@@ -1676,22 +2494,29 @@ var B2Simulator = class {
 	async copyPart(req) {
 		const large = this.largeFiles.get(req.largeFileId);
 		if (!large) return this.error(400, "bad_request", "Large file not found");
+		const partNumberError = this.validatePartNumber(req.partNumber);
+		if (partNumberError !== null) return partNumberError;
 		const found = this.findFile(req.sourceFileId);
 		if (found === null) return this.error(404, "file_not_present", "Source file not found");
 		const sourceStored = found.stored;
+		const sourceEncryptionError = await this.validateSourceServerSideEncryption(sourceStored, req.sourceServerSideEncryption);
+		if (sourceEncryptionError !== null) return sourceEncryptionError;
+		const destinationEncryptionError = await this.validateCopyPartDestinationEncryption(large, req.destinationServerSideEncryption);
+		if (destinationEncryptionError !== null) return destinationEncryptionError;
 		let partData = sourceStored.data;
-		if (req.range) {
-			const match = req.range.match(/bytes=(\d+)-(\d+)?/);
-			if (match) {
-				const rs = Number.parseInt(match[1] ?? "0", 10);
-				const re = match[2] !== void 0 ? Number.parseInt(match[2], 10) : sourceStored.data.byteLength - 1;
-				partData = sourceStored.data.slice(rs, re + 1);
-			}
+		if (req.range !== void 0) {
+			const parsed = parseRangeHeader(req.range, sourceStored.data.byteLength);
+			if (parsed.kind === "malformed") return this.error(400, "bad_request", `Malformed copy range: ${req.range}`);
+			if (parsed.kind === "unsatisfiable") return this.error(416, "range_not_satisfiable", `Unsatisfiable copy range: ${req.range}`);
+			partData = sourceStored.data.subarray(parsed.start, parsed.end + 1);
 		}
 		const sha1 = await sha1Hex(partData);
+		const uploadTimestamp = this.monotonicTimestamp();
 		large.parts.set(req.partNumber, {
 			data: new Uint8Array(partData),
-			sha1
+			sha1,
+			contentMd5: null,
+			uploadTimestamp
 		});
 		return {
 			status: 200,
@@ -1699,39 +2524,80 @@ var B2Simulator = class {
 				fileId: req.largeFileId,
 				partNumber: req.partNumber,
 				contentLength: partData.byteLength,
-				contentSha1: sha1
+				contentSha1: sha1,
+				contentMd5: null,
+				serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
+				uploadTimestamp
 			}
 		};
 	}
 	getDownloadAuthorization(req) {
+		this.purgeExpiredDownloadAuthorizationTokens();
 		if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const prefixError = validateDownloadAuthorizationPrefix(req.fileNamePrefix);
+		if (prefixError) return this.error(400, prefixError.code, prefixError.message);
+		const durationError = validateDownloadAuthorizationDuration(req.validDurationInSeconds);
+		if (durationError) return this.error(400, durationError.code, durationError.message);
+		const overrideError = validateDownloadResponseOverrides(req);
+		if (overrideError) return this.error(400, overrideError.code, overrideError.message);
+		let authorizationToken = randomDownloadAuthorizationToken();
+		while (this.downloadAuthorizationTokens.has(authorizationToken)) authorizationToken = randomDownloadAuthorizationToken();
+		const expiresAt = this.now() + req.validDurationInSeconds * 1e3;
+		this.downloadAuthorizationTokens.set(authorizationToken, {
+			bucketId: req.bucketId,
+			fileNamePrefix: req.fileNamePrefix,
+			expiresAt,
+			responseHeaderOverrides: pickDownloadResponseOverrides(req)
+		});
+		this.pushDownloadAuthorizationExpiry({
+			token: authorizationToken,
+			expiresAt
+		});
 		return {
 			status: 200,
 			body: {
 				bucketId: req.bucketId,
 				fileNamePrefix: req.fileNamePrefix,
-				authorizationToken: `sim_dl_auth_${this.genId("tok")}`
+				authorizationToken
 			}
 		};
 	}
-	createKey(req, apiVersion) {
-		if (apiVersion === "v4" && hasOwnField(req, "bucketId")) return this.error(400, "bad_request", "bucketId is not accepted by v4 b2_create_key; use bucketIds");
-		if (apiVersion !== "v4" && req.bucketId !== void 0 && req.bucketIds !== void 0) return this.error(400, "bad_request", "b2_create_key accepts either bucketIds or bucketId");
-		const bucketIds = apiVersion !== "v4" && req.bucketId !== void 0 ? Object.freeze([req.bucketId]) : normalizeKeyBucketIds(req);
+	createKeyCapabilitiesOutsideGrant(authToken, requested) {
+		const creator = authToken === void 0 ? void 0 : this.issuedTokens.get(authToken);
+		if (creator === void 0) return this.strictAuth ? requested : [];
+		if (creator.applicationKeyId === null) return [];
+		const granted = new Set(creator.capabilities);
+		return requested.filter((capability) => !granted.has(capability));
+	}
+	createKeyCreatorAccountId(authToken) {
+		return (authToken === void 0 ? void 0 : this.issuedTokens.get(authToken))?.accountId ?? this.accountId;
+	}
+	createKey(req, version, authToken) {
+		if (version === "v4" && hasOwnField(req, "bucketId")) return this.error(400, "bad_request", "bucketId is not accepted by v4 b2_create_key; use bucketIds");
+		if (version !== "v4" && req.bucketId !== void 0 && req.bucketIds !== void 0) return this.error(400, "bad_request", "b2_create_key accepts either bucketIds or bucketId");
+		const bucketIds = version !== "v4" && req.bucketId !== void 0 ? Object.freeze([req.bucketId]) : normalizeKeyBucketIds(req);
 		const namePrefix = req.namePrefix === void 0 || req.namePrefix === "" ? null : req.namePrefix;
-		if (hasKeyManagementCapability(req.capabilities) && (bucketIds !== null || namePrefix !== null)) return this.error(400, "bad_request", "key-management capabilities are account-level and cannot be bucket or name-prefix scoped");
+		const creatorAccountId = this.createKeyCreatorAccountId(authToken);
+		if (req.accountId !== creatorAccountId) return this.error(400, "bad_request", "accountId must match authorized account");
+		const keyNameError = validateCreateKeyName(req.keyName);
+		if (keyNameError) return this.error(400, keyNameError.code, keyNameError.message);
+		const keyName = req.keyName;
+		const capabilitiesError = validateCreateKeyCapabilities(req.capabilities);
+		if (capabilitiesError) return this.error(400, capabilitiesError.code, capabilitiesError.message);
+		const capabilities = normalizeCreateKeyCapabilities(req.capabilities);
+		const unauthorizedCapabilities = this.createKeyCapabilitiesOutsideGrant(authToken, capabilities);
+		if (unauthorizedCapabilities.length > 0) return this.error(400, "bad_request", `requested capabilities exceed creator grant: ${unauthorizedCapabilities.join(", ")}`);
+		if (hasKeyManagementCapability(capabilities) && (bucketIds !== null || namePrefix !== null)) return this.error(400, "bad_request", "key-management capabilities are account-level and cannot be bucket or name-prefix scoped");
 		const kid = this.genId("sim_key");
-		const appKey = this.genId("sim_secret");
-		const expiration = req.validDurationInSeconds !== void 0 ? Date.now() + req.validDurationInSeconds * 1e3 : null;
 		const stored = {
 			applicationKeyId: kid,
-			keyName: req.keyName,
-			capabilities: req.capabilities,
-			accountId: req.accountId,
-			applicationKey: appKey,
+			keyName,
+			capabilities,
+			accountId: creatorAccountId,
+			applicationKey: this.genId("sim_secret"),
 			bucketIds,
 			namePrefix,
-			expirationTimestamp: expiration
+			expirationTimestamp: req.validDurationInSeconds !== void 0 ? this.now() + req.validDurationInSeconds * 1e3 : null
 		};
 		this.keys.set(kid, stored);
 		return {
@@ -1740,7 +2606,7 @@ var B2Simulator = class {
 				keyName: stored.keyName,
 				applicationKeyId: stored.applicationKeyId,
 				applicationKey: stored.applicationKey,
-				capabilities: stored.capabilities,
+				capabilities: cloneCapabilities(stored.capabilities),
 				accountId: stored.accountId,
 				expirationTimestamp: stored.expirationTimestamp,
 				bucketIds: cloneBucketIds(stored.bucketIds),
@@ -1765,7 +2631,7 @@ var B2Simulator = class {
 				keys: allKeys.slice(0, max).map((k) => ({
 					keyName: k.keyName,
 					applicationKeyId: k.applicationKeyId,
-					capabilities: k.capabilities,
+					capabilities: cloneCapabilities(k.capabilities),
 					accountId: k.accountId,
 					expirationTimestamp: k.expirationTimestamp,
 					bucketIds: cloneBucketIds(k.bucketIds),
@@ -1791,7 +2657,7 @@ var B2Simulator = class {
 			body: {
 				keyName: key.keyName,
 				applicationKeyId: key.applicationKeyId,
-				capabilities: key.capabilities,
+				capabilities: cloneCapabilities(key.capabilities),
 				accountId: key.accountId,
 				expirationTimestamp: key.expirationTimestamp,
 				bucketIds: cloneBucketIds(key.bucketIds),
@@ -1801,31 +2667,45 @@ var B2Simulator = class {
 			}
 		};
 	}
-	updateFileRetention(req) {
+	updateFileRetention(req, authToken) {
 		const found = this.findFile(req.fileId);
 		if (found === null || found.stored.fileVersion.fileName !== req.fileName) return this.error(404, "file_not_present", "File not found");
+		const fileLockError = this.requireFileLockEnabled(found.bucket);
+		if (fileLockError !== null) return fileLockError;
+		const fileRetention = parseFileRetentionValue(req.fileRetention, Date.now());
+		if (fileRetention === null) return this.error(400, "bad_request", "fileRetention must use a valid mode and retainUntilTimestamp pair");
+		const current = found.stored.fileVersion.fileRetention?.value;
+		if (current?.mode === RetentionMode.Compliance && (fileRetention.mode !== RetentionMode.Compliance || isRetentionWeakened(current, fileRetention))) return this.error(400, "file_lock_compliance_protected", "Compliance-mode retention cannot be shortened or removed");
+		if (requiresGovernanceBypass(current, fileRetention)) {
+			const bypassError = this.requireGovernanceBypass(req, authToken, "Governance-mode retention cannot be shortened, removed, or converted without bypassGovernance");
+			if (bypassError !== null) return bypassError;
+		}
 		found.versions[found.index] = {
 			fileVersion: {
 				...found.stored.fileVersion,
 				fileRetention: {
 					isClientAuthorizedToRead: true,
-					value: req.fileRetention
+					value: fileRetention
 				}
 			},
-			data: found.stored.data
+			data: found.stored.data,
+			serverSideEncryption: found.stored.serverSideEncryption
 		};
 		return {
 			status: 200,
 			body: {
 				fileName: req.fileName,
 				fileId: req.fileId,
-				fileRetention: req.fileRetention
+				fileRetention
 			}
 		};
 	}
 	updateFileLegalHold(req) {
 		const found = this.findFile(req.fileId);
 		if (found === null || found.stored.fileVersion.fileName !== req.fileName) return this.error(404, "file_not_present", "File not found");
+		const fileLockError = this.requireFileLockEnabled(found.bucket);
+		if (fileLockError !== null) return fileLockError;
+		if (req.legalHold !== LegalHoldValue.On && req.legalHold !== LegalHoldValue.Off) return this.error(400, "bad_request", "legalHold must be \"on\" or \"off\"");
 		found.versions[found.index] = {
 			fileVersion: {
 				...found.stored.fileVersion,
@@ -1834,7 +2714,8 @@ var B2Simulator = class {
 					value: req.legalHold
 				}
 			},
-			data: found.stored.data
+			data: found.stored.data,
+			serverSideEncryption: found.stored.serverSideEncryption
 		};
 		return {
 			status: 200,
@@ -1858,6 +2739,8 @@ var B2Simulator = class {
 	}
 	setBucketNotificationRules(req) {
 		if (!this.buckets.has(req.bucketId)) return this.error(400, "bad_bucket_id", "Bucket not found");
+		const rulesError = validateNotificationRules(req.eventNotificationRules);
+		if (rulesError) return this.error(400, rulesError.code, rulesError.message);
 		this.notificationRules.set(req.bucketId, req.eventNotificationRules);
 		return {
 			status: 200,
@@ -1915,11 +2798,23 @@ var B2Simulator = class {
 				isClientAuthorizedToRead: true,
 				value: params.legalHold ?? null
 			},
-			replicationStatus: null,
+			...this.replicationStatusMetadataFor(params.replicationStatus),
 			serverSideEncryption: publicServerSideEncryption(params.serverSideEncryption ?? { mode: EncryptionMode.None }),
-			uploadTimestamp: this.monotonicTimestamp()
+			uploadTimestamp: params.uploadTimestamp ?? this.monotonicTimestamp()
 		};
 	}
+	newReplicationStatusField(bucketId, fileName) {
+		return this.replicationStatusMetadataFor(this.replicationStatusForNewFile(bucketId, fileName));
+	}
+	replicationStatusMetadataFor(replicationStatus) {
+		return replicationStatus === void 0 ? {} : { replicationStatus };
+	}
+	replicationStatusForNewFile(bucketId, fileName) {
+		return this.matchingEnabledReplicationRules(bucketId, fileName).length > 0 ? "PENDING" : void 0;
+	}
+	matchingEnabledReplicationRules(bucketId, fileName) {
+		return (this.buckets.get(bucketId)?.info.replicationConfiguration.asReplicationSource?.replicationRules)?.filter((rule) => rule.isEnabled && fileName.startsWith(rule.fileNamePrefix)) ?? [];
+	}
 	error(status, code, message) {
 		return {
 			status,
@@ -1947,8 +2842,7 @@ var B2Simulator = class {
 	*   used to match against `EventNotificationRule.eventTypes` globs.
 	*/
 	firePostUploadHooks(fileVersion, bucketId, eventType) {
-		const bucket = this.buckets.get(bucketId);
-		if (!bucket) return;
+		if (!this.buckets.get(bucketId)) return;
 		if (this.onWebhookDeliver !== void 0) {
 			const rules = this.notificationRules.get(bucketId) ?? [];
 			for (const rule of rules) {
@@ -1962,18 +2856,13 @@ var B2Simulator = class {
 				}));
 			}
 		}
-		if (this.onReplicate !== void 0) {
-			const sourceRules = bucket.info.replicationConfiguration.asReplicationSource?.replicationRules ?? [];
-			for (const rule of sourceRules) {
-				if (!rule.isEnabled) continue;
-				if (rule.fileNamePrefix && !fileVersion.fileName.startsWith(rule.fileNamePrefix)) continue;
-				const hook = this.onReplicate;
-				this.dispatchHook("replication", () => hook({
-					sourceFileVersion: fileVersion,
-					sourceBucketId: bucketId,
-					destinationBucketId: rule.destinationBucketId
-				}));
-			}
+		if (this.onReplicate !== void 0) for (const rule of this.matchingEnabledReplicationRules(bucketId, fileVersion.fileName)) {
+			const hook = this.onReplicate;
+			this.dispatchHook("replication", () => hook({
+				sourceFileVersion: fileVersion,
+				sourceBucketId: bucketId,
+				destinationBucketId: rule.destinationBucketId
+			}));
 		}
 	}
 	/**
@@ -2057,6 +2946,83 @@ function buildFaultResponse(fault) {
 		arrayBuffer: () => Promise.resolve(utf8Encoder.encode(body).buffer)
 	};
 }
+function rawUrlPathContainsLiteralBackslash(rawUrl) {
+	const schemeEnd = rawUrl.indexOf("://");
+	const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
+	const urlEndCandidates = [rawUrl.indexOf("?", authorityStart), rawUrl.indexOf("#", authorityStart)].filter((index) => index !== -1);
+	const urlEnd = urlEndCandidates.length === 0 ? rawUrl.length : Math.min(...urlEndCandidates);
+	const pathStartCandidates = [rawUrl.indexOf("/", authorityStart), rawUrl.indexOf("\\", authorityStart)].filter((index) => index !== -1 && index < urlEnd);
+	if (pathStartCandidates.length === 0) return false;
+	const pathStart = Math.min(...pathStartCandidates);
+	const pathEndCandidates = [rawUrl.indexOf("?", pathStart), rawUrl.indexOf("#", pathStart)].filter((index) => index !== -1);
+	const pathEnd = pathEndCandidates.length === 0 ? rawUrl.length : Math.min(...pathEndCandidates);
+	return rawUrl.slice(pathStart, pathEnd).includes("\\");
+}
+function badRequestJson(message) {
+	return {
+		status: 400,
+		body: {
+			status: 400,
+			code: "bad_request",
+			message
+		}
+	};
+}
+function checkedUploadBody(data, expectedLength) {
+	if (expectedLength !== null && data.byteLength !== expectedLength) return { error: badRequestJson(contentLengthMismatchMessage(expectedLength, data.byteLength)) };
+	return { data };
+}
+function copyBytes(bytes) {
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return copy;
+}
+function concatenateChunks(chunks, totalLength) {
+	if (chunks.length === 0) return /* @__PURE__ */ new Uint8Array(0);
+	if (chunks.length === 1) return copyBytes(chunks[0]);
+	const data = new Uint8Array(totalLength);
+	let offset = 0;
+	for (const chunk of chunks) {
+		data.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return data;
+}
+async function readStreamingUploadBody(stream, expectedLength) {
+	const reader = stream.getReader();
+	const chunks = [];
+	let totalLength = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (value === void 0) continue;
+			const chunk = value instanceof Uint8Array ? value : new Uint8Array(value);
+			totalLength += chunk.byteLength;
+			if (expectedLength !== null && totalLength > expectedLength) {
+				await reader.cancel().catch(() => void 0);
+				return { error: badRequestJson(contentLengthMismatchMessage(expectedLength, totalLength)) };
+			}
+			chunks.push(chunk);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	if (expectedLength !== null && totalLength !== expectedLength) return { error: badRequestJson(contentLengthMismatchMessage(expectedLength, totalLength)) };
+	return { data: concatenateChunks(chunks, totalLength) };
+}
+async function readUploadBody(body, expectedLength) {
+	if (body instanceof ReadableStream) return readStreamingUploadBody(body, expectedLength);
+	if (body instanceof ArrayBuffer) return checkedUploadBody(new Uint8Array(body), expectedLength);
+	if (ArrayBuffer.isView(body)) {
+		const view = body;
+		return checkedUploadBody(copyBytes(new Uint8Array(view.buffer, view.byteOffset, view.byteLength)), expectedLength);
+	}
+	if (typeof Blob !== "undefined" && body instanceof Blob) {
+		if (expectedLength !== null && body.size !== expectedLength) return { error: badRequestJson(contentLengthMismatchMessage(expectedLength, body.size)) };
+	}
+	return checkedUploadBody(new Uint8Array(await new Response(body).arrayBuffer()), expectedLength);
+}
 var SimulatorTransport = class {
 	sim;
 	constructor(sim) {
@@ -2066,6 +3032,12 @@ var SimulatorTransport = class {
 		const url = request.url;
 		const fault = this.sim.consumeMatchingFault(url);
 		if (fault !== null) return buildFaultResponse(fault);
+		if (rawUrlPathContainsLiteralBackslash(url)) return buildFaultResponse({
+			on: "\\",
+			status: 400,
+			code: "bad_request",
+			message: "URL path must not contain literal backslashes"
+		});
 		const headers = {};
 		if (request.headers) for (const [k, v] of Object.entries(request.headers)) headers[k.toLowerCase()] = v;
 		const parsedUrl = new URL(url);
@@ -2073,10 +3045,15 @@ var SimulatorTransport = class {
 		const isUpload = endpoint === "b2_upload_file" || endpoint === "b2_upload_part";
 		if (parsedUrl.pathname.includes("b2_download_file_by_id") || parsedUrl.pathname.includes("/file/")) {
 			const method = request.method === "HEAD" ? "HEAD" : "GET";
-			const result = this.sim.handleDownload(parsedUrl.pathname + parsedUrl.search, headers, method);
+			const result = await this.sim.handleDownload(parsedUrl.pathname + parsedUrl.search, headers, method);
 			const data = result.data ?? /* @__PURE__ */ new Uint8Array(0);
 			const responseHeaders = new Headers(result.headers);
 			responseHeaders.set("Content-Type", result.headers["Content-Type"] ?? "application/octet-stream");
+			let decodedText = null;
+			const text = () => {
+				decodedText ??= utf8Decoder.decode(data);
+				return decodedText;
+			};
 			const body = method === "HEAD" || result.data === null ? null : new ReadableStream({ start(controller) {
 				controller.enqueue(data);
 				controller.close();
@@ -2085,15 +3062,25 @@ var SimulatorTransport = class {
 				status: result.status,
 				headers: responseHeaders,
 				body,
-				json: () => Promise.reject(/* @__PURE__ */ new Error("Download response is not JSON")),
-				text: () => Promise.resolve(utf8Decoder.decode(data)),
+				json: () => {
+					try {
+						return Promise.resolve(JSON.parse(text()));
+					} catch {
+						return Promise.reject(/* @__PURE__ */ new Error("Download response is not JSON"));
+					}
+				},
+				text: () => Promise.resolve(text()),
 				arrayBuffer: () => Promise.resolve(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength))
 			};
 		}
 		let result;
-		if (isUpload && request.body) {
-			const data = new Uint8Array(request.body instanceof ArrayBuffer ? request.body : request.body instanceof Uint8Array ? request.body.buffer.slice(request.body.byteOffset, request.body.byteOffset + request.body.byteLength) : await new Response(request.body).arrayBuffer());
-			result = await this.sim.handleUpload(url, headers, data);
+		if (isUpload) {
+			const parsedContentLength = parseContentLengthHeader(headers);
+			if (parsedContentLength.kind === "error") result = badRequestJson(parsedContentLength.message);
+			else {
+				const uploadBody = await readUploadBody(request.body ?? /* @__PURE__ */ new Uint8Array(0), parsedContentLength.kind === "ok" ? parsedContentLength.expectedLength : null);
+				result = "error" in uploadBody ? uploadBody.error : await this.sim.handleUpload(url, headers, uploadBody.data);
+			}
 		} else {
 			let body = null;
 			if (request.body) {
@@ -2103,7 +3090,7 @@ var SimulatorTransport = class {
 				} catch {
 					body = text;
 				}
-			}
+			} else if (request.method.toUpperCase() === "GET" && isPartnerQueryEndpoint(apiPathParts(parsedUrl.pathname).endpoint)) body = queryParamsBody(parsedUrl.searchParams);
 			result = await this.sim.handleRequest(request.method, parsedUrl.origin, parsedUrl.pathname, headers, body);
 		}
 		const responseBody = JSON.stringify(result.body);
@@ -2121,6 +3108,6 @@ var SimulatorTransport = class {
 	}
 };
 //#endregion
-export { B2Simulator, BUCKET_INFO_MAX_KEYS, BUCKET_INFO_VALUE_MAX, BUCKET_NAME_MAX, BUCKET_NAME_MIN, FILE_INFO_TOTAL_MAX, FILE_INFO_VALUE_MAX, FILE_NAME_MAX_BYTES, LIST_ENDPOINT_CAPS };
+export { B2Simulator, BUCKET_INFO_MAX_KEYS, BUCKET_INFO_VALUE_MAX, BUCKET_NAME_MAX, BUCKET_NAME_MIN, DOWNLOAD_AUTH_DURATION_MAX_SECONDS, DOWNLOAD_AUTH_DURATION_MIN_SECONDS, FILE_INFO_TOTAL_MAX, FILE_INFO_VALUE_MAX, FILE_NAME_MAX_BYTES, KEY_NAME_MAX, KEY_NAME_MIN, LIST_ENDPOINT_CAPS };
 
 //# sourceMappingURL=index.js.map