@cloud-cli/s3mini 1.42.0

package/dist/storage/s3mini.js

@@ -0,0 +1,960 @@
+import { DatabaseSync } from 'node:sqlite';
+import path from 'path';
+import fs from 'fs/promises';
+import crypto from 'crypto';
+import { S3Error } from '../types/models.js';
+import { VALID_LOCATION_CONSTRAINTS } from '../types/models.js';
+export const STORAGE_BASE = '/data/objects';
+export const DATABASE_PATH = '/data/s3mini.sqlite';
+export const NODE_ID = process.env.S3MINI_NODE_ID || 'node-local';
+export const REPLICATION_MAX_ATTEMPTS = 8;
+export class S3Mini {
+    db;
+    initialized = false;
+    constructor() { }
+    versionPath(bucket, key, versionId) {
+        return path.join(STORAGE_BASE, bucket, '.versions', versionId, key);
+    }
+    validateKey(key) {
+        if (!key || path.isAbsolute(key) || key.split('/').some(part => part === '..')) {
+            throw new S3Error('InvalidObjectName', 'The object key is invalid.', 400, undefined, key);
+        }
+    }
+    async init() {
+        if (this.initialized)
+            return;
+        await fs.mkdir(STORAGE_BASE, { recursive: true });
+        try {
+            await fs.access(DATABASE_PATH);
+        }
+        catch {
+            try {
+                await fs.copyFile(path.join(STORAGE_BASE, 'meta.db'), DATABASE_PATH);
+            }
+            catch { /* Start with a new database. */ }
+        }
+        this.db = new DatabaseSync(DATABASE_PATH);
+        this.db.exec('PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL');
+        await this.run(`CREATE TABLE IF NOT EXISTS buckets (
+      name TEXT PRIMARY KEY,
+      locationConstraint TEXT DEFAULT 'us-east-1',
+      creationDate INTEGER
+    )`);
+        await this.run(`CREATE TABLE IF NOT EXISTS objs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      bucket TEXT NOT NULL,
+      key TEXT NOT NULL,
+      etag TEXT,
+       contentType TEXT,
+       contentLanguage TEXT,
+      contentDisposition TEXT,
+      contentEncoding TEXT,
+      cacheControl TEXT,
+      expires INTEGER,
+      lastModified INTEGER,
+      size INTEGER,
+      storageClass TEXT DEFAULT 'STANDARD',
+      versionId TEXT,
+      ownerId TEXT DEFAULT '000000000000000000000000',
+      ownerDisplayName TEXT DEFAULT 's3mini',
+      UNIQUE(bucket, key, versionId)
+    )`);
+        await this.run(`CREATE TABLE IF NOT EXISTS tags (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      bucket TEXT NOT NULL,
+      key TEXT NOT NULL,
+      name TEXT NOT NULL,
+      value TEXT NOT NULL,
+      UNIQUE(bucket, key, name)
+    )`);
+        for (const column of ['contentLanguage TEXT', 'encryption TEXT', 'sseKmsKeyId TEXT', 'objectLockMode TEXT', 'retainUntil INTEGER', 'legalHold TEXT', 'deleteMarker INTEGER', 'userMetadata TEXT']) {
+            try {
+                await this.run(`ALTER TABLE objs ADD COLUMN ${column}`);
+            }
+            catch { /* Existing databases already have the column. */ }
+        }
+        await this.run(`CREATE TABLE IF NOT EXISTS multipart_uploads (
+      uploadId TEXT PRIMARY KEY,
+      bucket TEXT NOT NULL,
+      key TEXT NOT NULL,
+      initiated INTEGER NOT NULL,
+      storageClass TEXT NOT NULL DEFAULT 'STANDARD'
+    )`);
+        await this.run(`CREATE TABLE IF NOT EXISTS multipart_parts (
+      uploadId TEXT NOT NULL,
+      partNumber INTEGER NOT NULL,
+      etag TEXT NOT NULL,
+      size INTEGER NOT NULL,
+      lastModified INTEGER NOT NULL,
+      body BLOB NOT NULL,
+      PRIMARY KEY(uploadId, partNumber)
+    )`);
+        await this.run(`CREATE TABLE IF NOT EXISTS bucket_settings (
+      bucket TEXT PRIMARY KEY,
+      versioningStatus TEXT,
+      bucketTags TEXT,
+      corsConfiguration TEXT,
+      lifecycleConfiguration TEXT,
+      policy TEXT,
+      encryptionConfiguration TEXT,
+      websiteConfiguration TEXT,
+      loggingStatus TEXT,
+      notificationConfiguration TEXT,
+      replicationConfiguration TEXT
+      ,acl TEXT
+    )`);
+        try {
+            await this.run('ALTER TABLE bucket_settings ADD COLUMN acl TEXT');
+        }
+        catch { /* Existing databases already have the column. */ }
+        await this.run(`CREATE TABLE IF NOT EXISTS object_tags (
+      bucket TEXT NOT NULL,
+      key TEXT NOT NULL,
+      versionId TEXT NOT NULL DEFAULT '',
+      tags TEXT NOT NULL,
+      PRIMARY KEY(bucket, key, versionId)
+    )`);
+        await this.run(`CREATE TABLE IF NOT EXISTS object_acl (
+      bucket TEXT NOT NULL,
+      key TEXT NOT NULL,
+      versionId TEXT NOT NULL DEFAULT '',
+      acl TEXT NOT NULL,
+      PRIMARY KEY(bucket, key, versionId)
+    )`);
+        await this.run(`CREATE TABLE IF NOT EXISTS access_keys (
+      accessKeyId TEXT PRIMARY KEY,
+      secretAccessKey TEXT NOT NULL,
+      displayName TEXT NOT NULL DEFAULT '',
+      status TEXT NOT NULL DEFAULT 'Active',
+      createdAt INTEGER NOT NULL,
+      lastUsedAt INTEGER
+    )`);
+        await this.run(`CREATE TABLE IF NOT EXISTS replication_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      bucket TEXT NOT NULL,
+      key TEXT NOT NULL,
+      versionId TEXT NOT NULL,
+      operation TEXT NOT NULL,
+      sourceNodeId TEXT NOT NULL,
+      payloadPath TEXT NOT NULL,
+      etag TEXT NOT NULL,
+      size INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'Pending',
+      attempts INTEGER NOT NULL DEFAULT 0,
+      nextAttemptAt INTEGER,
+      deleteMarker INTEGER NOT NULL DEFAULT 0,
+      sha256 TEXT,
+      leaseOwner TEXT,
+      leaseUntil INTEGER,
+      createdAt INTEGER NOT NULL,
+      UNIQUE(bucket, key, versionId, operation, sourceNodeId)
+    )`);
+        try {
+            await this.run('ALTER TABLE replication_events ADD COLUMN deleteMarker INTEGER NOT NULL DEFAULT 0');
+        }
+        catch { /* Existing databases already have the column. */ }
+        try {
+            await this.run('ALTER TABLE replication_events ADD COLUMN sha256 TEXT');
+        }
+        catch { /* Existing databases already have the column. */ }
+        try {
+            await this.run('ALTER TABLE replication_events ADD COLUMN leaseOwner TEXT');
+        }
+        catch { /* Existing databases already have the column. */ }
+        try {
+            await this.run('ALTER TABLE replication_events ADD COLUMN leaseUntil INTEGER');
+        }
+        catch { /* Existing databases already have the column. */ }
+        await this.run(`CREATE TABLE IF NOT EXISTS replication_peer_health (
+      peer TEXT PRIMARY KEY,
+      status TEXT NOT NULL DEFAULT 'Unknown',
+      consecutiveFailures INTEGER NOT NULL DEFAULT 0,
+      lastSuccessAt INTEGER,
+      lastFailureAt INTEGER
+    )`);
+        this.initialized = true;
+    }
+    async run(sql, params = []) {
+        this.db?.prepare(sql).run(...params);
+    }
+    async get(sql, params = []) {
+        return this.db?.prepare(sql).get(...params);
+    }
+    async all(sql, params = []) {
+        return (this.db?.prepare(sql).all(...params) || []);
+    }
+    async listBuckets() {
+        const rows = await this.all('SELECT * FROM buckets');
+        return rows.map((r) => ({
+            name: r.name,
+            locationConstraint: r.locationConstraint,
+            creationDate: new Date(r.creationDate),
+        }));
+    }
+    async applyLifecycle(bucket) {
+        const configuration = await this.getBucketConfiguration(bucket, 'lifecycleConfiguration');
+        if (!configuration?.rules?.length)
+            return;
+        const rows = await this.all('SELECT * FROM objs WHERE bucket = ?', [bucket]);
+        const now = Date.now();
+        const versioning = await this.getVersioning(bucket);
+        const rowsByKey = new Map();
+        for (const row of rows) {
+            const versions = rowsByKey.get(row.key) || [];
+            versions.push(row);
+            rowsByKey.set(row.key, versions);
+        }
+        for (const [key, versions] of rowsByKey) {
+            versions.sort((left, right) => right.id - left.id);
+            for (const [index, row] of versions.entries()) {
+                const noncurrent = index > 0;
+                const rule = configuration.rules.find(candidate => lifecycleRuleMatches(candidate, row.key));
+                if (!rule)
+                    continue;
+                const transition = lifecycleTransition(rule, noncurrent, row.lastModified, now);
+                if (transition && row.storageClass !== transition) {
+                    await this.run('UPDATE objs SET storageClass = ? WHERE id = ?', [transition, row.id]);
+                }
+                const expiration = noncurrent ? rule.noncurrentVersionExpiration : rule.expiration;
+                if (!expiration || !lifecycleAgeReached(expiration, row.lastModified, now))
+                    continue;
+                if (row.deleteMarker && !expiration.expiredObjectDeleteMarker)
+                    continue;
+                if (noncurrent || !versioning.status || row.deleteMarker) {
+                    await this.removeObjectVersion(bucket, row, !noncurrent && !versioning.status);
+                    continue;
+                }
+                // Versioned lifecycle expiration hides the current version with a marker.
+                await this.run('INSERT INTO objs (bucket, key, etag, lastModified, size, storageClass, versionId, ownerId, ownerDisplayName, deleteMarker) VALUES (?, ?, NULL, ?, 0, ?, ?, ?, ?, 1)', [bucket, key, now, 'STANDARD', crypto.randomBytes(8).toString('hex') + '+', '000000000000000000000000', 's3mini']);
+                await fs.rm(path.join(STORAGE_BASE, bucket, key), { force: true });
+            }
+        }
+    }
+    async removeObjectVersion(bucket, row, removeCurrentFile = false) {
+        await this.run('DELETE FROM objs WHERE id = ?', [row.id]);
+        await this.run('DELETE FROM object_tags WHERE bucket = ? AND key = ? AND versionId = ?', [bucket, row.key, row.versionId]);
+        await this.run('DELETE FROM object_acl WHERE bucket = ? AND key = ? AND versionId = ?', [bucket, row.key, row.versionId]);
+        await fs.rm(this.versionPath(bucket, row.key, row.versionId), { force: true });
+        if (row.deleteMarker || removeCurrentFile)
+            await fs.rm(path.join(STORAGE_BASE, bucket, row.key), { force: true });
+    }
+    async createBucket(name, locationConstraint = 'us-east-1') {
+        if (!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(name) || name.includes('..') || name.includes('.-') || name.includes('-.')) {
+            throw new S3Error('InvalidBucketName', 'The bucket name is invalid.', 400, name);
+        }
+        if (!VALID_LOCATION_CONSTRAINTS.includes(locationConstraint)) {
+            throw new S3Error('InvalidLocationConstraint', 'The location constraint is invalid.', 400, name);
+        }
+        const exists = await this.get('SELECT name FROM buckets WHERE name = ?', [name]);
+        if (exists)
+            throw new S3Error('BucketAlreadyExists', 'Bucket already exists.', 409, name);
+        await this.run('INSERT INTO buckets (name, locationConstraint, creationDate) VALUES (?, ?, ?)', [name, locationConstraint, Date.now()]);
+        await this.run('INSERT INTO bucket_settings (bucket, versioningStatus) VALUES (?, ?)', [name, null]);
+        await fs.mkdir(path.join(STORAGE_BASE, name), { recursive: true });
+    }
+    async headBucket(name) {
+        const bucket = await this.get('SELECT name FROM buckets WHERE name = ?', [name]);
+        if (!bucket)
+            throw new S3Error('NoSuchBucket', 'Bucket not found', 404, name);
+    }
+    async deleteBucket(name) {
+        const bucket = await this.get('SELECT name FROM buckets WHERE name = ?', [name]);
+        if (!bucket)
+            throw new S3Error('NoSuchBucket', 'Bucket not found', 404, name);
+        const object = await this.get('SELECT id FROM objs WHERE bucket = ? LIMIT 1', [name]);
+        if (object)
+            throw new S3Error('BucketNotEmpty', 'The bucket you tried to delete is not empty.', 409, name);
+        await this.run('DELETE FROM objs WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM tags WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM object_tags WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM object_acl WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM replication_events WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM bucket_settings WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM buckets WHERE name = ?', [name]);
+        await fs.rm(path.join(STORAGE_BASE, name), { recursive: true, force: true });
+    }
+    async close() {
+        if (!this.db)
+            return;
+        this.db.close();
+        this.db = undefined;
+        this.initialized = false;
+    }
+    async createAccessKey(displayName = '') {
+        const accessKeyId = `s3mini-${crypto.randomBytes(12).toString('base64url')}`;
+        const secretAccessKey = crypto.randomBytes(32).toString('base64url');
+        await this.run('INSERT INTO access_keys (accessKeyId, secretAccessKey, displayName, status, createdAt) VALUES (?, ?, ?, ?, ?)', [accessKeyId, secretAccessKey, displayName, 'Active', Date.now()]);
+        return { accessKeyId, secretAccessKey };
+    }
+    async listAccessKeys() {
+        const rows = await this.all('SELECT accessKeyId, displayName, status, createdAt, lastUsedAt FROM access_keys ORDER BY createdAt DESC');
+        return rows.map(row => ({
+            accessKeyId: row.accessKeyId,
+            displayName: row.displayName,
+            status: row.status,
+            createdAt: new Date(row.createdAt),
+            lastUsedAt: row.lastUsedAt ? new Date(row.lastUsedAt) : undefined,
+        }));
+    }
+    async getAccessKey(accessKeyId) {
+        const row = await this.get('SELECT accessKeyId, secretAccessKey, status FROM access_keys WHERE accessKeyId = ?', [accessKeyId]);
+        return row ? { accessKeyId: row.accessKeyId, secretAccessKey: row.secretAccessKey, status: row.status } : undefined;
+    }
+    async setAccessKeyStatus(accessKeyId, status) {
+        await this.run('UPDATE access_keys SET status = ? WHERE accessKeyId = ?', [status, accessKeyId]);
+    }
+    async markAccessKeyUsed(accessKeyId) {
+        await this.run('UPDATE access_keys SET lastUsedAt = ? WHERE accessKeyId = ?', [Date.now(), accessKeyId]);
+    }
+    async hasActiveAccessKeys() {
+        return Boolean(await this.get("SELECT 1 FROM access_keys WHERE status = 'Active' LIMIT 1"));
+    }
+    async listReplicationEvents(limit = 100, status) {
+        const rows = status
+            ? await this.all('SELECT * FROM replication_events WHERE status = ? ORDER BY id ASC LIMIT ?', [status, Math.max(1, Math.min(limit, 1000))])
+            : await this.all('SELECT * FROM replication_events ORDER BY id ASC LIMIT ?', [Math.max(1, Math.min(limit, 1000))]);
+        return rows.map(row => this.replicationEventFromRow(row));
+    }
+    replicationEventFromRow(row) {
+        return {
+            id: row.id,
+            bucket: row.bucket,
+            key: row.key,
+            versionId: row.versionId,
+            operation: row.operation,
+            sourceNodeId: row.sourceNodeId,
+            payloadPath: row.payloadPath,
+            etag: row.etag,
+            sha256: row.sha256 || undefined,
+            size: row.size,
+            deleteMarker: Boolean(row.deleteMarker),
+            status: row.status,
+            attempts: row.attempts,
+            nextAttemptAt: row.nextAttemptAt ? new Date(row.nextAttemptAt) : undefined,
+            createdAt: new Date(row.createdAt),
+        };
+    }
+    async listReplicationInventory(limit = 1000) {
+        const rows = await this.all('SELECT bucket, key, versionId, etag, size, lastModified, deleteMarker FROM objs ORDER BY bucket, key, lastModified, id LIMIT ?', [Math.max(1, Math.min(limit, 10000))]);
+        return Promise.all(rows.map(async (row) => ({
+            bucket: row.bucket,
+            key: row.key,
+            versionId: row.versionId,
+            etag: row.etag || '',
+            sha256: row.deleteMarker ? '' : crypto.createHash('sha256').update(await fs.readFile(this.versionPath(row.bucket, row.key, row.versionId))).digest('hex'),
+            size: row.size,
+            lastModified: new Date(row.lastModified),
+            deleteMarker: Boolean(row.deleteMarker),
+        })));
+    }
+    async listPeerHealth() {
+        const rows = await this.all('SELECT * FROM replication_peer_health ORDER BY peer ASC');
+        return rows.map(row => ({
+            peer: row.peer,
+            status: row.status,
+            consecutiveFailures: row.consecutiveFailures,
+            lastSuccessAt: row.lastSuccessAt ? new Date(row.lastSuccessAt) : undefined,
+            lastFailureAt: row.lastFailureAt ? new Date(row.lastFailureAt) : undefined,
+        }));
+    }
+    async savePeerHealth(state) {
+        await this.run(`INSERT INTO replication_peer_health (peer, status, consecutiveFailures, lastSuccessAt, lastFailureAt)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(peer) DO UPDATE SET status = excluded.status, consecutiveFailures = excluded.consecutiveFailures, lastSuccessAt = excluded.lastSuccessAt, lastFailureAt = excluded.lastFailureAt`, [
+            state.peer, state.status, state.consecutiveFailures, state.lastSuccessAt?.getTime() || null, state.lastFailureAt?.getTime() || null,
+        ]);
+    }
+    async updateReplicationEvent(id, status, attempts, nextAttemptAt) {
+        await this.run('UPDATE replication_events SET status = ?, attempts = ?, nextAttemptAt = ?, leaseOwner = NULL, leaseUntil = NULL WHERE id = ?', [status, attempts, nextAttemptAt?.getTime() || null, id]);
+    }
+    async retryReplicationEvent(id) {
+        await this.run("UPDATE replication_events SET status = 'Pending', attempts = 0, nextAttemptAt = NULL, leaseOwner = NULL, leaseUntil = NULL WHERE id = ? AND status = 'DeadLetter'", [id]);
+    }
+    async claimReplicationEvents(owner, limit = 100, leaseMs = 60_000) {
+        const now = Date.now();
+        this.db?.exec('BEGIN IMMEDIATE');
+        try {
+            await this.run(`UPDATE replication_events SET leaseOwner = ?, leaseUntil = ?
+        WHERE id IN (SELECT id FROM replication_events
+          WHERE status NOT IN ('Delivered', 'DeadLetter') AND (nextAttemptAt IS NULL OR nextAttemptAt <= ?)
+            AND (leaseUntil IS NULL OR leaseUntil <= ?)
+          ORDER BY id ASC LIMIT ?)`, [owner, now + leaseMs, now, now, Math.max(1, Math.min(limit, 1000))]);
+            const rows = await this.all('SELECT * FROM replication_events WHERE leaseOwner = ? AND leaseUntil = ? ORDER BY id ASC', [owner, now + leaseMs]);
+            this.db?.exec('COMMIT');
+            return rows.map(row => this.replicationEventFromRow(row));
+        }
+        catch (error) {
+            this.db?.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    async queueReplicationEvent(event) {
+        await this.run('INSERT OR IGNORE INTO replication_events (bucket, key, versionId, operation, sourceNodeId, payloadPath, etag, size, deleteMarker, sha256, createdAt) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', [event.bucket, event.key, event.versionId, event.operation, event.sourceNodeId, event.payloadPath, event.etag, event.size, event.deleteMarker ? 1 : 0, event.sha256 || null, event.createdAt.getTime()]);
+    }
+    async readReplicationPayload(event) {
+        return fs.readFile(event.payloadPath);
+    }
+    async acceptReplicatedObject(object) {
+        this.validateKey(object.key);
+        if (!/^[A-Za-z0-9._+-]+$/.test(object.versionId))
+            throw new S3Error('InvalidRequest', 'The replicated version ID is invalid.', 400, object.bucket, object.key);
+        if ('"' + crypto.createHash('md5').update(object.body).digest('hex') + '"' !== object.etag)
+            throw new S3Error('BadDigest', 'The replicated object ETag did not match its body.', 400, object.bucket, object.key);
+        const sha256 = crypto.createHash('sha256').update(object.body).digest('hex');
+        if (object.sha256 && object.sha256 !== sha256)
+            throw new S3Error('BadDigest', 'The replicated object SHA-256 digest did not match its body.', 400, object.bucket, object.key);
+        if (!(await this.get('SELECT name FROM buckets WHERE name = ?', [object.bucket])))
+            throw new S3Error('NoSuchBucket', 'Bucket not found', 404, object.bucket);
+        if (await this.get('SELECT id FROM objs WHERE bucket = ? AND key = ? AND versionId = ?', [object.bucket, object.key, object.versionId]))
+            return;
+        const filePath = path.join(STORAGE_BASE, object.bucket, object.key);
+        const versionFilePath = this.versionPath(object.bucket, object.key, object.versionId);
+        await fs.mkdir(path.dirname(filePath), { recursive: true });
+        await fs.mkdir(path.dirname(versionFilePath), { recursive: true });
+        await writeDurableFile(versionFilePath, object.body);
+        const current = await this.get('SELECT lastModified FROM objs WHERE bucket = ? AND key = ? ORDER BY lastModified DESC, id DESC LIMIT 1', [object.bucket, object.key]);
+        if (!current || object.lastModified >= current.lastModified)
+            await writeDurableFile(filePath, object.body);
+        this.db?.exec('BEGIN IMMEDIATE');
+        try {
+            await this.run('INSERT INTO objs (bucket, key, etag, contentType, lastModified, size, storageClass, versionId, ownerId, ownerDisplayName, deleteMarker, userMetadata) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', [object.bucket, object.key, object.etag, 'application/octet-stream', object.lastModified, object.body.length, 'STANDARD', object.versionId, '000000000000000000000000', 's3mini', 0, '{}']);
+            this.db?.exec('COMMIT');
+        }
+        catch (error) {
+            this.db?.exec('ROLLBACK');
+            await fs.rm(versionFilePath, { force: true });
+            throw error;
+        }
+    }
+    async acceptReplicatedDelete(event) {
+        this.validateKey(event.key);
+        if (!(await this.get('SELECT name FROM buckets WHERE name = ?', [event.bucket])))
+            throw new S3Error('NoSuchBucket', 'Bucket not found', 404, event.bucket);
+        if (event.deleteMarker) {
+            if (await this.get('SELECT id FROM objs WHERE bucket = ? AND key = ? AND versionId = ?', [event.bucket, event.key, event.versionId]))
+                return;
+            await this.run('INSERT INTO objs (bucket, key, etag, lastModified, size, storageClass, versionId, ownerId, ownerDisplayName, deleteMarker, userMetadata) VALUES (?, ?, NULL, ?, 0, ?, ?, ?, ?, 1, ?)', [event.bucket, event.key, event.lastModified, 'STANDARD', event.versionId, '000000000000000000000000', 's3mini', '{}']);
+            await fs.rm(path.join(STORAGE_BASE, event.bucket, event.key), { force: true });
+            return;
+        }
+        if (event.versionId) {
+            const row = await this.get('SELECT id FROM objs WHERE bucket = ? AND key = ? AND versionId = ?', [event.bucket, event.key, event.versionId]);
+            if (row)
+                await this.deleteReplicatedVersion(event.bucket, event.key, event.versionId, row.id);
+            return;
+        }
+        await this.run('DELETE FROM objs WHERE bucket = ? AND key = ?', [event.bucket, event.key]);
+        await fs.rm(path.join(STORAGE_BASE, event.bucket, event.key), { force: true });
+    }
+    async deleteReplicatedVersion(bucket, key, versionId, id) {
+        await this.run('DELETE FROM objs WHERE id = ?', [id]);
+        await this.run('DELETE FROM object_tags WHERE bucket = ? AND key = ? AND versionId = ?', [bucket, key, versionId]);
+        await fs.rm(this.versionPath(bucket, key, versionId), { force: true });
+    }
+    async clearBucket(name) {
+        await this.run('DELETE FROM objs WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM tags WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM object_tags WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM object_acl WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM replication_events WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM bucket_settings WHERE bucket = ?', [name]);
+        await this.run('DELETE FROM buckets WHERE name = ?', [name]);
+        await fs.rm(path.join(STORAGE_BASE, name), { recursive: true, force: true });
+    }
+    async putObject(bucketName, key, body, meta) {
+        this.validateKey(key);
+        const b = await this.get('SELECT name FROM buckets WHERE name = ?', [bucketName]);
+        if (!b)
+            throw new S3Error('NoSuchBucket', 'Bucket not found', 404, bucketName);
+        const versionId = crypto.randomBytes(8).toString('hex') + '+';
+        const etag = '"' + crypto.createHash('md5').update(body).digest('hex') + '"';
+        const lastModified = Date.now();
+        const filePath = path.join(STORAGE_BASE, bucketName, key);
+        const versionFilePath = this.versionPath(bucketName, key, versionId);
+        await fs.mkdir(path.dirname(filePath), { recursive: true });
+        await fs.mkdir(path.dirname(versionFilePath), { recursive: true });
+        await writeDurableFile(filePath, body);
+        await writeDurableFile(versionFilePath, body);
+        this.db?.exec('BEGIN IMMEDIATE');
+        try {
+            await this.run(`
+       INSERT INTO objs (bucket, key, etag, contentType, contentLanguage, contentDisposition, contentEncoding, cacheControl, expires, lastModified, size, storageClass, versionId, ownerId, ownerDisplayName, encryption, sseKmsKeyId, objectLockMode, retainUntil, legalHold, deleteMarker, userMetadata)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+                bucketName, key, etag, meta.contentType || null, meta.contentLanguage || null, meta.contentDisposition || null,
+                meta.contentEncoding || null, meta.cacheControl || null,
+                meta.expires ? new Date(meta.expires).getTime() : null,
+                lastModified, body.length, meta.storageClass || 'STANDARD', versionId, '000000000000000000000000', 's3mini', meta.serverSideEncryption || null, meta.sseKmsKeyId || null, meta.objectLockMode || null, meta.retainUntil ? new Date(meta.retainUntil).getTime() : null, meta.legalHold || null, 0, JSON.stringify(meta.userMetadata || {})
+            ]);
+            await this.queueReplicationEvent({ bucket: bucketName, key, versionId, operation: 'PutObject', sourceNodeId: NODE_ID, payloadPath: versionFilePath, etag, sha256: crypto.createHash('sha256').update(body).digest('hex'), size: body.length, deleteMarker: false, createdAt: new Date(lastModified) });
+            this.db?.exec('COMMIT');
+        }
+        catch (error) {
+            this.db?.exec('ROLLBACK');
+            await fs.rm(filePath, { force: true });
+            await fs.rm(versionFilePath, { force: true });
+            throw error;
+        }
+        return {
+            key, bucket: bucketName, versionId, etag, contentType: meta.contentType || 'application/octet-stream', contentLanguage: meta.contentLanguage,
+            contentDisposition: meta.contentDisposition, contentEncoding: meta.contentEncoding,
+            cacheControl: meta.cacheControl, expires: meta.expires ? new Date(meta.expires) : undefined,
+            lastModified: new Date(lastModified), storageClass: meta.storageClass || 'STANDARD',
+            ownerId: '000000000000000000000000', ownerDisplayName: 's3mini',
+            userMetadata: meta.userMetadata || {},
+            serverSideEncryption: meta.serverSideEncryption,
+            sseKmsKeyId: meta.sseKmsKeyId,
+            objectLockMode: meta.objectLockMode,
+            objectLockRetainUntilDate: meta.retainUntil ? new Date(meta.retainUntil) : undefined,
+            objectLockLegalHold: meta.legalHold === 'ON',
+            size: body.length // FIX: added missing size
+        };
+    }
+    async getObject(bucketName, key, versionId) {
+        this.validateKey(key);
+        await this.applyLifecycle(bucketName);
+        const row = versionId
+            ? await this.get('SELECT * FROM objs WHERE bucket = ? AND key = ? AND versionId = ?', [bucketName, key, versionId])
+            : await this.get('SELECT * FROM objs WHERE bucket = ? AND key = ? ORDER BY lastModified DESC, id DESC LIMIT 1', [bucketName, key]);
+        if (!row)
+            throw new S3Error('NoSuchKey', 'Object not found', 404, bucketName, key);
+        if (row.deleteMarker)
+            throw new S3Error('NoSuchKey', 'The object is deleted.', 404, bucketName, key);
+        const versionFilePath = this.versionPath(bucketName, key, row.versionId);
+        const filePath = await fs.stat(versionFilePath).then(() => versionFilePath).catch(() => path.join(STORAGE_BASE, bucketName, key));
+        const data = await fs.readFile(filePath);
+        const metadata = {
+            key: row.key, bucket: row.bucket, versionId: row.versionId, size: row.size, etag: row.etag,
+            contentType: row.contentType || 'application/octet-stream', contentLanguage: row.contentLanguage || undefined, contentDisposition: row.contentDisposition || undefined,
+            contentEncoding: row.contentEncoding || undefined, cacheControl: row.cacheControl || undefined,
+            expires: row.expires ? new Date(row.expires) : undefined, lastModified: new Date(row.lastModified),
+            storageClass: row.storageClass, ownerId: row.ownerId, ownerDisplayName: row.ownerDisplayName,
+            userMetadata: row.userMetadata ? JSON.parse(row.userMetadata) : {}, serverSideEncryption: row.encryption || undefined, sseKmsKeyId: row.sseKmsKeyId || undefined,
+            objectLockMode: row.objectLockMode || undefined, objectLockRetainUntilDate: row.retainUntil ? new Date(row.retainUntil) : undefined, objectLockLegalHold: row.legalHold === 'ON'
+        };
+        return { data, metadata };
+    }
+    async getObjectRange(bucketName, key, start, end) {
+        const object = await this.getObject(bucketName, key);
+        if (start < 0 || start >= object.data.length || (end !== undefined && end < start)) {
+            throw new S3Error('InvalidRange', 'The requested range is not satisfiable.', 416, bucketName, key);
+        }
+        return {
+            data: object.data.subarray(start, end === undefined ? undefined : end + 1),
+            metadata: object.metadata,
+            totalSize: object.data.length,
+        };
+    }
+    async copyObject(sourceBucket, sourceKey, destinationBucket, destinationKey) {
+        const source = await this.getObject(sourceBucket, sourceKey);
+        return this.putObject(destinationBucket, destinationKey, source.data, {
+            contentType: source.metadata.contentType,
+            contentLanguage: source.metadata.contentLanguage,
+            contentDisposition: source.metadata.contentDisposition,
+            contentEncoding: source.metadata.contentEncoding,
+            cacheControl: source.metadata.cacheControl,
+            expires: source.metadata.expires,
+            storageClass: source.metadata.storageClass,
+            userMetadata: source.metadata.userMetadata,
+            serverSideEncryption: source.metadata.serverSideEncryption,
+            sseKmsKeyId: source.metadata.sseKmsKeyId,
+        });
+    }
+    async restoreObject(bucket, key) {
+        await this.headBucket(bucket);
+        await this.getObject(bucket, key);
+    }
+    async selectObjectContent(bucket, key, expression) {
+        if (!/^\s*SELECT\s+\*\s+FROM\s+S3Object\s*;?\s*$/i.test(expression)) {
+            throw new S3Error('InvalidExpression', 'Only SELECT * FROM S3Object is supported.', 400, bucket, key);
+        }
+        return (await this.getObject(bucket, key)).data;
+    }
+    async deleteObject(bucketName, key) {
+        this.validateKey(key);
+        const found = await this.get('SELECT id, objectLockMode, retainUntil, legalHold FROM objs WHERE bucket = ? AND key = ?', [bucketName, key]);
+        if (!found)
+            throw new S3Error('NoSuchKey', 'Object not found', 404, bucketName, key);
+        if (found.legalHold === 'ON' || (found.retainUntil && found.retainUntil > Date.now()))
+            throw new S3Error('AccessDenied', 'Object retention prevents deletion.', 403, bucketName, key);
+        const versioning = await this.getVersioning(bucketName);
+        if (versioning.status === 'Enabled') {
+            const markerId = crypto.randomBytes(8).toString('hex') + '+';
+            const deletedAt = Date.now();
+            await this.run('INSERT INTO objs (bucket, key, etag, lastModified, size, storageClass, versionId, ownerId, ownerDisplayName, deleteMarker) VALUES (?, ?, NULL, ?, 0, ?, ?, ?, ?, 1)', [bucketName, key, deletedAt, 'STANDARD', markerId, '000000000000000000000000', 's3mini']);
+            await this.queueReplicationEvent({ bucket: bucketName, key, versionId: markerId, operation: 'DeleteObject', sourceNodeId: NODE_ID, payloadPath: '', etag: '', size: 0, deleteMarker: true, createdAt: new Date(deletedAt) });
+            await fs.rm(path.join(STORAGE_BASE, bucketName, key), { force: true });
+            return;
+        }
+        await this.run('DELETE FROM objs WHERE bucket = ? AND key = ?', [bucketName, key]);
+        await this.run('DELETE FROM tags WHERE bucket = ? AND key = ?', [bucketName, key]);
+        await this.run('DELETE FROM object_tags WHERE bucket = ? AND key = ?', [bucketName, key]);
+        await this.run('DELETE FROM object_acl WHERE bucket = ? AND key = ?', [bucketName, key]);
+        await fs.rm(path.join(STORAGE_BASE, bucketName, key), { force: true });
+        await fs.rm(path.join(STORAGE_BASE, bucketName, '.versions'), { recursive: true, force: true });
+        await this.queueReplicationEvent({ bucket: bucketName, key, versionId: '', operation: 'DeleteObject', sourceNodeId: NODE_ID, payloadPath: '', etag: '', size: 0, deleteMarker: false, createdAt: new Date() });
+    }
+    async deleteObjects(bucket, keys) {
+        await this.headBucket(bucket);
+        const deleted = [];
+        const errors = [];
+        for (const key of keys) {
+            try {
+                await this.deleteObject(bucket, key);
+                deleted.push(key);
+            }
+            catch (error) {
+                if (error instanceof S3Error && error.code === 'NoSuchKey')
+                    deleted.push(key);
+                else
+                    errors.push({ key, code: error instanceof S3Error ? error.code : 'InternalError' });
+            }
+        }
+        return { deleted, errors };
+    }
+    async getVersioning(bucket) {
+        await this.headBucket(bucket);
+        const row = await this.get('SELECT versioningStatus FROM bucket_settings WHERE bucket = ?', [bucket]);
+        return row?.versioningStatus ? { status: row.versioningStatus } : {};
+    }
+    async putVersioning(bucket, status) {
+        await this.headBucket(bucket);
+        await this.run('UPDATE bucket_settings SET versioningStatus = ? WHERE bucket = ?', [status, bucket]);
+    }
+    async listObjectVersions(bucket, prefix) {
+        await this.headBucket(bucket);
+        const rows = await this.all('SELECT * FROM objs WHERE bucket = ? ORDER BY key ASC, id DESC', [bucket]);
+        return rows
+            .filter(row => !prefix || row.key.startsWith(prefix))
+            .map((row, index, all) => ({
+            Key: row.key,
+            VersionId: row.versionId,
+            IsLatest: index === all.findIndex(candidate => candidate.key === row.key),
+            LastModified: new Date(row.lastModified),
+            ETag: row.etag,
+            Size: row.size,
+            StorageClass: row.storageClass,
+            IsDeleteMarker: Boolean(row.deleteMarker),
+            Owner: { ID: row.ownerId, DisplayName: row.ownerDisplayName },
+        }));
+    }
+    async deleteObjectVersion(bucket, key, versionId) {
+        this.validateKey(key);
+        await this.headBucket(bucket);
+        const row = await this.get('SELECT id FROM objs WHERE bucket = ? AND key = ? AND versionId = ?', [bucket, key, versionId]);
+        if (!row)
+            throw new S3Error('NoSuchVersion', 'The specified version does not exist.', 404, bucket, key);
+        await this.run('DELETE FROM objs WHERE id = ?', [row.id]);
+        await this.run('DELETE FROM object_tags WHERE bucket = ? AND key = ? AND versionId = ?', [bucket, key, versionId]);
+        await fs.rm(this.versionPath(bucket, key, versionId), { force: true });
+        await this.queueReplicationEvent({ bucket, key, versionId, operation: 'DeleteObject', sourceNodeId: NODE_ID, payloadPath: '', etag: '', size: 0, deleteMarker: false, createdAt: new Date() });
+    }
+    async putObjectTags(bucket, key, tags, versionId = '') {
+        await this.headBucket(bucket);
+        const object = await this.get('SELECT id FROM objs WHERE bucket = ? AND key = ? AND (? = \'\' OR versionId = ?) LIMIT 1', [bucket, key, versionId, versionId]);
+        if (!object)
+            throw new S3Error(versionId ? 'NoSuchVersion' : 'NoSuchKey', 'Object not found', 404, bucket, key);
+        await this.run('INSERT OR REPLACE INTO object_tags (bucket, key, versionId, tags) VALUES (?, ?, ?, ?)', [bucket, key, versionId, JSON.stringify(tags)]);
+    }
+    async getObjectTags(bucket, key, versionId = '') {
+        await this.headBucket(bucket);
+        const row = await this.get('SELECT tags FROM object_tags WHERE bucket = ? AND key = ? AND versionId = ?', [bucket, key, versionId]);
+        if (!row)
+            throw new S3Error('NoSuchTagSet', 'The object has no tags.', 404, bucket, key);
+        return JSON.parse(row.tags);
+    }
+    async deleteObjectTags(bucket, key, versionId = '') {
+        await this.headBucket(bucket);
+        await this.run('DELETE FROM object_tags WHERE bucket = ? AND key = ? AND versionId = ?', [bucket, key, versionId]);
+    }
+    async putObjectAcl(bucket, key, acl, versionId = '') {
+        await this.headBucket(bucket);
+        await this.getObject(bucket, key, versionId || undefined);
+        await this.run('INSERT OR REPLACE INTO object_acl (bucket, key, versionId, acl) VALUES (?, ?, ?, ?)', [bucket, key, versionId, JSON.stringify(acl)]);
+    }
+    async getObjectAcl(bucket, key, versionId = '') {
+        await this.headBucket(bucket);
+        await this.getObject(bucket, key, versionId || undefined);
+        const row = await this.get('SELECT acl FROM object_acl WHERE bucket = ? AND key = ? AND versionId = ?', [bucket, key, versionId]);
+        return (row ? JSON.parse(row.acl) : { CannedACL: 'private' });
+    }
+    async putBucketTags(bucket, tags) {
+        await this.headBucket(bucket);
+        await this.run('UPDATE bucket_settings SET bucketTags = ? WHERE bucket = ?', [JSON.stringify(tags), bucket]);
+    }
+    async getBucketTags(bucket) {
+        await this.headBucket(bucket);
+        const row = await this.get('SELECT bucketTags FROM bucket_settings WHERE bucket = ?', [bucket]);
+        return row?.bucketTags ? JSON.parse(row.bucketTags) : {};
+    }
+    async deleteBucketTags(bucket) {
+        await this.headBucket(bucket);
+        await this.run('UPDATE bucket_settings SET bucketTags = NULL WHERE bucket = ?', [bucket]);
+    }
+    async getBucketLocation(bucket) {
+        const row = await this.get('SELECT locationConstraint FROM buckets WHERE name = ?', [bucket]);
+        if (!row)
+            throw new S3Error('NoSuchBucket', 'Bucket not found', 404, bucket);
+        return row.locationConstraint;
+    }
+    async putBucketConfiguration(bucket, name, value) {
+        await this.headBucket(bucket);
+        await this.run(`UPDATE bucket_settings SET ${name} = ? WHERE bucket = ?`, [JSON.stringify(value), bucket]);
+    }
+    async getBucketConfiguration(bucket, name) {
+        await this.headBucket(bucket);
+        const row = await this.get(`SELECT ${name} FROM bucket_settings WHERE bucket = ?`, [bucket]);
+        return row?.[name] ? JSON.parse(row[name]) : undefined;
+    }
+    async deleteBucketConfiguration(bucket, name) {
+        await this.headBucket(bucket);
+        await this.run(`UPDATE bucket_settings SET ${name} = NULL WHERE bucket = ?`, [bucket]);
+    }
+    async isRequestDenied(bucket, key, action, principal = '*', context = {}) {
+        const policy = await this.getBucketConfiguration(bucket, 'policy');
+        if (!policy?.statements)
+            return false;
+        const resource = `arn:aws:s3:::${bucket}${key ? `/${key}` : ''}`;
+        const matching = policy.statements.filter(statement => policyStatementMatches(statement, resource, action, principal, context));
+        if (matching.some(statement => statement.effect === 'Deny'))
+            return true;
+        return matching.some(statement => statement.effect === 'Allow') ? false : policy.statements.some(statement => statement.effect === 'Allow');
+    }
+    async isObjectRequestDenied(bucket, key, action, principal) {
+        const acl = await this.getObjectAcl(bucket, key).catch(() => ({ CannedACL: 'private' }));
+        if (principal !== 'anonymous')
+            return false;
+        const requiredPermission = action === 'GetObject' ? 'READ' : action === 'GetObjectAcl' ? 'READ_ACP' : action === 'PutObjectAcl' ? 'WRITE_ACP' : 'WRITE';
+        if (acl.CannedACL) {
+            if (acl.CannedACL === 'public-read')
+                return requiredPermission === 'READ';
+            if (acl.CannedACL === 'public-read-write')
+                return requiredPermission === 'READ' || requiredPermission === 'WRITE';
+            if (acl.CannedACL === 'authenticated-read')
+                return !(principal !== 'anonymous' && requiredPermission === 'READ');
+            return true;
+        }
+        const grants = Array.isArray(acl.Grants) ? acl.Grants : [];
+        return !grants.some((grant) => {
+            const grantee = grant.Grantee || {};
+            const matches = grantee.ID === principal || (principal === 'anonymous' && grantee.URI === 'http://acs.amazonaws.com/groups/global/AllUsers') || (principal !== 'anonymous' && grantee.URI === 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers');
+            return matches && grant.Permission === requiredPermission;
+        });
+    }
+    async listObjectsV2(bucketName, prefix) {
+        const rows = await this.all('SELECT * FROM objs WHERE bucket = ?', [bucketName]);
+        const filtered = rows.filter((r) => !prefix || r.key.startsWith(prefix));
+        return filtered.map((r) => ({
+            Key: r.key, LastModified: new Date(r.lastModified), ETag: r.etag,
+            Size: r.size, StorageClass: r.storageClass, Owner: { ID: r.ownerId, DisplayName: r.ownerDisplayName }
+        }));
+    }
+    async listObjectsV2Advanced(request) {
+        await this.headBucket(request.bucket);
+        await this.applyLifecycle(request.bucket);
+        const rows = await this.all('SELECT * FROM objs WHERE bucket = ? ORDER BY key ASC', [request.bucket]);
+        const prefix = request.prefix || '';
+        const delimiter = request.delimiter;
+        const marker = request.continuationToken
+            ? Buffer.from(request.continuationToken, 'base64url').toString('utf8')
+            : request.startAfter;
+        const entries = new Map();
+        for (const row of rows) {
+            if (!row.key.startsWith(prefix) || (marker && row.key <= marker))
+                continue;
+            if (delimiter) {
+                const remainder = row.key.slice(prefix.length);
+                const delimiterIndex = remainder.indexOf(delimiter);
+                if (delimiterIndex >= 0) {
+                    const commonPrefix = prefix + remainder.slice(0, delimiterIndex + delimiter.length);
+                    entries.set(commonPrefix, commonPrefix);
+                    continue;
+                }
+            }
+            entries.set(row.key, {
+                key: row.key,
+                etag: row.etag,
+                size: row.size,
+                lastModified: new Date(row.lastModified),
+                storageClass: row.storageClass,
+                owner: { id: row.ownerId, displayName: row.ownerDisplayName },
+            });
+        }
+        const ordered = [...entries.entries()].sort(([left], [right]) => left.localeCompare(right));
+        const maxKeys = Math.max(0, Math.min(request.maxKeys ?? 1000, 1000));
+        const page = ordered.slice(0, maxKeys);
+        const isTruncated = ordered.length > page.length;
+        const lastEntry = page[page.length - 1]?.[0];
+        const result = {
+            name: request.bucket,
+            prefix: request.prefix,
+            delimiter: request.delimiter,
+            maxKeys,
+            keyCount: page.length,
+            isTruncated,
+            contents: page.flatMap(([, value]) => typeof value === 'string' ? [] : [value]),
+            commonPrefixes: page.flatMap(([, value]) => typeof value === 'string' ? [value] : []),
+            startAfter: request.startAfter,
+            encodingType: request.encodingType,
+        };
+        if (request.continuationToken)
+            result.continuationToken = request.continuationToken;
+        if (isTruncated && lastEntry)
+            result.nextContinuationToken = Buffer.from(lastEntry).toString('base64url');
+        return result;
+    }
+    async createMultipartUpload(bucket, key, storageClass = 'STANDARD') {
+        await this.headBucket(bucket);
+        const uploadId = crypto.randomUUID();
+        await this.run('INSERT INTO multipart_uploads (uploadId, bucket, key, initiated, storageClass) VALUES (?, ?, ?, ?, ?)', [uploadId, bucket, key, Date.now(), storageClass]);
+        return { uploadId, bucket, key };
+    }
+    async uploadPart(request) {
+        const upload = await this.get('SELECT uploadId FROM multipart_uploads WHERE uploadId = ? AND bucket = ? AND key = ?', [request.uploadId, request.bucket, request.key]);
+        if (!upload)
+            throw new S3Error('NoSuchUpload', 'The specified multipart upload does not exist.', 404, request.bucket, request.key);
+        if (request.partNumber < 1 || request.partNumber > 10000)
+            throw new S3Error('InvalidPart', 'Part number must be between 1 and 10000.', 400, request.bucket, request.key);
+        const etag = '"' + crypto.createHash('md5').update(request.body).digest('hex') + '"';
+        const lastModified = Date.now();
+        await this.run('INSERT OR REPLACE INTO multipart_parts (uploadId, partNumber, etag, size, lastModified, body) VALUES (?, ?, ?, ?, ?, ?)', [request.uploadId, request.partNumber, etag, request.body.length, lastModified, request.body]);
+        return { partNumber: request.partNumber, etag, size: request.body.length, lastModified: new Date(lastModified) };
+    }
+    async uploadPartCopy(bucket, key, uploadId, partNumber, sourceBucket, sourceKey) {
+        const source = await this.getObject(sourceBucket, sourceKey);
+        return this.uploadPart({ bucket, key, uploadId, partNumber, body: source.data });
+    }
+    async listParts(request) {
+        const upload = await this.get('SELECT uploadId FROM multipart_uploads WHERE uploadId = ? AND bucket = ? AND key = ?', [request.uploadId, request.bucket, request.key]);
+        if (!upload)
+            throw new S3Error('NoSuchUpload', 'The specified multipart upload does not exist.', 404, request.bucket, request.key);
+        const rows = await this.all('SELECT * FROM multipart_parts WHERE uploadId = ? AND partNumber > ? ORDER BY partNumber ASC', [request.uploadId, request.partNumberMarker || 0]);
+        const maxParts = Math.max(0, Math.min(request.maxParts ?? 1000, 1000));
+        const page = rows.slice(0, maxParts);
+        return {
+            bucket: request.bucket,
+            key: request.key,
+            uploadId: request.uploadId,
+            parts: page.map(row => ({ partNumber: row.partNumber, etag: row.etag, size: row.size, lastModified: new Date(row.lastModified) })),
+            isTruncated: rows.length > page.length,
+            nextPartNumberMarker: rows.length > page.length ? page[page.length - 1].partNumber : undefined,
+        };
+    }
+    async completeMultipartUpload(request) {
+        const upload = await this.get('SELECT * FROM multipart_uploads WHERE uploadId = ? AND bucket = ? AND key = ?', [request.uploadId, request.bucket, request.key]);
+        if (!upload)
+            throw new S3Error('NoSuchUpload', 'The specified multipart upload does not exist.', 404, request.bucket, request.key);
+        if (!request.parts.length)
+            throw new S3Error('InvalidRequest', 'At least one part is required.', 400, request.bucket, request.key);
+        const bodies = [];
+        for (const part of request.parts) {
+            const row = await this.get('SELECT body, etag FROM multipart_parts WHERE uploadId = ? AND partNumber = ?', [request.uploadId, part.partNumber]);
+            if (!row || row.etag !== part.etag)
+                throw new S3Error('InvalidPart', 'One or more requested parts could not be found.', 400, request.bucket, request.key);
+            bodies.push(row.body);
+        }
+        const result = await this.putObject(request.bucket, request.key, Buffer.concat(bodies), {});
+        await this.run('DELETE FROM multipart_parts WHERE uploadId = ?', [request.uploadId]);
+        await this.run('DELETE FROM multipart_uploads WHERE uploadId = ?', [request.uploadId]);
+        return { bucket: request.bucket, key: request.key, etag: result.etag, versionId: result.versionId };
+    }
+    async abortMultipartUpload(bucket, key, uploadId) {
+        const upload = await this.get('SELECT uploadId FROM multipart_uploads WHERE uploadId = ? AND bucket = ? AND key = ?', [uploadId, bucket, key]);
+        if (!upload)
+            throw new S3Error('NoSuchUpload', 'The specified multipart upload does not exist.', 404, bucket, key);
+        await this.run('DELETE FROM multipart_parts WHERE uploadId = ?', [uploadId]);
+        await this.run('DELETE FROM multipart_uploads WHERE uploadId = ?', [uploadId]);
+    }
+    async listMultipartUploads(request) {
+        await this.headBucket(request.bucket);
+        const rows = await this.all('SELECT * FROM multipart_uploads WHERE bucket = ? ORDER BY key, initiated', [request.bucket]);
+        const filtered = rows.filter(row => !request.prefix || row.key.startsWith(request.prefix));
+        return {
+            bucket: request.bucket,
+            uploads: filtered.slice(0, request.maxUploads ?? 1000).map(row => ({
+                uploadId: row.uploadId,
+                bucket: row.bucket,
+                key: row.key,
+                initiated: new Date(row.initiated),
+                initiator: { id: '000000000000000000000000', displayName: 's3mini' },
+                owner: { id: '000000000000000000000000', displayName: 's3mini' },
+                storageClass: row.storageClass,
+                parts: [],
+            })),
+            commonPrefixes: [],
+            isTruncated: filtered.length > (request.maxUploads ?? 1000),
+        };
+    }
+}
+async function writeDurableFile(filePath, body) {
+    const temporaryPath = `${filePath}.${crypto.randomUUID()}.tmp`;
+    try {
+        const handle = await fs.open(temporaryPath, 'w');
+        try {
+            await handle.writeFile(body);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await fs.rename(temporaryPath, filePath);
+    }
+    catch (error) {
+        await fs.rm(temporaryPath, { force: true });
+        throw error;
+    }
+}
+function lifecycleRuleMatches(rule, key) {
+    if (rule.status && rule.status !== 'Enabled')
+        return false;
+    const prefix = rule.filter?.prefix ?? rule.prefix ?? '';
+    return !prefix || key.startsWith(prefix);
+}
+function lifecycleAgeReached(condition, lastModified, now) {
+    if (condition.date !== undefined)
+        return now >= Date.parse(String(condition.date));
+    const days = condition.days ?? condition.noncurrentDays;
+    if (days !== undefined)
+        return now >= lastModified + Number(days) * 86_400_000;
+    return false;
+}
+function lifecycleTransition(rule, noncurrent, lastModified, now) {
+    const transitions = noncurrent ? rule.noncurrentVersionTransitions : rule.transitions;
+    if (!Array.isArray(transitions))
+        return undefined;
+    return transitions
+        .filter(transition => lifecycleAgeReached(transition, lastModified, now))
+        .sort((left, right) => Number(right.days ?? right.noncurrentDays ?? 0) - Number(left.days ?? left.noncurrentDays ?? 0))
+        .map(transition => transition.storageClass || transition.StorageClass)
+        .find(Boolean);
+}
+function policyStatementMatches(statement, resource, action, principal, context) {
+    const actions = Array.isArray(statement.action) ? statement.action : [statement.action];
+    const resources = Array.isArray(statement.resource) ? statement.resource : [statement.resource];
+    const principals = statement.principal === '*' || statement.principal?.aws === '*' || [statement.principal, statement.principal?.aws].includes(principal);
+    const actionMatches = actions.some((value) => typeof value === 'string' && wildcardMatches(value, action));
+    const resourceMatches = resources.some((value) => typeof value === 'string' && wildcardMatches(value, resource));
+    if (!principals || !actionMatches || !resourceMatches)
+        return false;
+    return policyConditionsMatch(statement.condition, context);
+}
+function policyConditionsMatch(condition, context) {
+    if (!condition)
+        return true;
+    for (const [operator, entries] of Object.entries(condition)) {
+        for (const [name, expectedValue] of Object.entries(entries || {})) {
+            const actual = context[name];
+            const expected = Array.isArray(expectedValue) ? expectedValue.map(String) : [String(expectedValue)];
+            const matches = operator === 'StringLike'
+                ? expected.some(value => actual !== undefined && wildcardMatches(value, actual))
+                : expected.includes(actual || '');
+            if (operator === 'StringNotEquals' ? expected.includes(actual || '') : !matches)
+                return false;
+        }
+    }
+    return true;
+}
+function wildcardMatches(pattern, value) {
+    const expression = '^' + pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.') + '$';
+    return new RegExp(expression).test(value);
+}
+//# sourceMappingURL=s3mini.js.map