@backblaze-labs/b2-sdk 0.3.0 → 0.4.0

package/dist/simulator/index.cjs

@@ -13,6 +13,7 @@ const require_bucket = require("../types/bucket.cjs");
 const require_to_error = require("../util/to-error.cjs");
 const require_url = require("../raw/url.cjs");
 const require_auth = require("../types/auth.cjs");
+const require_partner_capabilities = require("./partner-capabilities.cjs");
 const require_partner = require("./partner.cjs");
 const require_capabilities = require("./capabilities.cjs");
 const require_b2_naming = require("../internal/b2-naming.cjs");
@@ -56,9 +57,22 @@ var SIMULATOR_MASTER_CAPABILITIES = [
 function apiPathParts(path) {
 	const segments = path.split("/").filter((segment) => segment.length > 0);
 	const candidate = segments.at(-2);
+	const endpoint = segments.at(-1) ?? "";
+	const isB2ApiPath = segments.at(-3) === "b2api";
+	if (candidate !== void 0 && require_url.isB2ApiVersion(candidate)) {
+		if (candidate === "v3" || candidate === "v4") return {
+			endpoint,
+			version: candidate
+		};
+		if (isB2ApiPath) return {
+			endpoint,
+			version: "v3",
+			unsupportedVersion: candidate
+		};
+	}
 	return {
-		endpoint: segments.at(-1) ?? "",
-		version: candidate !== void 0 && require_url.isB2ApiVersion(candidate) ? candidate : "v3"
+		endpoint,
+		version: "v3"
 	};
 }
 function parseBasicAuthorizationHeader(authzHeader) {
@@ -191,6 +205,11 @@ function compareB2FileNames(a, b) {
 	if (a > b) return 1;
 	return 0;
 }
+function compareFileVersionListEntries(a, b) {
+	const nameCmp = compareB2FileNames(a.fileName, b.fileName);
+	if (nameCmp !== 0) return nameCmp;
+	return b.uploadTimestamp - a.uploadTimestamp;
+}
 var DOWNLOAD_AUTH_TOKEN_BYTES = 32;
 var DOWNLOAD_AUTH_TOKEN_PREFIX = "sim_dl_auth_";
 var DOWNLOAD_AUTH_PURGE_BATCH_SIZE = 128;
@@ -284,6 +303,44 @@ function normalizeReplicationConfiguration(config) {
 		asReplicationDestination: config.asReplicationDestination ?? null
 	};
 }
+function wrapReplicationConfiguration(config) {
+	if (config === void 0) return {
+		isClientAuthorizedToRead: true,
+		value: null
+	};
+	const normalized = normalizeReplicationConfiguration(config);
+	return {
+		isClientAuthorizedToRead: true,
+		value: normalized.asReplicationSource === null && normalized.asReplicationDestination === null ? null : normalized
+	};
+}
+function filterReadableReplicationConfiguration(config, canRead) {
+	return canRead ? {
+		isClientAuthorizedToRead: true,
+		value: config.value
+	} : {
+		isClientAuthorizedToRead: false,
+		value: null
+	};
+}
+function readableFileRetention(value, canRead) {
+	return canRead ? {
+		isClientAuthorizedToRead: true,
+		value
+	} : {
+		isClientAuthorizedToRead: false,
+		value: null
+	};
+}
+function readableLegalHold(value, canRead) {
+	return canRead ? {
+		isClientAuthorizedToRead: true,
+		value
+	} : {
+		isClientAuthorizedToRead: false,
+		value: null
+	};
+}
 function validateBucketConfigurationFields(fields, options) {
 	if (fields.bucketInfo !== void 0) {
 		const infoError = require_validation.validateBucketInfo(fields.bucketInfo);
@@ -297,6 +354,10 @@ function validateBucketConfigurationFields(fields, options) {
 		const lifecycleError = require_validation.validateLifecycleRules(fields.lifecycleRules);
 		if (lifecycleError) return lifecycleError;
 	}
+	if (fields.defaultServerSideEncryption !== void 0) {
+		const encryptionError = validateBucketDefaultServerSideEncryption(fields.defaultServerSideEncryption);
+		if (encryptionError) return encryptionError;
+	}
 	if (fields.replicationConfiguration !== void 0) {
 		const replicationError = require_validation.validateReplicationConfiguration(fields.replicationConfiguration);
 		if (replicationError) return replicationError;
@@ -311,6 +372,34 @@ function validateBucketConfigurationFields(fields, options) {
 	}
 	return null;
 }
+function validateBucketDefaultServerSideEncryption(encryption) {
+	const runtimeEncryption = requestRecord(encryption);
+	if (runtimeEncryption === null) return {
+		code: "bad_request",
+		message: "defaultServerSideEncryption must be an object"
+	};
+	if (hasCustomerEncryptionFields(runtimeEncryption)) return {
+		code: "bad_request",
+		message: "Bucket default server-side encryption cannot use SSE-C"
+	};
+	const mode = runtimeEncryption["mode"];
+	if (mode === require_encryption.EncryptionMode.None) return null;
+	if (mode === require_encryption.EncryptionMode.SseB2) {
+		if (runtimeEncryption["algorithm"] !== require_encryption.EncryptionAlgorithm.Aes256) return {
+			code: "bad_request",
+			message: "SSE-B2 algorithm must be AES256"
+		};
+		return null;
+	}
+	if (mode === require_encryption.EncryptionMode.SseC) return {
+		code: "bad_request",
+		message: "Bucket default server-side encryption cannot use SSE-C"
+	};
+	return {
+		code: "bad_request",
+		message: `Unsupported bucket default server-side encryption mode: ${String(mode)}`
+	};
+}
 function nextObjectLockEnabled(current, requested) {
 	if (requested === void 0) return current;
 	if (typeof requested !== "boolean") return {
@@ -353,59 +442,188 @@ function fileNames(...names) {
 	const present = names.filter((name) => name !== void 0);
 	return present.length > 0 ? present : void 0;
 }
-function queryParamsBody(params) {
+function queryParamsBody(params, endpoint) {
+	const metadata = jsonEndpointMetadata(endpoint);
+	const queryFields = new Set(metadata?.queryFields ?? []);
+	const numericFields = new Set(metadata?.numericQueryFields ?? []);
 	const body = Object.create(null);
-	let hasParams = false;
 	for (const [key, value] of params) {
+		if (!queryFields.has(key)) continue;
 		if (body[key] !== void 0) continue;
-		body[key] = value;
-		hasParams = true;
-	}
-	return hasParams ? body : null;
-}
-var JSON_GET_ENDPOINTS = /* @__PURE__ */ new Set([
-	"b2_authorize_account",
-	"b2_list_groups",
-	"b2_list_group_members",
-	"bz_list_computers"
-]);
-var JSON_POST_ENDPOINTS = /* @__PURE__ */ new Set([
-	"b2_create_group_member",
-	"b2_eject_group_member",
-	"b2_reserve_trial_create_account",
-	"bz_delete_computer",
-	"b2_create_bucket",
-	"b2_list_buckets",
-	"b2_delete_bucket",
-	"b2_update_bucket",
-	"b2_get_upload_url",
-	"b2_list_file_names",
-	"b2_list_file_versions",
-	"b2_get_file_info",
-	"b2_hide_file",
-	"b2_delete_file_version",
-	"b2_copy_file",
-	"b2_start_large_file",
-	"b2_get_upload_part_url",
-	"b2_finish_large_file",
-	"b2_cancel_large_file",
-	"b2_list_unfinished_large_files",
-	"b2_list_parts",
-	"b2_copy_part",
-	"b2_get_download_authorization",
-	"b2_create_key",
-	"b2_list_keys",
-	"b2_delete_key",
-	"b2_update_file_retention",
-	"b2_update_file_legal_hold",
-	"b2_get_bucket_notification_rules",
-	"b2_set_bucket_notification_rules"
-]);
+		body[key] = queryParamValue(value, numericFields.has(key));
+	}
+	return body;
+}
+function queryParamValue(value, numeric) {
+	if (!numeric || !/^-?\d+$/.test(value)) return value;
+	const numericValue = Number(value);
+	return Number.isSafeInteger(numericValue) ? numericValue : value;
+}
+var JSON_ENDPOINTS = {
+	b2_authorize_account: { methods: ["GET"] },
+	[require_partner_capabilities.PartnerEndpoint.ListGroups]: {
+		methods: ["GET"],
+		queryFields: [
+			"adminAccountId",
+			"groupName",
+			"startGroupId",
+			"maxGroupCount"
+		],
+		numericQueryFields: ["maxGroupCount"]
+	},
+	[require_partner_capabilities.PartnerEndpoint.ListGroupMembers]: {
+		methods: ["GET"],
+		queryFields: [
+			"adminAccountId",
+			"groupId",
+			"startEmail",
+			"maxMemberCount"
+		],
+		numericQueryFields: ["maxMemberCount"]
+	},
+	[require_partner_capabilities.PartnerEndpoint.ListComputers]: {
+		methods: ["GET"],
+		queryFields: [
+			"accountId",
+			"startComputerId",
+			"maxComputerCount"
+		],
+		numericQueryFields: ["maxComputerCount"]
+	},
+	b2_get_upload_url: {
+		methods: ["GET", "POST"],
+		queryFields: ["bucketId"]
+	},
+	b2_list_file_names: {
+		methods: ["GET", "POST"],
+		queryFields: [
+			"bucketId",
+			"delimiter",
+			"maxFileCount",
+			"prefix",
+			"startFileName"
+		],
+		numericQueryFields: ["maxFileCount"]
+	},
+	b2_list_file_versions: {
+		methods: ["GET", "POST"],
+		queryFields: [
+			"bucketId",
+			"delimiter",
+			"maxFileCount",
+			"prefix",
+			"startFileName",
+			"startFileId"
+		],
+		numericQueryFields: ["maxFileCount"]
+	},
+	b2_get_file_info: {
+		methods: ["GET", "POST"],
+		queryFields: ["fileId"]
+	},
+	b2_copy_file: {
+		methods: ["GET", "POST"],
+		queryFields: [
+			"sourceFileId",
+			"fileName",
+			"destinationBucketId",
+			"range",
+			"metadataDirective",
+			"contentType"
+		]
+	},
+	b2_get_upload_part_url: {
+		methods: ["GET", "POST"],
+		queryFields: ["fileId"]
+	},
+	b2_list_unfinished_large_files: {
+		methods: ["GET", "POST"],
+		queryFields: [
+			"bucketId",
+			"namePrefix",
+			"startFileId",
+			"maxFileCount"
+		],
+		numericQueryFields: ["maxFileCount"]
+	},
+	b2_list_parts: {
+		methods: ["GET", "POST"],
+		queryFields: [
+			"fileId",
+			"startPartNumber",
+			"maxPartCount"
+		],
+		numericQueryFields: ["startPartNumber", "maxPartCount"]
+	},
+	b2_copy_part: {
+		methods: ["GET", "POST"],
+		queryFields: [
+			"sourceFileId",
+			"largeFileId",
+			"partNumber",
+			"range"
+		],
+		numericQueryFields: ["partNumber"]
+	},
+	b2_get_download_authorization: {
+		methods: ["GET", "POST"],
+		queryFields: [
+			"bucketId",
+			"fileNamePrefix",
+			"validDurationInSeconds",
+			"b2ContentDisposition",
+			"b2ContentLanguage",
+			"b2ContentEncoding",
+			"b2ContentType",
+			"b2CacheControl",
+			"b2Expires"
+		],
+		numericQueryFields: ["validDurationInSeconds"]
+	},
+	b2_list_keys: {
+		methods: ["GET", "POST"],
+		queryFields: [
+			"accountId",
+			"maxKeyCount",
+			"startApplicationKeyId"
+		],
+		numericQueryFields: ["maxKeyCount"]
+	},
+	b2_get_bucket_notification_rules: {
+		methods: ["GET", "POST"],
+		queryFields: ["bucketId"]
+	},
+	[require_partner_capabilities.PartnerEndpoint.CreateGroupMember]: { methods: ["POST"] },
+	[require_partner_capabilities.PartnerEndpoint.EjectGroupMember]: { methods: ["POST"] },
+	[require_partner_capabilities.PartnerEndpoint.ReserveTrialCreateAccount]: { methods: ["POST"] },
+	[require_partner_capabilities.PartnerEndpoint.DeleteComputer]: { methods: ["POST"] },
+	b2_create_bucket: { methods: ["POST"] },
+	b2_list_buckets: { methods: ["POST"] },
+	b2_delete_bucket: { methods: ["POST"] },
+	b2_update_bucket: { methods: ["POST"] },
+	b2_hide_file: { methods: ["POST"] },
+	b2_delete_file_version: { methods: ["POST"] },
+	b2_start_large_file: { methods: ["POST"] },
+	b2_finish_large_file: { methods: ["POST"] },
+	b2_cancel_large_file: { methods: ["POST"] },
+	b2_create_key: { methods: ["POST"] },
+	b2_delete_key: { methods: ["POST"] },
+	b2_update_file_retention: { methods: ["POST"] },
+	b2_update_file_legal_hold: { methods: ["POST"] },
+	b2_set_bucket_notification_rules: { methods: ["POST"] }
+};
+function jsonEndpointMetadata(endpoint) {
+	return JSON_ENDPOINTS[endpoint];
+}
 function jsonEndpointAllowsMethod(method, endpoint) {
+	const metadata = jsonEndpointMetadata(endpoint);
+	if (metadata === void 0) return true;
 	const normalizedMethod = method.toUpperCase();
-	if (JSON_GET_ENDPOINTS.has(endpoint)) return normalizedMethod === "GET";
-	if (JSON_POST_ENDPOINTS.has(endpoint)) return normalizedMethod === "POST";
-	return true;
+	if (normalizedMethod !== "GET" && normalizedMethod !== "POST") return false;
+	return metadata.methods.includes(normalizedMethod);
+}
+function isJsonQueryEndpoint(endpoint) {
+	return jsonEndpointMetadata(endpoint)?.queryFields !== void 0;
 }
 function notificationRulePrefixes(body) {
 	if (typeof body !== "object" || body === null) return void 0;
@@ -441,6 +659,30 @@ function publicServerSideEncryption(encryption) {
 	};
 	return encryption;
 }
+function publicBucketDefaultServerSideEncryption(encryption) {
+	return {
+		isClientAuthorizedToRead: true,
+		value: publicBucketDefaultServerSideEncryptionValue(encryption)
+	};
+}
+function publicBucketDefaultServerSideEncryptionValue(encryption) {
+	if (encryption?.mode === require_encryption.EncryptionMode.SseB2) return encryption;
+	return {
+		mode: null,
+		algorithm: null
+	};
+}
+function bucketDefaultServerSideEncryptionForStorage(info) {
+	const encryption = info.defaultServerSideEncryption;
+	if (!encryption.isClientAuthorizedToRead) return {
+		mode: null,
+		algorithm: null
+	};
+	return encryption.value ?? {
+		mode: null,
+		algorithm: null
+	};
+}
 function customerKeyDigest(customerKey) {
 	let first = 2166136261;
 	let second = 668265261;
@@ -495,13 +737,21 @@ function hasCustomerEncryptionFields(encryption) {
 function hasCustomerEncryptionHeaders(headers) {
 	return headers["x-bz-server-side-encryption-customer-algorithm"] !== void 0 || headers["x-bz-server-side-encryption-customer-key"] !== void 0 || headers["x-bz-server-side-encryption-customer-key-md5"] !== void 0;
 }
+function isExactNoEncryptionWireSetting(encryption) {
+	return encryption["mode"] === null && encryption["algorithm"] === null && Object.keys(encryption).length === 2;
+}
 async function storedServerSideEncryption(encryption) {
 	const runtimeEncryption = encryption;
+	if (encryption.mode === null) {
+		if (isExactNoEncryptionWireSetting(runtimeEncryption)) return { mode: require_encryption.EncryptionMode.None };
+		if (hasCustomerEncryptionFields(runtimeEncryption)) return encryptionValidationError("No-encryption settings must not include SSE-C customer keys");
+		return encryptionValidationError("No-encryption wire settings must be exactly { mode: null, algorithm: null }");
+	}
 	if (encryption.mode === require_encryption.EncryptionMode.SseC) {
 		if (runtimeEncryption["algorithm"] === void 0) return encryptionValidationError("SSE-C customer algorithm is required");
 		if (encryption.algorithm !== require_encryption.EncryptionAlgorithm.Aes256) return encryptionValidationError("SSE-C customer algorithm must be AES256");
-		const customerKey = encryption.customerKey;
-		const customerKeyMd5 = encryption.customerKeyMd5;
+		const customerKey = "customerKey" in encryption ? encryption.customerKey : void 0;
+		const customerKeyMd5 = "customerKeyMd5" in encryption ? encryption.customerKeyMd5 : void 0;
 		if (typeof customerKey !== "string" || customerKey === "") return encryptionValidationError("SSE-C customer key is required");
 		if (typeof customerKeyMd5 !== "string" || customerKeyMd5 === "") return encryptionValidationError("SSE-C customer key MD5 is required");
 		const customerKeyBytes = base64ToBytes(customerKey, 32);
@@ -556,7 +806,22 @@ async function uploadServerSideEncryption(headers, fallback) {
 	}
 	return await storedServerSideEncryption(fallback);
 }
+function noBucketDefaultRetention() {
+	return {
+		mode: null,
+		period: null
+	};
+}
+function bucketDefaultRetentionForResponse(policy) {
+	if (policy === void 0 || policy.mode === require_bucket.BucketRetentionMode.None) return noBucketDefaultRetention();
+	return policy;
+}
+function bucketDefaultRetention(info) {
+	return info.fileLockConfiguration.value?.defaultRetention;
+}
 function defaultFileRetention(policy, uploadTimestamp) {
+	if (policy === void 0) return null;
+	if (policy.mode === null) return null;
 	if (policy.mode === require_bucket.BucketRetentionMode.None || policy.period === null) return null;
 	const retainUntilTimestamp = uploadTimestamp + (policy.period.unit === "days" ? policy.period.duration : policy.period.duration * 365) * MS_PER_DAY;
 	if (!isValidRetentionTimestamp(retainUntilTimestamp, uploadTimestamp)) return null;
@@ -1025,6 +1290,16 @@ var B2Simulator = class {
 		if (authToken === void 0) return false;
 		return this.issuedTokens.get(authToken)?.capabilities.includes(capability) === true;
 	}
+	bucketInfoForResponse(info, authToken) {
+		return {
+			...info,
+			defaultServerSideEncryption: this.requestHasCapability(authToken, require_auth.Capability.ReadBucketEncryption) ? info.defaultServerSideEncryption : {
+				isClientAuthorizedToRead: false,
+				value: null
+			},
+			replicationConfiguration: filterReadableReplicationConfiguration(info.replicationConfiguration, this.requestHasCapability(authToken, require_auth.Capability.ReadBucketReplications))
+		};
+	}
 	requireFileLockEnabled(bucket) {
 		if (bucket.info.fileLockConfiguration.value?.isFileLockEnabled === true) return null;
 		return this.error(400, "file_lock_not_enabled", "Bucket does not have file lock enabled");
@@ -1051,7 +1326,7 @@ var B2Simulator = class {
 		for (const rule of rules) {
 			const destinationBucketId = requestRecord(rule)?.["destinationBucketId"];
 			if (typeof destinationBucketId !== "string") continue;
-			const destinationApplicationKeyId = this.buckets.get(destinationBucketId)?.info.replicationConfiguration.asReplicationDestination?.sourceToDestinationKeyMapping[sourceApplicationKeyId];
+			const destinationApplicationKeyId = this.buckets.get(destinationBucketId)?.info.replicationConfiguration.value?.asReplicationDestination?.sourceToDestinationKeyMapping[sourceApplicationKeyId];
 			if (destinationApplicationKeyId === void 0) return this.invalidReplicationDestinationBucket();
 			const destinationKeyError = this.validateReplicationApplicationKey(destinationApplicationKeyId, [require_auth.Capability.WriteFiles], {
 				bucketId: destinationBucketId,
@@ -1480,7 +1755,8 @@ var B2Simulator = class {
 	* @returns An object with HTTP status and JSON response body.
 	*/
 	async handleRequest(method, origin, path, headers, body) {
-		const { endpoint, version } = apiPathParts(path);
+		const { endpoint, version, unsupportedVersion } = apiPathParts(path);
+		if (unsupportedVersion !== void 0) return this.error(400, "unsupported_api_version", `B2 API version ${unsupportedVersion} is not supported by the simulator; use v4 or v3`);
 		if (!jsonEndpointAllowsMethod(method, endpoint)) return this.error(405, "method_not_allowed", `${endpoint} does not support ${method.toUpperCase()}`);
 		if (this.strictAuth && !this.partner.isEndpoint(endpoint)) {
 			const authError = this.authorizeRequest(headers["authorization"], endpoint, this.requestScope(endpoint, body));
@@ -1490,17 +1766,17 @@ var B2Simulator = class {
 			case "b2_authorize_account":
 				if (version === "v3" && this.partner.isAuthorizeEnabled()) return this.partner.authorize(headers["authorization"], origin);
 				return this.authorize(headers["authorization"], origin);
-			case "b2_create_group_member": return this.partner.createGroupMember(body, headers["authorization"]);
-			case "b2_eject_group_member": return this.partner.ejectGroupMember(body, headers["authorization"]);
-			case "b2_list_groups": return this.partner.listGroups(body, headers["authorization"]);
-			case "b2_list_group_members": return this.partner.listGroupMembers(body, headers["authorization"]);
-			case "b2_reserve_trial_create_account": return this.partner.reserveTrialCreateAccount(body, headers["authorization"]);
-			case "bz_list_computers": return this.partner.listComputers(body, headers["authorization"]);
-			case "bz_delete_computer": return this.partner.deleteComputer(body, headers["authorization"]);
-			case "b2_create_bucket": return this.createBucket(body);
-			case "b2_list_buckets": return this.listBuckets(body);
-			case "b2_delete_bucket": return this.deleteBucket(body);
-			case "b2_update_bucket": return this.updateBucket(body);
+			case require_partner_capabilities.PartnerEndpoint.CreateGroupMember: return this.partner.createGroupMember(body, headers["authorization"]);
+			case require_partner_capabilities.PartnerEndpoint.EjectGroupMember: return this.partner.ejectGroupMember(body, headers["authorization"]);
+			case require_partner_capabilities.PartnerEndpoint.ListGroups: return this.partner.listGroups(body, headers["authorization"]);
+			case require_partner_capabilities.PartnerEndpoint.ListGroupMembers: return this.partner.listGroupMembers(body, headers["authorization"]);
+			case require_partner_capabilities.PartnerEndpoint.ReserveTrialCreateAccount: return this.partner.reserveTrialCreateAccount(body, headers["authorization"]);
+			case require_partner_capabilities.PartnerEndpoint.ListComputers: return this.partner.listComputers(body, headers["authorization"]);
+			case require_partner_capabilities.PartnerEndpoint.DeleteComputer: return this.partner.deleteComputer(body, headers["authorization"]);
+			case "b2_create_bucket": return this.createBucket(body, headers["authorization"]);
+			case "b2_list_buckets": return this.listBuckets(body, headers["authorization"]);
+			case "b2_delete_bucket": return this.deleteBucket(body, headers["authorization"]);
+			case "b2_update_bucket": return this.updateBucket(body, headers["authorization"]);
 			case "b2_get_upload_url": return await this.getUploadUrl(body, headers["authorization"]);
 			case "b2_list_file_names": return this.listFileNames(body);
 			case "b2_list_file_versions": return this.listFileVersions(body);
@@ -1508,11 +1784,11 @@ var B2Simulator = class {
 			case "b2_hide_file": return this.hideFile(body);
 			case "b2_delete_file_version": return this.deleteFileVersion(body, headers["authorization"]);
 			case "b2_copy_file": return await this.copyFile(body);
-			case "b2_start_large_file": return await this.startLargeFile(body);
+			case "b2_start_large_file": return await this.startLargeFile(body, headers["authorization"]);
 			case "b2_get_upload_part_url": return await this.getUploadPartUrl(body, headers["authorization"]);
 			case "b2_finish_large_file": return this.finishLargeFile(body);
 			case "b2_cancel_large_file": return this.cancelLargeFile(body);
-			case "b2_list_unfinished_large_files": return this.listUnfinishedLargeFiles(body);
+			case "b2_list_unfinished_large_files": return this.listUnfinishedLargeFiles(body, headers["authorization"]);
 			case "b2_list_parts": return this.listParts(body);
 			case "b2_copy_part": return await this.copyPart(body);
 			case "b2_get_download_authorization": return this.getDownloadAuthorization(body);
@@ -1668,7 +1944,7 @@ var B2Simulator = class {
 		const resolved = await this.resolveUploadSha1(headers["x-bz-content-sha1"], data);
 		if ("status" in resolved) return resolved;
 		const { sha1: contentSha1, data: storedData } = resolved;
-		const serverSideEncryption = await uploadServerSideEncryption(headers, bucket.info.defaultServerSideEncryption);
+		const serverSideEncryption = await uploadServerSideEncryption(headers, bucketDefaultServerSideEncryptionForStorage(bucket.info));
 		if ("status" in serverSideEncryption) return serverSideEncryption;
 		const customUploadTimestamp = this.parseCustomUploadTimestamp(requestHeaderValue(headers, "x-bz-custom-upload-timestamp"));
 		if ("status" in customUploadTimestamp) return customUploadTimestamp;
@@ -1845,7 +2121,7 @@ var B2Simulator = class {
 	}
 	async resolveCopyDestinationEncryption(destinationBucket, requested) {
 		if (requested !== void 0) return await storedServerSideEncryption(requested);
-		return await storedServerSideEncryption(destinationBucket.info.defaultServerSideEncryption);
+		return await storedServerSideEncryption(bucketDefaultServerSideEncryptionForStorage(destinationBucket.info));
 	}
 	async validateCopyPartDestinationEncryption(large, encryption) {
 		if (encryption === void 0) return large.serverSideEncryption.mode === require_encryption.EncryptionMode.SseC ? this.error(400, "bad_request", "SSE-C destination copies require customer encryption") : null;
@@ -1973,9 +2249,11 @@ var B2Simulator = class {
 			}
 		};
 	}
-	createBucket(req) {
+	createBucket(req, authToken) {
 		const nameError = require_validation.validateBucketName(req.bucketName);
 		if (nameError) return this.error(400, nameError.code, nameError.message);
+		const bucketTypeError = require_validation.validateBucketType(req.bucketType);
+		if (bucketTypeError) return this.error(400, bucketTypeError.code, bucketTypeError.message);
 		const objectLockEnabled = nextObjectLockEnabled(false, req.fileLockEnabled);
 		if (typeof objectLockEnabled !== "boolean") return this.error(400, objectLockEnabled.code, objectLockEnabled.message);
 		const configError = validateBucketConfigurationFields(req, { objectLockEnabled });
@@ -1984,10 +2262,7 @@ var B2Simulator = class {
 		if (replicationKeyError !== null) return replicationKeyError;
 		for (const b of this.buckets.values()) if (b.info.bucketName === req.bucketName) return this.error(400, "duplicate_bucket_name", "Bucket name already in use");
 		const bid = require_ids.bucketId(this.genId("b2_bucket"));
-		const defaultRetention = req.defaultRetention ?? {
-			mode: require_bucket.BucketRetentionMode.None,
-			period: null
-		};
+		const defaultRetention = bucketDefaultRetentionForResponse(req.defaultRetention);
 		const info = {
 			accountId: require_ids.accountId(req.accountId),
 			bucketId: bid,
@@ -1995,7 +2270,7 @@ var B2Simulator = class {
 			bucketType: req.bucketType,
 			bucketInfo: req.bucketInfo ?? {},
 			corsRules: req.corsRules ?? [],
-			defaultServerSideEncryption: req.defaultServerSideEncryption ?? { mode: require_encryption.EncryptionMode.None },
+			defaultServerSideEncryption: publicBucketDefaultServerSideEncryption(req.defaultServerSideEncryption),
 			fileLockConfiguration: {
 				isClientAuthorizedToRead: true,
 				value: {
@@ -2006,11 +2281,7 @@ var B2Simulator = class {
 			lifecycleRules: req.lifecycleRules ?? [],
 			options: [],
 			revision: 1,
-			defaultRetention,
-			replicationConfiguration: req.replicationConfiguration === void 0 ? {
-				asReplicationSource: null,
-				asReplicationDestination: null
-			} : normalizeReplicationConfiguration(req.replicationConfiguration)
+			replicationConfiguration: wrapReplicationConfiguration(req.replicationConfiguration)
 		};
 		this.buckets.set(bid, {
 			info,
@@ -2018,25 +2289,25 @@ var B2Simulator = class {
 		});
 		return {
 			status: 200,
-			body: info
+			body: this.bucketInfoForResponse(info, authToken)
 		};
 	}
-	listBuckets(req) {
+	listBuckets(req, authToken) {
 		const bucketTypesError = require_validation.validateBucketTypes(req.bucketTypes);
 		if (bucketTypesError) return this.error(400, bucketTypesError.code, bucketTypesError.message);
 		return {
 			status: 200,
-			body: { buckets: [...this.buckets.values()].map((b) => b.info).filter((bucket) => req.bucketId === void 0 || bucket.bucketId === req.bucketId).filter((bucket) => req.bucketName === void 0 || bucket.bucketName === req.bucketName).filter((bucket) => req.bucketTypes === void 0 || req.bucketTypes.includes(bucket.bucketType)) }
+			body: { buckets: [...this.buckets.values()].map((b) => b.info).filter((bucket) => req.bucketId === void 0 || bucket.bucketId === req.bucketId).filter((bucket) => req.bucketName === void 0 || bucket.bucketName === req.bucketName).filter((bucket) => req.bucketTypes === void 0 || req.bucketTypes[0] === "all" || req.bucketTypes.some((bucketType) => bucketType === bucket.bucketType)).map((bucket) => this.bucketInfoForResponse(bucket, authToken)) }
 		};
 	}
-	deleteBucket(req) {
+	deleteBucket(req, authToken) {
 		const bucket = this.buckets.get(req.bucketId);
 		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
 		if (this.bucketHasContents(bucket)) return this.error(400, "cannot_delete_non_empty_bucket", "Bucket is not empty and cannot be deleted");
 		this.buckets.delete(req.bucketId);
 		return {
 			status: 200,
-			body: bucket.info
+			body: this.bucketInfoForResponse(bucket.info, authToken)
 		};
 	}
 	bucketHasContents(bucket) {
@@ -2044,7 +2315,7 @@ var B2Simulator = class {
 		for (const large of this.largeFiles.values()) if (large.bucketId === bucket.info.bucketId) return true;
 		return false;
 	}
-	updateBucket(req) {
+	updateBucket(req, authToken) {
 		const bucket = this.buckets.get(req["bucketId"]);
 		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
 		const revisionGuard = req["ifRevisionIs"];
@@ -2054,9 +2325,14 @@ var B2Simulator = class {
 		}
 		const objectLockEnabled = nextObjectLockEnabled(bucket.info.fileLockConfiguration.value?.isFileLockEnabled ?? false, req["fileLockEnabled"]);
 		if (typeof objectLockEnabled !== "boolean") return this.error(400, objectLockEnabled.code, objectLockEnabled.message);
+		if (req["bucketType"] !== void 0) {
+			const bucketTypeError = require_validation.validateBucketType(req["bucketType"]);
+			if (bucketTypeError) return this.error(400, bucketTypeError.code, bucketTypeError.message);
+		}
 		const configError = validateBucketConfigurationFields({
 			bucketInfo: req["bucketInfo"],
 			corsRules: req["corsRules"],
+			defaultServerSideEncryption: req["defaultServerSideEncryption"],
 			defaultRetention: req["defaultRetention"],
 			lifecycleRules: req["lifecycleRules"],
 			replicationConfiguration: req["replicationConfiguration"]
@@ -2070,25 +2346,22 @@ var B2Simulator = class {
 			...req["bucketInfo"] !== void 0 ? { bucketInfo: req["bucketInfo"] } : {},
 			...req["lifecycleRules"] !== void 0 ? { lifecycleRules: req["lifecycleRules"] } : {},
 			...req["corsRules"] !== void 0 ? { corsRules: req["corsRules"] } : {},
-			...req["replicationConfiguration"] !== void 0 ? { replicationConfiguration: normalizeReplicationConfiguration(req["replicationConfiguration"]) } : {},
-			...req["defaultRetention"] !== void 0 ? {
-				defaultRetention: req["defaultRetention"],
-				fileLockConfiguration: {
-					isClientAuthorizedToRead: true,
-					value: {
-						isFileLockEnabled: objectLockEnabled,
-						defaultRetention: req["defaultRetention"]
-					}
+			...req["replicationConfiguration"] !== void 0 ? { replicationConfiguration: wrapReplicationConfiguration(req["replicationConfiguration"]) } : {},
+			...req["defaultRetention"] !== void 0 ? { fileLockConfiguration: {
+				isClientAuthorizedToRead: true,
+				value: {
+					isFileLockEnabled: objectLockEnabled,
+					defaultRetention: bucketDefaultRetentionForResponse(req["defaultRetention"])
 				}
-			} : {},
+			} } : {},
 			...req["fileLockEnabled"] !== void 0 && req["defaultRetention"] === void 0 ? { fileLockConfiguration: {
 				isClientAuthorizedToRead: true,
 				value: {
 					isFileLockEnabled: objectLockEnabled,
-					defaultRetention: bucket.info.defaultRetention
+					defaultRetention: bucketDefaultRetention(bucket.info) ?? noBucketDefaultRetention()
 				}
 			} } : {},
-			...req["defaultServerSideEncryption"] !== void 0 ? { defaultServerSideEncryption: req["defaultServerSideEncryption"] } : {},
+			...req["defaultServerSideEncryption"] !== void 0 ? { defaultServerSideEncryption: publicBucketDefaultServerSideEncryption(req["defaultServerSideEncryption"]) } : {},
 			revision: bucket.info.revision + 1
 		};
 		this.buckets.set(req["bucketId"], {
@@ -2097,7 +2370,7 @@ var B2Simulator = class {
 		});
 		return {
 			status: 200,
-			body: updated
+			body: this.bucketInfoForResponse(updated, authToken)
 		};
 	}
 	async getUploadUrl(req, authToken) {
@@ -2123,7 +2396,13 @@ var B2Simulator = class {
 		if (countError) return this.error(400, countError.code, countError.message);
 		const max = req.maxFileCount ?? 1e3;
 		const prefix = req.prefix ?? "";
-		let allFiles = [...bucket.files.entries()].filter(([name]) => name.startsWith(prefix)).map(([_, versions]) => versions[versions.length - 1]).filter((v) => v !== void 0).map((v) => v.fileVersion).sort((a, b) => compareB2FileNames(a.fileName, b.fileName));
+		const currentVersions = [...bucket.files.entries()].filter(([name]) => name.startsWith(prefix)).map(([_, versions]) => versions[versions.length - 1]).filter((v) => v !== void 0).map((v) => v.fileVersion).filter((v) => v.action !== require_file.FileAction.Hide).sort((a, b) => compareB2FileNames(a.fileName, b.fileName));
+		let allFiles = this.applyListDelimiter({
+			bucketId: req.bucketId,
+			delimiter: req.delimiter,
+			entries: currentVersions,
+			prefix
+		});
 		if (req.startFileName) {
 			const start = req.startFileName;
 			allFiles = allFiles.filter((f) => f.fileName >= start);
@@ -2143,11 +2422,17 @@ var B2Simulator = class {
 		if (countError) return this.error(400, countError.code, countError.message);
 		const max = req.maxFileCount ?? 1e3;
 		const prefix = req.prefix ?? "";
-		const allVersions = [...bucket.files.entries()].filter(([name]) => name.startsWith(prefix)).flatMap(([_, versions]) => versions.map((v) => v.fileVersion)).sort((a, b) => {
+		const versions = [...bucket.files.entries()].filter(([name]) => name.startsWith(prefix)).flatMap(([_, versions]) => versions.map((v) => v.fileVersion)).sort((a, b) => {
 			const nameCmp = compareB2FileNames(a.fileName, b.fileName);
 			if (nameCmp !== 0) return nameCmp;
 			return b.uploadTimestamp - a.uploadTimestamp;
 		});
+		const allVersions = this.applyListDelimiter({
+			bucketId: req.bucketId,
+			delimiter: req.delimiter,
+			entries: versions,
+			prefix
+		});
 		let startIdx = 0;
 		if (req.startFileName !== void 0) {
 			const startName = req.startFileName;
@@ -2170,6 +2455,48 @@ var B2Simulator = class {
 			}
 		};
 	}
+	applyListDelimiter(params) {
+		if (params.delimiter === void 0 || params.delimiter === "") return params.entries.map((entry) => this.toListEntry(entry));
+		const grouped = [];
+		const seenFolders = /* @__PURE__ */ new Set();
+		for (const entry of params.entries) {
+			const delimiterIndex = entry.fileName.indexOf(params.delimiter, params.prefix.length);
+			if (delimiterIndex === -1) {
+				grouped.push(this.toListEntry(entry));
+				continue;
+			}
+			const folderName = entry.fileName.slice(0, delimiterIndex + params.delimiter.length);
+			if (!seenFolders.has(folderName)) {
+				seenFolders.add(folderName);
+				grouped.push(this.makeFolderListEntry(params.bucketId, folderName));
+			}
+		}
+		return grouped.sort(compareFileVersionListEntries);
+	}
+	toListEntry(entry) {
+		if (entry.action !== require_file.FileAction.Hide) return entry;
+		const { contentType: _contentType, fileRetention, legalHold, serverSideEncryption, ...listed } = entry;
+		return {
+			...listed,
+			action: require_file.FileAction.Hide,
+			contentType: require_file.HIDE_MARKER_CONTENT_TYPE
+		};
+	}
+	makeFolderListEntry(bucketId$1, fileName) {
+		return {
+			accountId: require_ids.accountId(this.accountId),
+			action: require_file.FileAction.Folder,
+			bucketId: require_ids.bucketId(bucketId$1),
+			contentLength: 0,
+			contentMd5: null,
+			contentSha1: null,
+			contentType: null,
+			fileId: null,
+			fileInfo: {},
+			fileName,
+			uploadTimestamp: 0
+		};
+	}
 	getFileInfo(req) {
 		const found = this.findFile(req.fileId);
 		if (found === null) return this.error(404, "file_not_present", "File not found");
@@ -2186,7 +2513,7 @@ var B2Simulator = class {
 		const fileVersion = this.makeFileVersion({
 			bucketId: req.bucketId,
 			fileName: req.fileName,
-			contentType: "application/octet-stream",
+			contentType: require_file.HIDE_MARKER_CONTENT_TYPE,
 			contentLength: 0,
 			contentSha1: "none",
 			action: require_file.FileAction.Hide
@@ -2290,7 +2617,7 @@ var B2Simulator = class {
 			body: fileVersion
 		};
 	}
-	async startLargeFile(req) {
+	async startLargeFile(req, authToken) {
 		const bucket = this.buckets.get(req.bucketId);
 		if (!bucket) return this.error(400, "bad_bucket_id", "Bucket not found");
 		const nameError = require_validation.validateFileName(req.fileName);
@@ -2303,7 +2630,7 @@ var B2Simulator = class {
 		if ("status" in customUploadTimestamp) return customUploadTimestamp;
 		const fid = this.genId("4_z");
 		const uploadTimestamp = customUploadTimestamp.timestamp ?? this.monotonicTimestamp();
-		const serverSideEncryption = await storedServerSideEncryption(req.serverSideEncryption ?? bucket.info.defaultServerSideEncryption);
+		const serverSideEncryption = await storedServerSideEncryption(req.serverSideEncryption ?? bucketDefaultServerSideEncryptionForStorage(bucket.info));
 		if ("status" in serverSideEncryption) return serverSideEncryption;
 		const replicationStatus = this.replicationStatusForNewFile(req.bucketId, req.fileName);
 		const large = {
@@ -2312,7 +2639,7 @@ var B2Simulator = class {
 			fileName: req.fileName,
 			contentType: req.contentType,
 			fileInfo: req.fileInfo ?? {},
-			fileRetention: req.fileRetention ?? defaultFileRetention(bucket.info.defaultRetention, uploadTimestamp),
+			fileRetention: req.fileRetention ?? defaultFileRetention(bucketDefaultRetention(bucket.info), uploadTimestamp),
 			legalHold: req.legalHold ?? null,
 			...this.replicationStatusMetadataFor(replicationStatus),
 			serverSideEncryption,
@@ -2333,14 +2660,8 @@ var B2Simulator = class {
 				contentLength: 0,
 				contentSha1: "none",
 				contentMd5: null,
-				fileRetention: {
-					isClientAuthorizedToRead: true,
-					value: large.fileRetention
-				},
-				legalHold: {
-					isClientAuthorizedToRead: true,
-					value: large.legalHold
-				},
+				fileRetention: readableFileRetention(large.fileRetention, this.requestHasCapability(authToken, require_auth.Capability.ReadFileRetentions)),
+				legalHold: readableLegalHold(large.legalHold, this.requestHasCapability(authToken, require_auth.Capability.ReadFileLegalHolds)),
 				...this.replicationStatusMetadataFor(large.replicationStatus),
 				serverSideEncryption: publicServerSideEncryption(large.serverSideEncryption),
 				uploadTimestamp: large.uploadTimestamp
@@ -2427,7 +2748,7 @@ var B2Simulator = class {
 			}
 		};
 	}
-	listUnfinishedLargeFiles(req) {
+	listUnfinishedLargeFiles(req, authToken) {
 		const countError = require_validation.validateMaxCount(req.maxFileCount, "b2_list_unfinished_large_files");
 		if (countError) return this.error(400, countError.code, countError.message);
 		const prefix = req.namePrefix ?? "";
@@ -2438,10 +2759,13 @@ var B2Simulator = class {
 			const found = candidates.findIndex((f) => f.fileId === req.startFileId);
 			startIndex = found >= 0 ? found : 0;
 		}
+		const slice = candidates.slice(startIndex, startIndex + max);
+		const canReadFileRetentions = this.requestHasCapability(authToken, require_auth.Capability.ReadFileRetentions);
+		const canReadFileLegalHolds = this.requestHasCapability(authToken, require_auth.Capability.ReadFileLegalHolds);
 		return {
 			status: 200,
 			body: {
-				files: candidates.slice(startIndex, startIndex + max).map((f) => ({
+				files: slice.map((f) => ({
 					fileId: f.fileId,
 					fileName: f.fileName,
 					accountId: this.accountId,
@@ -2452,14 +2776,8 @@ var B2Simulator = class {
 					contentSha1: "none",
 					contentMd5: null,
 					fileInfo: f.fileInfo,
-					fileRetention: {
-						isClientAuthorizedToRead: true,
-						value: f.fileRetention
-					},
-					legalHold: {
-						isClientAuthorizedToRead: true,
-						value: f.legalHold
-					},
+					fileRetention: readableFileRetention(f.fileRetention, canReadFileRetentions),
+					legalHold: readableLegalHold(f.legalHold, canReadFileLegalHolds),
 					...this.replicationStatusMetadataFor(f.replicationStatus),
 					serverSideEncryption: publicServerSideEncryption(f.serverSideEncryption),
 					uploadTimestamp: f.uploadTimestamp
@@ -2814,7 +3132,7 @@ var B2Simulator = class {
 		return this.matchingEnabledReplicationRules(bucketId, fileName).length > 0 ? "PENDING" : void 0;
 	}
 	matchingEnabledReplicationRules(bucketId, fileName) {
-		return (this.buckets.get(bucketId)?.info.replicationConfiguration.asReplicationSource?.replicationRules)?.filter((rule) => rule.isEnabled && fileName.startsWith(rule.fileNamePrefix)) ?? [];
+		return (this.buckets.get(bucketId)?.info.replicationConfiguration.value?.asReplicationSource?.replicationRules)?.filter((rule) => rule.isEnabled && fileName.startsWith(rule.fileNamePrefix)) ?? [];
 	}
 	error(status, code, message) {
 		return {
@@ -3083,6 +3401,7 @@ var SimulatorTransport = class {
 				result = "error" in uploadBody ? uploadBody.error : await this.sim.handleUpload(url, headers, uploadBody.data);
 			}
 		} else {
+			const requestPath = apiPathParts(parsedUrl.pathname);
 			let body = null;
 			if (request.body) {
 				const text = typeof request.body === "string" ? request.body : await new Response(request.body).text();
@@ -3091,7 +3410,7 @@ var SimulatorTransport = class {
 				} catch {
 					body = text;
 				}
-			} else if (request.method.toUpperCase() === "GET" && require_partner.isPartnerQueryEndpoint(apiPathParts(parsedUrl.pathname).endpoint)) body = queryParamsBody(parsedUrl.searchParams);
+			} else if (request.method.toUpperCase() === "GET" && isJsonQueryEndpoint(requestPath.endpoint)) body = queryParamsBody(parsedUrl.searchParams, requestPath.endpoint);
 			result = await this.sim.handleRequest(request.method, parsedUrl.origin, parsedUrl.pathname, headers, body);
 		}
 		const responseBody = JSON.stringify(result.body);
@@ -3110,10 +3429,22 @@ var SimulatorTransport = class {
 };
 //#endregion
 exports.B2Simulator = B2Simulator;
+exports.BUCKET_INFO_KEY_MAX_BYTES = require_bucket.BUCKET_INFO_KEY_MAX_BYTES;
+exports.BUCKET_INFO_KEY_MIN_BYTES = require_bucket.BUCKET_INFO_KEY_MIN_BYTES;
+exports.BUCKET_INFO_KEY_PATTERN = require_bucket.BUCKET_INFO_KEY_PATTERN;
 exports.BUCKET_INFO_MAX_KEYS = require_validation.BUCKET_INFO_MAX_KEYS;
+exports.BUCKET_INFO_RESERVED_PREFIX = require_bucket.BUCKET_INFO_RESERVED_PREFIX;
+exports.BUCKET_INFO_VALUES_MAX_BYTES = require_bucket.BUCKET_INFO_VALUES_MAX_BYTES;
 exports.BUCKET_INFO_VALUE_MAX = require_validation.BUCKET_INFO_VALUE_MAX;
 exports.BUCKET_NAME_MAX = require_b2_naming.BUCKET_NAME_MAX;
 exports.BUCKET_NAME_MIN = require_b2_naming.BUCKET_NAME_MIN;
+exports.CORS_MAX_AGE_SECONDS_MAX = require_bucket.CORS_MAX_AGE_SECONDS_MAX;
+exports.CORS_RULES_MAX_COUNT = require_bucket.CORS_RULES_MAX_COUNT;
+exports.CORS_RULE_MAX_BYTES = require_bucket.CORS_RULE_MAX_BYTES;
+exports.CORS_RULE_NAME_MAX_LENGTH = require_bucket.CORS_RULE_NAME_MAX_LENGTH;
+exports.CORS_RULE_NAME_MIN_LENGTH = require_bucket.CORS_RULE_NAME_MIN_LENGTH;
+exports.CORS_RULE_NAME_PATTERN = require_bucket.CORS_RULE_NAME_PATTERN;
+exports.CORS_RULE_NAME_RESERVED_PREFIX = require_bucket.CORS_RULE_NAME_RESERVED_PREFIX;
 exports.DOWNLOAD_AUTH_DURATION_MAX_SECONDS = require_validation.DOWNLOAD_AUTH_DURATION_MAX_SECONDS;
 exports.DOWNLOAD_AUTH_DURATION_MIN_SECONDS = require_validation.DOWNLOAD_AUTH_DURATION_MIN_SECONDS;
 exports.FILE_INFO_TOTAL_MAX = require_validation.FILE_INFO_TOTAL_MAX;