@backblaze-labs/b2-sdk 0.1.0 → 0.2.0

package/dist/client.cjs

@@ -1,230 +1,248 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const inMemory = require("./auth/in-memory.cjs");
-const realms = require("./auth/realms.cjs");
-const bucket = require("./bucket.cjs");
-const transport = require("./http/transport.cjs");
-const urlGuard = require("./http/url-guard.cjs");
-const raw_index = require("./raw/index.cjs");
-const ids = require("./types/ids.cjs");
-const defaults = require("./util/defaults.cjs");
-const paginator = require("./util/paginator.cjs");
-class B2Client {
-  /** Low-level client for direct B2 API calls. */
-  raw;
-  /** Authorization state storage (tokens, URLs, capabilities). */
-  accountInfo;
-  /**
-   * SSRF allow-list applied by the default {@link FetchTransport}. `null` when
-   * a custom transport was supplied — in that case the SDK does not own the
-   * guard. Locked down by {@link B2Client.authorize}.
-   */
-  urlGuard;
-  applicationKeyId;
-  applicationKey;
-  realmUrl;
-  userAllowedSuffixes;
-  /**
-   * Creates a new B2Client. Call {@link authorize} before making API requests.
-   * @param options - Configuration including credentials, realm, and transport settings.
-   */
-  constructor(options) {
-    this.applicationKeyId = options.applicationKeyId;
-    this.applicationKey = options.applicationKey;
-    this.realmUrl = realms.getRealmUrl(options.realm ?? "production");
-    this.accountInfo = options.accountInfo ?? new inMemory.InMemoryAccountInfo();
-    this.userAllowedSuffixes = options.allowedHostSuffixes;
-    let baseTransport;
-    if (options.transport !== void 0) {
-      baseTransport = options.transport;
-      this.urlGuard = null;
-    } else {
-      const urlGuard$1 = new urlGuard.UrlGuard();
-      baseTransport = new transport.FetchTransport({
-        urlGuard: urlGuard$1,
-        ...options.userAgent !== void 0 ? { userAgent: options.userAgent } : {}
-      });
-      this.urlGuard = urlGuard$1;
-    }
-    const retryTransport = new transport.RetryTransport({
-      transport: baseTransport,
-      ...options.retry !== void 0 ? { retry: options.retry } : {},
-      onReauth: () => this.reauthorize()
-    });
-    this.raw = new raw_index.RawClient({ transport: retryTransport });
-  }
-  /**
-   * Authenticates with B2 and stores the authorization state. Must be called before other methods.
-   *
-   * @returns The authorization response containing tokens, URLs, and capabilities.
-   */
-  async authorize() {
-    const auth = await this.raw.authorizeAccount(
-      this.applicationKeyId,
-      this.applicationKey,
-      this.realmUrl
-    );
-    this.accountInfo.setAuth(auth);
-    if (this.urlGuard !== null) {
-      const derived = urlGuard.deriveAllowedSuffixes(auth.apiInfo.storageApi);
-      const merged = this.userAllowedSuffixes !== void 0 ? Array.from(/* @__PURE__ */ new Set([...derived, ...this.userAllowedSuffixes])) : derived;
-      this.urlGuard.setAllowedSuffixes(merged);
-    }
-    return auth;
-  }
-  /**
-   * Refresh credentials after a 401. Returns the fresh auth token so
-   * {@link RetryTransport} can rewrite the in-flight request's
-   * Authorization header before retrying.
-   *
-   * @returns The fresh authorization token.
-   */
-  async reauthorize() {
-    this.accountInfo.clear();
-    const auth = await this.authorize();
-    return auth.authorizationToken;
-  }
-  /**
-   * Creates a new B2 bucket.
-   * @param options - Bucket configuration including name, type, and optional settings.
-   *
-   * @returns A {@link Bucket} handle for the newly created bucket.
-   */
-  async createBucket(options) {
-    const request = {
-      accountId: ids.accountId(this.accountInfo.getAccountId()),
-      ...options
-    };
-    const info = await this.raw.createBucket(
-      this.accountInfo.getApiUrl(),
-      this.accountInfo.getAuthToken(),
-      request
-    );
-    return new bucket.Bucket(this, info);
-  }
-  /**
-   * Lists buckets in the account, optionally filtered by ID, name, or type.
-   * @param options - Optional filters for bucket ID, name, or type.
-   *
-   * @returns An array of {@link Bucket} handles.
-   */
-  async listBuckets(options) {
-    const resp = await this.raw.listBuckets(
-      this.accountInfo.getApiUrl(),
-      this.accountInfo.getAuthToken(),
-      {
-        accountId: ids.accountId(this.accountInfo.getAccountId()),
-        ...options
-      }
-    );
-    return resp.buckets.map((info) => new bucket.Bucket(this, info));
-  }
-  /**
-   * Looks up a single bucket by name.
-   * @param bucketName - The name of the bucket to find.
-   *
-   * @returns The {@link Bucket} handle, or `null` if not found.
-   */
-  async getBucket(bucketName) {
-    const buckets = await this.listBuckets({ bucketName });
-    return buckets[0] ?? null;
-  }
-  /**
-   * Permanently deletes a bucket. The bucket must be empty.
-   * @param id - The unique identifier of the bucket to delete.
-   *
-   * @returns The deleted bucket metadata.
-   */
-  async deleteBucket(id) {
-    return this.raw.deleteBucket(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {
-      accountId: ids.accountId(this.accountInfo.getAccountId()),
-      bucketId: id
-    });
-  }
-  /**
-   * Creates a new application key with the specified capabilities.
-   * @param options - Key configuration including capabilities, name, and optional restrictions.
-   *
-   * @returns The full key including the secret (only returned at creation time).
-   */
-  async createKey(options) {
-    return this.raw.createKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {
-      accountId: ids.accountId(this.accountInfo.getAccountId()),
-      ...options
-    });
-  }
-  /**
-   * Lists application keys in the account.
-   * @param options - Optional pagination settings.
-   *
-   * @returns A page of application keys with an optional continuation token.
-   */
-  async listKeys(options) {
-    return this.raw.listKeys(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {
-      accountId: ids.accountId(this.accountInfo.getAccountId()),
-      ...options?.pageSize !== void 0 ? { maxKeyCount: options.pageSize } : {},
-      ...options?.startApplicationKeyId !== void 0 ? { startApplicationKeyId: options.startApplicationKeyId } : {}
-    });
-  }
-  /**
-   * Async iterator that yields every application key on the account,
-   * automatically handling pagination via `listKeys`.
-   *
-   * @param options - Pagination + abort options. `pageSize` is forwarded
-   *   to `maxKeyCount`; the default is 1000.
-   *
-   * @returns An async iterable of {@link ApplicationKey} entries.
-   *
-   * @example
-   * ```ts
-   * for await (const key of client.paginateKeys()) {
-   *   console.log(key.keyName, key.capabilities)
-   * }
-   * ```
-   */
-  paginateKeys(options) {
-    return paginator.paginateItems(
-      async (cursor) => {
-        const resp = await this.listKeys({
-          pageSize: options?.pageSize ?? defaults.DEFAULT_PAGE_SIZE,
-          ...cursor !== void 0 ? { startApplicationKeyId: cursor } : {}
-        });
-        return { page: resp, nextCursor: resp.nextApplicationKeyId ?? void 0 };
-      },
-      (page) => page.keys,
-      options?.signal
-    );
-  }
-  /**
-   * Permanently deletes an application key.
-   * @param applicationKeyId - The unique identifier of the key to delete.
-   *
-   * @returns The deleted application key metadata.
-   */
-  async deleteKey(applicationKeyId) {
-    return this.raw.deleteKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {
-      applicationKeyId
-    });
-  }
-  /**
-   * Checks whether the authorized application key carries every capability in
-   * `needed`. Returns the missing capabilities so callers can fail fast with a
-   * clear error instead of a generic 401/403 from the server.
-   *
-   * @param needed - The capabilities required by the planned operation.
-   *
-   * @returns An object with `ok: true` when every needed capability is
-   *   present, otherwise `{ ok: false, missing: [...] }`.
-   *
-   * @throws If {@link authorize} has not been called yet.
-   */
-  hasCapabilities(needed) {
-    const auth = this.accountInfo.getAuth();
-    if (!auth) throw new Error("Not authorized. Call authorize() first.");
-    const available = new Set(auth.apiInfo.storageApi.allowed.capabilities);
-    const missing = needed.filter((cap) => !available.has(cap));
-    return { ok: missing.length === 0, missing };
-  }
+const require_in_memory = require("./auth/in-memory.cjs");
+const require_ids = require("./types/ids.cjs");
+require("./util/defaults.cjs");
+const require_retry = require("./http/retry.cjs");
+const require_paginator = require("./util/paginator.cjs");
+const require_bucket = require("./bucket.cjs");
+const require_realms = require("./auth/realms.cjs");
+const require_url_guard = require("./http/url-guard.cjs");
+const require_transport = require("./http/transport.cjs");
+const require_raw_index = require("./raw/index.cjs");
+//#region src/client.ts
+/**
+* High-level B2 client providing ergonomic access to buckets, files, and keys.
+*
+* @example
+* ```ts
+* const client = new B2Client({
+*   applicationKeyId: process.env.B2_APPLICATION_KEY_ID,
+*   applicationKey: process.env.B2_APPLICATION_KEY,
+* })
+* await client.authorize()
+* const buckets = await client.listBuckets()
+* ```
+*/
+var B2Client = class {
+	/** Low-level client for direct B2 API calls. */
+	raw;
+	/** Authorization state storage (tokens, URLs, capabilities). */
+	accountInfo;
+	/**
+	* SSRF allow-list applied by the default {@link FetchTransport}. `null` when
+	* a custom transport was supplied — in that case the SDK does not own the
+	* guard. Locked down by {@link B2Client.authorize}.
+	*/
+	urlGuard;
+	applicationKeyId;
+	applicationKey;
+	realmUrl;
+	userAllowedSuffixes;
+	resolvedUploadRetryOptions;
+	/**
+	* Creates a new B2Client. Call {@link authorize} before making API requests.
+	* @param options - Configuration including credentials, realm, and transport settings.
+	*/
+	constructor(options) {
+		this.applicationKeyId = options.applicationKeyId;
+		this.applicationKey = options.applicationKey;
+		this.realmUrl = require_realms.getRealmUrl(options.realm ?? "production");
+		this.accountInfo = options.accountInfo ?? new require_in_memory.InMemoryAccountInfo();
+		bindAccountInfoAuthContext(this.accountInfo, this.realmUrl, this.applicationKeyId);
+		this.userAllowedSuffixes = options.allowedHostSuffixes;
+		this.resolvedUploadRetryOptions = {
+			...require_retry.DEFAULT_RETRY_OPTIONS,
+			...options.retry
+		};
+		let baseTransport;
+		if (options.transport !== void 0) {
+			baseTransport = options.transport;
+			this.urlGuard = null;
+		} else {
+			const urlGuard = new require_url_guard.UrlGuard();
+			baseTransport = new require_transport.FetchTransport({
+				urlGuard,
+				...options.userAgent !== void 0 ? { userAgent: options.userAgent } : {},
+				...options.followSameOriginRedirects !== void 0 ? { followSameOriginRedirects: options.followSameOriginRedirects } : {}
+			});
+			this.urlGuard = urlGuard;
+		}
+		const retryTransport = new require_transport.RetryTransport({
+			transport: baseTransport,
+			retry: this.resolvedUploadRetryOptions,
+			onReauth: () => this.reauthorize()
+		});
+		const cachedAuth = this.accountInfo.getAuth();
+		if (cachedAuth !== null) this.lockUrlGuard(cachedAuth);
+		this.raw = new require_raw_index.RawClient({ transport: retryTransport });
+	}
+	/**
+	* Authenticates with B2 and stores the authorization state. Must be called before other methods.
+	*
+	* @returns The authorization response containing tokens, URLs, and capabilities.
+	*/
+	async authorize() {
+		const auth = await this.raw.authorizeAccount(this.applicationKeyId, this.applicationKey, this.realmUrl);
+		this.accountInfo.setAuth(auth);
+		this.lockUrlGuard(auth);
+		return auth;
+	}
+	lockUrlGuard(auth) {
+		if (this.urlGuard !== null) {
+			const derived = require_url_guard.deriveAllowedSuffixes(auth.apiInfo.storageApi);
+			const merged = this.userAllowedSuffixes !== void 0 ? this.userAllowedSuffixes.length === 0 ? [] : Array.from(/* @__PURE__ */ new Set([...derived, ...this.userAllowedSuffixes])) : derived;
+			this.urlGuard.setAllowedSuffixes(merged);
+		}
+	}
+	/**
+	* Refresh credentials after a 401. Returns the fresh auth token so
+	* {@link RetryTransport} can rewrite the in-flight request's
+	* Authorization header before retrying.
+	*
+	* @returns The fresh authorization token.
+	*/
+	async reauthorize() {
+		this.accountInfo.clear();
+		return (await this.authorize()).authorizationToken;
+	}
+	/**
+	* Creates a new B2 bucket.
+	* @param options - Bucket configuration including name, type, and optional settings.
+	*
+	* @returns A {@link Bucket} handle for the newly created bucket.
+	*/
+	async createBucket(options) {
+		const request = {
+			accountId: require_ids.accountId(this.accountInfo.getAccountId()),
+			...options
+		};
+		const info = await this.raw.createBucket(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), request);
+		return new require_bucket.Bucket(this, info, this.resolvedUploadRetryOptions);
+	}
+	/**
+	* Lists buckets in the account, optionally filtered by ID, name, or type.
+	* @param options - Optional filters for bucket ID, name, or type.
+	*
+	* @returns An array of {@link Bucket} handles.
+	*/
+	async listBuckets(options) {
+		return (await this.raw.listBuckets(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {
+			accountId: require_ids.accountId(this.accountInfo.getAccountId()),
+			...options
+		})).buckets.map((info) => new require_bucket.Bucket(this, info, this.resolvedUploadRetryOptions));
+	}
+	/**
+	* Looks up a single bucket by name.
+	* @param bucketName - The name of the bucket to find.
+	*
+	* @returns The {@link Bucket} handle, or `null` if not found.
+	*/
+	async getBucket(bucketName) {
+		const filteredMatch = (await this.listBuckets({ bucketName }))[0];
+		if (filteredMatch !== void 0) return filteredMatch;
+		return (await this.listBuckets()).find((bucket) => bucket.name === bucketName) ?? null;
+	}
+	/**
+	* Permanently deletes a bucket. The bucket must be empty.
+	* @param id - The unique identifier of the bucket to delete.
+	*
+	* @returns The deleted bucket metadata.
+	*/
+	async deleteBucket(id) {
+		return this.raw.deleteBucket(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {
+			accountId: require_ids.accountId(this.accountInfo.getAccountId()),
+			bucketId: id
+		});
+	}
+	/**
+	* Creates a new application key with the specified capabilities.
+	* @param options - Key configuration including capabilities, name, and optional restrictions.
+	*
+	* @returns The full key including the secret (only returned at creation time).
+	*/
+	async createKey(options) {
+		return this.raw.createKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {
+			accountId: require_ids.accountId(this.accountInfo.getAccountId()),
+			...options
+		});
+	}
+	/**
+	* Lists application keys in the account.
+	* @param options - Optional pagination settings.
+	*
+	* @returns A page of application keys with an optional continuation token.
+	*/
+	async listKeys(options) {
+		return this.raw.listKeys(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {
+			accountId: require_ids.accountId(this.accountInfo.getAccountId()),
+			...options?.pageSize !== void 0 ? { maxKeyCount: options.pageSize } : {},
+			...options?.startApplicationKeyId !== void 0 ? { startApplicationKeyId: options.startApplicationKeyId } : {}
+		});
+	}
+	/**
+	* Async iterator that yields every application key on the account,
+	* automatically handling pagination via `listKeys`.
+	*
+	* @param options - Pagination + abort options. `pageSize` is forwarded
+	*   to `maxKeyCount`; the default is 1000.
+	*
+	* @returns An async iterable of {@link ApplicationKey} entries.
+	*
+	* @example
+	* ```ts
+	* for await (const key of client.paginateKeys()) {
+	*   console.log(key.keyName, key.capabilities)
+	* }
+	* ```
+	*/
+	paginateKeys(options) {
+		return require_paginator.paginateItems(async (cursor) => {
+			const resp = await this.listKeys({
+				pageSize: options?.pageSize ?? 1e3,
+				...cursor !== void 0 ? { startApplicationKeyId: cursor } : {}
+			});
+			return {
+				page: resp,
+				nextCursor: resp.nextApplicationKeyId ?? void 0
+			};
+		}, (page) => page.keys, options?.signal);
+	}
+	/**
+	* Permanently deletes an application key.
+	* @param applicationKeyId - The unique identifier of the key to delete.
+	*
+	* @returns The deleted application key metadata.
+	*/
+	async deleteKey(applicationKeyId) {
+		return this.raw.deleteKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), { applicationKeyId });
+	}
+	/**
+	* Checks whether the authorized application key carries every capability in
+	* `needed`. Returns the missing capabilities so callers can fail fast with a
+	* clear error instead of a generic 401/403 from the server.
+	*
+	* @param needed - The capabilities required by the planned operation.
+	*
+	* @returns An object with `ok: true` when every needed capability is
+	*   present, otherwise `{ ok: false, missing: [...] }`.
+	*
+	* @throws If {@link authorize} has not been called yet.
+	*/
+	hasCapabilities(needed) {
+		const auth = this.accountInfo.getAuth();
+		if (!auth) throw new Error("Not authorized. Call authorize() first.");
+		const available = new Set(auth.apiInfo.storageApi.allowed.capabilities);
+		const missing = needed.filter((cap) => !available.has(cap));
+		return {
+			ok: missing.length === 0,
+			missing
+		};
+	}
+};
+function bindAccountInfoAuthContext(accountInfo, realmUrl, applicationKeyId) {
+	accountInfo.setApplicationKeyId?.(applicationKeyId);
+	accountInfo.setRealmUrl?.(realmUrl);
 }
+//#endregion
 exports.B2Client = B2Client;
-//# sourceMappingURL=client.cjs.map
+
+//# sourceMappingURL=client.cjs.map

package/dist/client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.cjs","sources":["../src/client.ts"],"sourcesContent":["import type { AccountInfo } from './auth/account-info.ts'\nimport { InMemoryAccountInfo } from './auth/in-memory.ts'\nimport { getRealmUrl } from './auth/realms.ts'\nimport { Bucket } from './bucket.ts'\nimport type { RetryOptions } from './http/retry.ts'\nimport type { HttpTransport } from './http/transport.ts'\nimport { FetchTransport, RetryTransport } from './http/transport.ts'\nimport { UrlGuard, deriveAllowedSuffixes } from './http/url-guard.ts'\nimport { RawClient } from './raw/index.ts'\nimport type { AuthorizeAccountResponse, Capability } from './types/auth.ts'\nimport type {\n  BucketInfo,\n  BucketType,\n  CorsRule,\n  CreateBucketRequest,\n  LifecycleRule,\n} from './types/bucket.ts'\nimport type { BucketRetentionPolicy } from './types/bucket.ts'\nimport type { EncryptionSetting } from './types/encryption.ts'\nimport type { ApplicationKeyId, BucketId } from './types/ids.ts'\nimport { accountId } from './types/ids.ts'\nimport type { ApplicationKey, FullApplicationKey, ListKeysResponse } from './types/key.ts'\nimport type { ReplicationConfiguration } from './types/replication.ts'\nimport { DEFAULT_PAGE_SIZE } from './util/defaults.ts'\nimport { type PaginatorOptions, paginateItems } from './util/paginator.ts'\n\n/** Result of {@link B2Client.hasCapabilities}. */\nexport interface CapabilityCheckResult {\n  /** `true` when the key carries every requested capability. */\n  readonly ok: boolean\n  /** Capabilities the call requested that the current key does not hold. Empty when `ok` is `true`. */\n  readonly missing: readonly Capability[]\n}\n\n/** Configuration options for creating a {@link B2Client}. */\nexport interface B2ClientOptions {\n  /** The application key ID from the B2 dashboard or `b2_create_key`. */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /** B2 realm to authenticate against. Defaults to `\"production\"`. */\n  readonly realm?: string\n  /** Storage backend for authorization state. Defaults to {@link InMemoryAccountInfo}. */\n  readonly accountInfo?: AccountInfo\n  /** Custom HTTP transport. Defaults to {@link FetchTransport}. Wrapped by {@link RetryTransport}. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior (max retries, backoff, jitter). */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /**\n   * Override the SSRF allow-list. By default the SDK locks the\n   * {@link FetchTransport} to host suffixes derived from the realm's authorize\n   * response (e.g. `backblazeb2.com`, `backblaze.com`) so a compromised B2\n   * endpoint cannot redirect the SDK to internal services. Pass an explicit\n   * list to add hosts (e.g. when testing against a self-hosted proxy) or set\n   * to an empty array to disable the guard entirely (not recommended).\n   *\n   * Only consulted when {@link B2ClientOptions.transport} is unset; a custom\n   * transport is the user's responsibility to harden.\n   */\n  readonly allowedHostSuffixes?: readonly string[]\n}\n\n/**\n * High-level B2 client providing ergonomic access to buckets, files, and keys.\n *\n * @example\n * ```ts\n * const client = new B2Client({\n *   applicationKeyId: process.env.B2_APPLICATION_KEY_ID,\n *   applicationKey: process.env.B2_APPLICATION_KEY,\n * })\n * await client.authorize()\n * const buckets = await client.listBuckets()\n * ```\n */\nexport class B2Client {\n  /** Low-level client for direct B2 API calls. */\n  readonly raw: RawClient\n  /** Authorization state storage (tokens, URLs, capabilities). */\n  readonly accountInfo: AccountInfo\n  /**\n   * SSRF allow-list applied by the default {@link FetchTransport}. `null` when\n   * a custom transport was supplied — in that case the SDK does not own the\n   * guard. Locked down by {@link B2Client.authorize}.\n   */\n  readonly urlGuard: UrlGuard | null\n  private readonly applicationKeyId: string\n  private readonly applicationKey: string\n  private readonly realmUrl: string\n  private readonly userAllowedSuffixes: readonly string[] | undefined\n\n  /**\n   * Creates a new B2Client. Call {@link authorize} before making API requests.\n   * @param options - Configuration including credentials, realm, and transport settings.\n   */\n  constructor(options: B2ClientOptions) {\n    this.applicationKeyId = options.applicationKeyId\n    this.applicationKey = options.applicationKey\n    this.realmUrl = getRealmUrl(options.realm ?? 'production')\n    this.accountInfo = options.accountInfo ?? new InMemoryAccountInfo()\n    this.userAllowedSuffixes = options.allowedHostSuffixes\n\n    let baseTransport: HttpTransport\n    if (options.transport !== undefined) {\n      baseTransport = options.transport\n      this.urlGuard = null\n    } else {\n      const urlGuard = new UrlGuard()\n      baseTransport = new FetchTransport({\n        urlGuard,\n        ...(options.userAgent !== undefined ? { userAgent: options.userAgent } : {}),\n      })\n      this.urlGuard = urlGuard\n    }\n\n    const retryTransport = new RetryTransport({\n      transport: baseTransport,\n      ...(options.retry !== undefined ? { retry: options.retry } : {}),\n      onReauth: () => this.reauthorize(),\n    })\n\n    this.raw = new RawClient({ transport: retryTransport })\n  }\n\n  /**\n   * Authenticates with B2 and stores the authorization state. Must be called before other methods.\n   *\n   * @returns The authorization response containing tokens, URLs, and capabilities.\n   */\n  async authorize(): Promise<AuthorizeAccountResponse> {\n    const auth = await this.raw.authorizeAccount(\n      this.applicationKeyId,\n      this.applicationKey,\n      this.realmUrl,\n    )\n    this.accountInfo.setAuth(auth)\n    // Lock the SSRF guard to the realm's hosts (plus any user additions).\n    // No-op when the caller supplied a custom transport: their threat model.\n    if (this.urlGuard !== null) {\n      const derived = deriveAllowedSuffixes(auth.apiInfo.storageApi)\n      const merged =\n        this.userAllowedSuffixes !== undefined\n          ? Array.from(new Set([...derived, ...this.userAllowedSuffixes]))\n          : derived\n      this.urlGuard.setAllowedSuffixes(merged)\n    }\n    return auth\n  }\n\n  /**\n   * Refresh credentials after a 401. Returns the fresh auth token so\n   * {@link RetryTransport} can rewrite the in-flight request's\n   * Authorization header before retrying.\n   *\n   * @returns The fresh authorization token.\n   */\n  private async reauthorize(): Promise<string> {\n    this.accountInfo.clear()\n    const auth = await this.authorize()\n    return auth.authorizationToken\n  }\n\n  /**\n   * Creates a new B2 bucket.\n   * @param options - Bucket configuration including name, type, and optional settings.\n   *\n   * @returns A {@link Bucket} handle for the newly created bucket.\n   */\n  async createBucket(options: {\n    /** Globally unique bucket name (6-50 chars, letters, digits, hyphens). */\n    bucketName: string\n    /** Access level: `\"allPrivate\"` or `\"allPublic\"`. */\n    bucketType: BucketType\n    /** Custom key-value metadata stored with the bucket. */\n    bucketInfo?: Record<string, string>\n    /** CORS rules for browser-based access. */\n    corsRules?: CorsRule[]\n    /** Default server-side encryption for new files. */\n    defaultServerSideEncryption?: EncryptionSetting\n    /** Default retention policy for new files (requires file lock). */\n    defaultRetention?: BucketRetentionPolicy\n    /** Enable file lock (Object Lock) on the bucket. Cannot be disabled once set. */\n    fileLockEnabled?: boolean\n    /** Lifecycle rules for automatic file deletion or hiding. */\n    lifecycleRules?: LifecycleRule[]\n    /** Cross-region replication configuration. */\n    replicationConfiguration?: ReplicationConfiguration\n  }): Promise<Bucket> {\n    const request: CreateBucketRequest = {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...options,\n    }\n    const info = await this.raw.createBucket(\n      this.accountInfo.getApiUrl(),\n      this.accountInfo.getAuthToken(),\n      request,\n    )\n    return new Bucket(this, info)\n  }\n\n  /**\n   * Lists buckets in the account, optionally filtered by ID, name, or type.\n   * @param options - Optional filters for bucket ID, name, or type.\n   *\n   * @returns An array of {@link Bucket} handles.\n   */\n  async listBuckets(options?: {\n    /** Filter to a specific bucket by ID. */\n    bucketId?: BucketId\n    /** Filter to a specific bucket by name. */\n    bucketName?: string\n    /** Filter by bucket types (e.g., `[\"allPrivate\"]`). */\n    bucketTypes?: BucketType[]\n  }): Promise<Bucket[]> {\n    const resp = await this.raw.listBuckets(\n      this.accountInfo.getApiUrl(),\n      this.accountInfo.getAuthToken(),\n      {\n        accountId: accountId(this.accountInfo.getAccountId()),\n        ...options,\n      },\n    )\n    return resp.buckets.map((info) => new Bucket(this, info))\n  }\n\n  /**\n   * Looks up a single bucket by name.\n   * @param bucketName - The name of the bucket to find.\n   *\n   * @returns The {@link Bucket} handle, or `null` if not found.\n   */\n  async getBucket(bucketName: string): Promise<Bucket | null> {\n    const buckets = await this.listBuckets({ bucketName })\n    return buckets[0] ?? null\n  }\n\n  /**\n   * Permanently deletes a bucket. The bucket must be empty.\n   * @param id - The unique identifier of the bucket to delete.\n   *\n   * @returns The deleted bucket metadata.\n   */\n  async deleteBucket(id: BucketId): Promise<BucketInfo> {\n    return this.raw.deleteBucket(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      bucketId: id,\n    })\n  }\n\n  /**\n   * Creates a new application key with the specified capabilities.\n   * @param options - Key configuration including capabilities, name, and optional restrictions.\n   *\n   * @returns The full key including the secret (only returned at creation time).\n   */\n  async createKey(options: {\n    /** Capabilities to grant (e.g., `[\"readFiles\", \"writeFiles\"]`). */\n    capabilities: Capability[]\n    /** Human-readable name for the key. */\n    keyName: string\n    /** Key expiration in seconds from now. Omit for non-expiring keys. */\n    validDurationInSeconds?: number\n    /** Restrict the key to a single bucket. */\n    bucketId?: BucketId\n    /** Restrict the key to files with this name prefix. */\n    namePrefix?: string\n  }): Promise<FullApplicationKey> {\n    return this.raw.createKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...options,\n    })\n  }\n\n  /**\n   * Lists application keys in the account.\n   * @param options - Optional pagination settings.\n   *\n   * @returns A page of application keys with an optional continuation token.\n   */\n  async listKeys(options?: {\n    /**\n     * Maximum number of keys to return per request. Forwarded to the\n     * raw API's `maxKeyCount` parameter.\n     */\n    pageSize?: number\n    /** Start listing after this key ID (for pagination). */\n    startApplicationKeyId?: ApplicationKeyId\n  }): Promise<ListKeysResponse> {\n    return this.raw.listKeys(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...(options?.pageSize !== undefined ? { maxKeyCount: options.pageSize } : {}),\n      ...(options?.startApplicationKeyId !== undefined\n        ? { startApplicationKeyId: options.startApplicationKeyId }\n        : {}),\n    })\n  }\n\n  /**\n   * Async iterator that yields every application key on the account,\n   * automatically handling pagination via `listKeys`.\n   *\n   * @param options - Pagination + abort options. `pageSize` is forwarded\n   *   to `maxKeyCount`; the default is 1000.\n   *\n   * @returns An async iterable of {@link ApplicationKey} entries.\n   *\n   * @example\n   * ```ts\n   * for await (const key of client.paginateKeys()) {\n   *   console.log(key.keyName, key.capabilities)\n   * }\n   * ```\n   */\n  paginateKeys(options?: PaginatorOptions): AsyncIterableIterator<ApplicationKey> {\n    return paginateItems(\n      async (cursor: ApplicationKeyId | undefined) => {\n        const resp = await this.listKeys({\n          pageSize: options?.pageSize ?? DEFAULT_PAGE_SIZE,\n          ...(cursor !== undefined ? { startApplicationKeyId: cursor } : {}),\n        })\n        return { page: resp, nextCursor: resp.nextApplicationKeyId ?? undefined }\n      },\n      (page) => page.keys,\n      options?.signal,\n    )\n  }\n\n  /**\n   * Permanently deletes an application key.\n   * @param applicationKeyId - The unique identifier of the key to delete.\n   *\n   * @returns The deleted application key metadata.\n   */\n  async deleteKey(applicationKeyId: ApplicationKeyId): Promise<ApplicationKey> {\n    return this.raw.deleteKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      applicationKeyId,\n    })\n  }\n\n  /**\n   * Checks whether the authorized application key carries every capability in\n   * `needed`. Returns the missing capabilities so callers can fail fast with a\n   * clear error instead of a generic 401/403 from the server.\n   *\n   * @param needed - The capabilities required by the planned operation.\n   *\n   * @returns An object with `ok: true` when every needed capability is\n   *   present, otherwise `{ ok: false, missing: [...] }`.\n   *\n   * @throws If {@link authorize} has not been called yet.\n   */\n  hasCapabilities(needed: readonly Capability[]): CapabilityCheckResult {\n    const auth = this.accountInfo.getAuth()\n    if (!auth) throw new Error('Not authorized. Call authorize() first.')\n    const available = new Set<string>(auth.apiInfo.storageApi.allowed.capabilities)\n    const missing = needed.filter((cap) => !available.has(cap as string))\n    return { ok: missing.length === 0, missing }\n  }\n}\n"],"names":["getRealmUrl","InMemoryAccountInfo","urlGuard","UrlGuard","FetchTransport","RetryTransport","RawClient","deriveAllowedSuffixes","accountId","Bucket","paginateItems","DEFAULT_PAGE_SIZE"],"mappings":";;;;;;;;;;;AA6EO,MAAM,SAAS;AAAA;AAAA,EAEX;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjB,YAAY,SAA0B;AACpC,SAAK,mBAAmB,QAAQ;AAChC,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,WAAWA,OAAAA,YAAY,QAAQ,SAAS,YAAY;AACzD,SAAK,cAAc,QAAQ,eAAe,IAAIC,SAAAA,oBAAA;AAC9C,SAAK,sBAAsB,QAAQ;AAEnC,QAAI;AACJ,QAAI,QAAQ,cAAc,QAAW;AACnC,sBAAgB,QAAQ;AACxB,WAAK,WAAW;AAAA,IAClB,OAAO;AACL,YAAMC,aAAW,IAAIC,kBAAA;AACrB,sBAAgB,IAAIC,UAAAA,eAAe;AAAA,QAAA,UACjCF;AAAAA,QACA,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,cAAc,CAAA;AAAA,MAAC,CAC3E;AACD,WAAK,WAAWA;AAAAA,IAClB;AAEA,UAAM,iBAAiB,IAAIG,yBAAe;AAAA,MACxC,WAAW;AAAA,MACX,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,MAAA,IAAU,CAAA;AAAA,MAC7D,UAAU,MAAM,KAAK,YAAA;AAAA,IAAY,CAClC;AAED,SAAK,MAAM,IAAIC,UAAAA,UAAU,EAAE,WAAW,gBAAgB;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAA+C;AACnD,UAAM,OAAO,MAAM,KAAK,IAAI;AAAA,MAC1B,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEP,SAAK,YAAY,QAAQ,IAAI;AAG7B,QAAI,KAAK,aAAa,MAAM;AAC1B,YAAM,UAAUC,SAAAA,sBAAsB,KAAK,QAAQ,UAAU;AAC7D,YAAM,SACJ,KAAK,wBAAwB,SACzB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK,mBAAmB,CAAC,CAAC,IAC7D;AACN,WAAK,SAAS,mBAAmB,MAAM;AAAA,IACzC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cAA+B;AAC3C,SAAK,YAAY,MAAA;AACjB,UAAM,OAAO,MAAM,KAAK,UAAA;AACxB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,aAAa,SAmBC;AAClB,UAAM,UAA+B;AAAA,MACnC,WAAWC,IAAAA,UAAU,KAAK,YAAY,cAAc;AAAA,MACpD,GAAG;AAAA,IAAA;AAEL,UAAM,OAAO,MAAM,KAAK,IAAI;AAAA,MAC1B,KAAK,YAAY,UAAA;AAAA,MACjB,KAAK,YAAY,aAAA;AAAA,MACjB;AAAA,IAAA;AAEF,WAAO,IAAIC,OAAAA,OAAO,MAAM,IAAI;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAY,SAOI;AACpB,UAAM,OAAO,MAAM,KAAK,IAAI;AAAA,MAC1B,KAAK,YAAY,UAAA;AAAA,MACjB,KAAK,YAAY,aAAA;AAAA,MACjB;AAAA,QACE,WAAWD,IAAAA,UAAU,KAAK,YAAY,cAAc;AAAA,QACpD,GAAG;AAAA,MAAA;AAAA,IACL;AAEF,WAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAIC,OAAAA,OAAO,MAAM,IAAI,CAAC;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAU,YAA4C;AAC1D,UAAM,UAAU,MAAM,KAAK,YAAY,EAAE,YAAY;AACrD,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,aAAa,IAAmC;AACpD,WAAO,KAAK,IAAI,aAAa,KAAK,YAAY,aAAa,KAAK,YAAY,gBAAgB;AAAA,MAC1F,WAAWD,IAAAA,UAAU,KAAK,YAAY,cAAc;AAAA,MACpD,UAAU;AAAA,IAAA,CACX;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAU,SAWgB;AAC9B,WAAO,KAAK,IAAI,UAAU,KAAK,YAAY,aAAa,KAAK,YAAY,gBAAgB;AAAA,MACvF,WAAWA,IAAAA,UAAU,KAAK,YAAY,cAAc;AAAA,MACpD,GAAG;AAAA,IAAA,CACJ;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,SAQe;AAC5B,WAAO,KAAK,IAAI,SAAS,KAAK,YAAY,aAAa,KAAK,YAAY,gBAAgB;AAAA,MACtF,WAAWA,IAAAA,UAAU,KAAK,YAAY,cAAc;AAAA,MACpD,GAAI,SAAS,aAAa,SAAY,EAAE,aAAa,QAAQ,SAAA,IAAa,CAAA;AAAA,MAC1E,GAAI,SAAS,0BAA0B,SACnC,EAAE,uBAAuB,QAAQ,0BACjC,CAAA;AAAA,IAAC,CACN;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,aAAa,SAAmE;AAC9E,WAAOE,UAAAA;AAAAA,MACL,OAAO,WAAyC;AAC9C,cAAM,OAAO,MAAM,KAAK,SAAS;AAAA,UAC/B,UAAU,SAAS,YAAYC,SAAAA;AAAAA,UAC/B,GAAI,WAAW,SAAY,EAAE,uBAAuB,OAAA,IAAW,CAAA;AAAA,QAAC,CACjE;AACD,eAAO,EAAE,MAAM,MAAM,YAAY,KAAK,wBAAwB,OAAA;AAAA,MAChE;AAAA,MACA,CAAC,SAAS,KAAK;AAAA,MACf,SAAS;AAAA,IAAA;AAAA,EAEb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAU,kBAA6D;AAC3E,WAAO,KAAK,IAAI,UAAU,KAAK,YAAY,aAAa,KAAK,YAAY,gBAAgB;AAAA,MACvF;AAAA,IAAA,CACD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,gBAAgB,QAAsD;AACpE,UAAM,OAAO,KAAK,YAAY,QAAA;AAC9B,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,yCAAyC;AACpE,UAAM,YAAY,IAAI,IAAY,KAAK,QAAQ,WAAW,QAAQ,YAAY;AAC9E,UAAM,UAAU,OAAO,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAa,CAAC;AACpE,WAAO,EAAE,IAAI,QAAQ,WAAW,GAAG,QAAA;AAAA,EACrC;AACF;;"}
+{"version":3,"file":"client.cjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type { AccountInfo } from './auth/account-info.ts'\nimport { InMemoryAccountInfo } from './auth/in-memory.ts'\nimport { getRealmUrl } from './auth/realms.ts'\nimport { Bucket } from './bucket.ts'\nimport { DEFAULT_RETRY_OPTIONS, type RetryOptions } from './http/retry.ts'\nimport type { HttpTransport } from './http/transport.ts'\nimport { FetchTransport, RetryTransport } from './http/transport.ts'\nimport { deriveAllowedSuffixes, UrlGuard } from './http/url-guard.ts'\nimport { RawClient } from './raw/index.ts'\nimport type { AuthorizeAccountResponse, Capability } from './types/auth.ts'\nimport type {\n  BucketInfo,\n  BucketRetentionPolicy,\n  BucketType,\n  CorsRule,\n  CreateBucketRequest,\n  LifecycleRule,\n} from './types/bucket.ts'\nimport type { EncryptionSetting } from './types/encryption.ts'\nimport type { ApplicationKeyId, BucketId } from './types/ids.ts'\nimport { accountId } from './types/ids.ts'\nimport type {\n  ApplicationKey,\n  CreateKeyOptions,\n  FullApplicationKey,\n  ListKeysResponse,\n} from './types/key.ts'\nimport type { ReplicationConfiguration } from './types/replication.ts'\nimport { DEFAULT_PAGE_SIZE } from './util/defaults.ts'\nimport { type PaginatorOptions, paginateItems } from './util/paginator.ts'\n\n/** Result of {@link B2Client.hasCapabilities}. */\nexport interface CapabilityCheckResult {\n  /** `true` when the key carries every requested capability. */\n  readonly ok: boolean\n  /** Capabilities the call requested that the current key does not hold. Empty when `ok` is `true`. */\n  readonly missing: readonly Capability[]\n}\n\n/** Configuration options for creating a {@link B2Client}. */\nexport interface B2ClientOptions {\n  /** The application key ID from the B2 dashboard or `b2_create_key`. */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /**\n   * B2 realm to authenticate against. Accepts a known realm-map key\n   * (`\"production\"` or `\"staging\"`) or a direct base URL. Custom HTTPS hosts\n   * are trusted with the application key during authorize, so never derive\n   * `realm` from untrusted input. URL values must use HTTPS, or loopback IP\n   * literal HTTP for local testing only; application-key credentials are sent\n   * unencrypted over loopback HTTP. Unsupported schemes, malformed URLs,\n   * non-URL strings, plaintext HTTP hostnames such as `localhost`, and\n   * non-loopback plaintext HTTP are rejected before credentials are sent. URL\n   * values must not include userinfo, query strings, or fragments. Defaults to\n   * `\"production\"`.\n   */\n  readonly realm?: string\n  /** Storage backend for authorization state. Defaults to {@link InMemoryAccountInfo}. */\n  readonly accountInfo?: AccountInfo\n  /** Custom HTTP transport. Defaults to {@link FetchTransport}. Wrapped by {@link RetryTransport}. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior (max retries, backoff, and per-attempt timeout). */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /**\n   * Override the SSRF allow-list. By default the SDK locks the\n   * {@link FetchTransport} to host suffixes derived from the realm's authorize\n   * response (e.g. `backblazeb2.com`, `backblaze.com`) so a compromised B2\n   * endpoint cannot redirect the SDK to internal services. Pass an explicit\n   * list to add hosts (e.g. when testing against a self-hosted proxy) or set\n   * to an empty array to disable the guard entirely (not recommended).\n   *\n   * Only consulted when {@link B2ClientOptions.transport} is unset; a custom\n   * transport is the user's responsibility to harden.\n   */\n  readonly allowedHostSuffixes?: readonly string[]\n  /**\n   * Follow same-origin GET/HEAD redirects in the default fetch transport after\n   * checking each target with the SSRF guard. POST redirects remain blocked.\n   * Defaults to true.\n   */\n  readonly followSameOriginRedirects?: boolean\n}\n\n/**\n * High-level B2 client providing ergonomic access to buckets, files, and keys.\n *\n * @example\n * ```ts\n * const client = new B2Client({\n *   applicationKeyId: process.env.B2_APPLICATION_KEY_ID,\n *   applicationKey: process.env.B2_APPLICATION_KEY,\n * })\n * await client.authorize()\n * const buckets = await client.listBuckets()\n * ```\n */\nexport class B2Client {\n  /** Low-level client for direct B2 API calls. */\n  readonly raw: RawClient\n  /** Authorization state storage (tokens, URLs, capabilities). */\n  readonly accountInfo: AccountInfo\n  /**\n   * SSRF allow-list applied by the default {@link FetchTransport}. `null` when\n   * a custom transport was supplied — in that case the SDK does not own the\n   * guard. Locked down by {@link B2Client.authorize}.\n   */\n  readonly urlGuard: UrlGuard | null\n  private readonly applicationKeyId: string\n  private readonly applicationKey: string\n  private readonly realmUrl: string\n  private readonly userAllowedSuffixes: readonly string[] | undefined\n  private readonly resolvedUploadRetryOptions: RetryOptions\n\n  /**\n   * Creates a new B2Client. Call {@link authorize} before making API requests.\n   * @param options - Configuration including credentials, realm, and transport settings.\n   */\n  constructor(options: B2ClientOptions) {\n    this.applicationKeyId = options.applicationKeyId\n    this.applicationKey = options.applicationKey\n    this.realmUrl = getRealmUrl(options.realm ?? 'production')\n    this.accountInfo = options.accountInfo ?? new InMemoryAccountInfo()\n    bindAccountInfoAuthContext(this.accountInfo, this.realmUrl, this.applicationKeyId)\n    this.userAllowedSuffixes = options.allowedHostSuffixes\n    this.resolvedUploadRetryOptions = { ...DEFAULT_RETRY_OPTIONS, ...options.retry }\n\n    let baseTransport: HttpTransport\n    if (options.transport !== undefined) {\n      baseTransport = options.transport\n      this.urlGuard = null\n    } else {\n      const urlGuard = new UrlGuard()\n      baseTransport = new FetchTransport({\n        urlGuard,\n        ...(options.userAgent !== undefined ? { userAgent: options.userAgent } : {}),\n        ...(options.followSameOriginRedirects !== undefined\n          ? { followSameOriginRedirects: options.followSameOriginRedirects }\n          : {}),\n      })\n      this.urlGuard = urlGuard\n    }\n\n    const retryTransport = new RetryTransport({\n      transport: baseTransport,\n      retry: this.resolvedUploadRetryOptions,\n      onReauth: () => this.reauthorize(),\n    })\n\n    const cachedAuth = this.accountInfo.getAuth()\n    if (cachedAuth !== null) this.lockUrlGuard(cachedAuth)\n\n    this.raw = new RawClient({ transport: retryTransport })\n  }\n\n  /**\n   * Authenticates with B2 and stores the authorization state. Must be called before other methods.\n   *\n   * @returns The authorization response containing tokens, URLs, and capabilities.\n   */\n  async authorize(): Promise<AuthorizeAccountResponse> {\n    const auth = await this.raw.authorizeAccount(\n      this.applicationKeyId,\n      this.applicationKey,\n      this.realmUrl,\n    )\n    this.accountInfo.setAuth(auth)\n    this.lockUrlGuard(auth)\n    return auth\n  }\n\n  private lockUrlGuard(auth: AuthorizeAccountResponse): void {\n    if (this.urlGuard !== null) {\n      const derived = deriveAllowedSuffixes(auth.apiInfo.storageApi)\n      const merged =\n        this.userAllowedSuffixes !== undefined\n          ? this.userAllowedSuffixes.length === 0\n            ? []\n            : Array.from(new Set([...derived, ...this.userAllowedSuffixes]))\n          : derived\n      this.urlGuard.setAllowedSuffixes(merged)\n    }\n  }\n\n  /**\n   * Refresh credentials after a 401. Returns the fresh auth token so\n   * {@link RetryTransport} can rewrite the in-flight request's\n   * Authorization header before retrying.\n   *\n   * @returns The fresh authorization token.\n   */\n  private async reauthorize(): Promise<string> {\n    this.accountInfo.clear()\n    const auth = await this.authorize()\n    return auth.authorizationToken\n  }\n\n  /**\n   * Creates a new B2 bucket.\n   * @param options - Bucket configuration including name, type, and optional settings.\n   *\n   * @returns A {@link Bucket} handle for the newly created bucket.\n   */\n  async createBucket(options: {\n    /** Globally unique bucket name (6-63 chars; letters, digits, hyphens, periods). */\n    bucketName: string\n    /** Access level: `\"allPrivate\"` or `\"allPublic\"`. */\n    bucketType: BucketType\n    /** Custom key-value metadata stored with the bucket. */\n    bucketInfo?: Record<string, string>\n    /** CORS rules for browser-based access. */\n    corsRules?: CorsRule[]\n    /** Default server-side encryption for new files. */\n    defaultServerSideEncryption?: EncryptionSetting\n    /** Default retention policy for new files (requires file lock). */\n    defaultRetention?: BucketRetentionPolicy\n    /** Enable file lock (Object Lock) on the bucket. Cannot be disabled once set. */\n    fileLockEnabled?: boolean\n    /** Lifecycle rules for automatic file deletion or hiding. */\n    lifecycleRules?: LifecycleRule[]\n    /** Cross-region replication configuration. */\n    replicationConfiguration?: ReplicationConfiguration\n  }): Promise<Bucket> {\n    const request: CreateBucketRequest = {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...options,\n    }\n    const info = await this.raw.createBucket(\n      this.accountInfo.getApiUrl(),\n      this.accountInfo.getAuthToken(),\n      request,\n    )\n    return new Bucket(this, info, this.resolvedUploadRetryOptions)\n  }\n\n  /**\n   * Lists buckets in the account, optionally filtered by ID, name, or type.\n   * @param options - Optional filters for bucket ID, name, or type.\n   *\n   * @returns An array of {@link Bucket} handles.\n   */\n  async listBuckets(options?: {\n    /** Filter to a specific bucket by ID. */\n    bucketId?: BucketId\n    /** Filter to a specific bucket by name. */\n    bucketName?: string\n    /** Filter by bucket types (e.g., `[\"allPrivate\"]`). */\n    bucketTypes?: BucketType[]\n  }): Promise<Bucket[]> {\n    const resp = await this.raw.listBuckets(\n      this.accountInfo.getApiUrl(),\n      this.accountInfo.getAuthToken(),\n      {\n        accountId: accountId(this.accountInfo.getAccountId()),\n        ...options,\n      },\n    )\n    return resp.buckets.map((info) => new Bucket(this, info, this.resolvedUploadRetryOptions))\n  }\n\n  /**\n   * Looks up a single bucket by name.\n   * @param bucketName - The name of the bucket to find.\n   *\n   * @returns The {@link Bucket} handle, or `null` if not found.\n   */\n  async getBucket(bucketName: string): Promise<Bucket | null> {\n    const buckets = await this.listBuckets({ bucketName })\n    const filteredMatch = buckets[0]\n    if (filteredMatch !== undefined) return filteredMatch\n\n    const unfilteredBuckets = await this.listBuckets()\n    return unfilteredBuckets.find((bucket) => bucket.name === bucketName) ?? null\n  }\n\n  /**\n   * Permanently deletes a bucket. The bucket must be empty.\n   * @param id - The unique identifier of the bucket to delete.\n   *\n   * @returns The deleted bucket metadata.\n   */\n  async deleteBucket(id: BucketId): Promise<BucketInfo> {\n    return this.raw.deleteBucket(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      bucketId: id,\n    })\n  }\n\n  /**\n   * Creates a new application key with the specified capabilities.\n   * @param options - Key configuration including capabilities, name, and optional restrictions.\n   *\n   * @returns The full key including the secret (only returned at creation time).\n   */\n  async createKey(options: CreateKeyOptions): Promise<FullApplicationKey> {\n    return this.raw.createKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...options,\n    })\n  }\n\n  /**\n   * Lists application keys in the account.\n   * @param options - Optional pagination settings.\n   *\n   * @returns A page of application keys with an optional continuation token.\n   */\n  async listKeys(options?: {\n    /**\n     * Maximum number of keys to return per request. Forwarded to the\n     * raw API's `maxKeyCount` parameter.\n     */\n    pageSize?: number\n    /** Start listing after this key ID (for pagination). */\n    startApplicationKeyId?: ApplicationKeyId\n  }): Promise<ListKeysResponse> {\n    return this.raw.listKeys(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...(options?.pageSize !== undefined ? { maxKeyCount: options.pageSize } : {}),\n      ...(options?.startApplicationKeyId !== undefined\n        ? { startApplicationKeyId: options.startApplicationKeyId }\n        : {}),\n    })\n  }\n\n  /**\n   * Async iterator that yields every application key on the account,\n   * automatically handling pagination via `listKeys`.\n   *\n   * @param options - Pagination + abort options. `pageSize` is forwarded\n   *   to `maxKeyCount`; the default is 1000.\n   *\n   * @returns An async iterable of {@link ApplicationKey} entries.\n   *\n   * @example\n   * ```ts\n   * for await (const key of client.paginateKeys()) {\n   *   console.log(key.keyName, key.capabilities)\n   * }\n   * ```\n   */\n  paginateKeys(options?: PaginatorOptions): AsyncIterableIterator<ApplicationKey> {\n    return paginateItems(\n      async (cursor: ApplicationKeyId | undefined) => {\n        const resp = await this.listKeys({\n          pageSize: options?.pageSize ?? DEFAULT_PAGE_SIZE,\n          ...(cursor !== undefined ? { startApplicationKeyId: cursor } : {}),\n        })\n        return { page: resp, nextCursor: resp.nextApplicationKeyId ?? undefined }\n      },\n      (page) => page.keys,\n      options?.signal,\n    )\n  }\n\n  /**\n   * Permanently deletes an application key.\n   * @param applicationKeyId - The unique identifier of the key to delete.\n   *\n   * @returns The deleted application key metadata.\n   */\n  async deleteKey(applicationKeyId: ApplicationKeyId): Promise<ApplicationKey> {\n    return this.raw.deleteKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      applicationKeyId,\n    })\n  }\n\n  /**\n   * Checks whether the authorized application key carries every capability in\n   * `needed`. Returns the missing capabilities so callers can fail fast with a\n   * clear error instead of a generic 401/403 from the server.\n   *\n   * @param needed - The capabilities required by the planned operation.\n   *\n   * @returns An object with `ok: true` when every needed capability is\n   *   present, otherwise `{ ok: false, missing: [...] }`.\n   *\n   * @throws If {@link authorize} has not been called yet.\n   */\n  hasCapabilities(needed: readonly Capability[]): CapabilityCheckResult {\n    const auth = this.accountInfo.getAuth()\n    if (!auth) throw new Error('Not authorized. Call authorize() first.')\n    const available = new Set<string>(auth.apiInfo.storageApi.allowed.capabilities)\n    const missing = needed.filter((cap) => !available.has(cap as string))\n    return { ok: missing.length === 0, missing }\n  }\n}\n\nfunction bindAccountInfoAuthContext(\n  accountInfo: AccountInfo,\n  realmUrl: string,\n  applicationKeyId: string,\n): void {\n  accountInfo.setApplicationKeyId?.(applicationKeyId)\n  accountInfo.setRealmUrl?.(realmUrl)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmGA,IAAa,WAAb,MAAsB;;CAEpB;;CAEA;;;;;;CAMA;CACA;CACA;CACA;CACA;CACA;;;;;CAMA,YAAY,SAA0B;EACpC,KAAK,mBAAmB,QAAQ;EAChC,KAAK,iBAAiB,QAAQ;EAC9B,KAAK,WAAW,eAAA,YAAY,QAAQ,SAAS,YAAY;EACzD,KAAK,cAAc,QAAQ,eAAe,IAAI,kBAAA,oBAAoB;EAClE,2BAA2B,KAAK,aAAa,KAAK,UAAU,KAAK,gBAAgB;EACjF,KAAK,sBAAsB,QAAQ;EACnC,KAAK,6BAA6B;GAAE,GAAG,cAAA;GAAuB,GAAG,QAAQ;EAAM;EAE/E,IAAI;EACJ,IAAI,QAAQ,cAAc,KAAA,GAAW;GACnC,gBAAgB,QAAQ;GACxB,KAAK,WAAW;EAClB,OAAO;GACL,MAAM,WAAW,IAAI,kBAAA,SAAS;GAC9B,gBAAgB,IAAI,kBAAA,eAAe;IACjC;IACA,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC1E,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;GACP,CAAC;GACD,KAAK,WAAW;EAClB;EAEA,MAAM,iBAAiB,IAAI,kBAAA,eAAe;GACxC,WAAW;GACX,OAAO,KAAK;GACZ,gBAAgB,KAAK,YAAY;EACnC,CAAC;EAED,MAAM,aAAa,KAAK,YAAY,QAAQ;EAC5C,IAAI,eAAe,MAAM,KAAK,aAAa,UAAU;EAErD,KAAK,MAAM,IAAI,kBAAA,UAAU,EAAE,WAAW,eAAe,CAAC;CACxD;;;;;;CAOA,MAAM,YAA+C;EACnD,MAAM,OAAO,MAAM,KAAK,IAAI,iBAC1B,KAAK,kBACL,KAAK,gBACL,KAAK,QACP;EACA,KAAK,YAAY,QAAQ,IAAI;EAC7B,KAAK,aAAa,IAAI;EACtB,OAAO;CACT;CAEA,aAAqB,MAAsC;EACzD,IAAI,KAAK,aAAa,MAAM;GAC1B,MAAM,UAAU,kBAAA,sBAAsB,KAAK,QAAQ,UAAU;GAC7D,MAAM,SACJ,KAAK,wBAAwB,KAAA,IACzB,KAAK,oBAAoB,WAAW,IAClC,CAAC,IACD,MAAM,qBAAK,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK,mBAAmB,CAAC,CAAC,IAC/D;GACN,KAAK,SAAS,mBAAmB,MAAM;EACzC;CACF;;;;;;;;CASA,MAAc,cAA+B;EAC3C,KAAK,YAAY,MAAM;EAEvB,QAAO,MADY,KAAK,UAAU,EAAA,CACtB;CACd;;;;;;;CAQA,MAAM,aAAa,SAmBC;EAClB,MAAM,UAA+B;GACnC,WAAW,YAAA,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAG;EACL;EACA,MAAM,OAAO,MAAM,KAAK,IAAI,aAC1B,KAAK,YAAY,UAAU,GAC3B,KAAK,YAAY,aAAa,GAC9B,OACF;EACA,OAAO,IAAI,eAAA,OAAO,MAAM,MAAM,KAAK,0BAA0B;CAC/D;;;;;;;CAQA,MAAM,YAAY,SAOI;EASpB,QAAO,MARY,KAAK,IAAI,YAC1B,KAAK,YAAY,UAAU,GAC3B,KAAK,YAAY,aAAa,GAC9B;GACE,WAAW,YAAA,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAG;EACL,CACF,EAAA,CACY,QAAQ,KAAK,SAAS,IAAI,eAAA,OAAO,MAAM,MAAM,KAAK,0BAA0B,CAAC;CAC3F;;;;;;;CAQA,MAAM,UAAU,YAA4C;EAE1D,MAAM,iBAAgB,MADA,KAAK,YAAY,EAAE,WAAW,CAAC,EAAA,CACvB;EAC9B,IAAI,kBAAkB,KAAA,GAAW,OAAO;EAGxC,QAAO,MADyB,KAAK,YAAY,EAAA,CACxB,MAAM,WAAW,OAAO,SAAS,UAAU,KAAK;CAC3E;;;;;;;CAQA,MAAM,aAAa,IAAmC;EACpD,OAAO,KAAK,IAAI,aAAa,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GAC1F,WAAW,YAAA,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,UAAU;EACZ,CAAC;CACH;;;;;;;CAQA,MAAM,UAAU,SAAwD;EACtE,OAAO,KAAK,IAAI,UAAU,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GACvF,WAAW,YAAA,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAG;EACL,CAAC;CACH;;;;;;;CAQA,MAAM,SAAS,SAQe;EAC5B,OAAO,KAAK,IAAI,SAAS,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GACtF,WAAW,YAAA,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAI,SAAS,aAAa,KAAA,IAAY,EAAE,aAAa,QAAQ,SAAS,IAAI,CAAC;GAC3E,GAAI,SAAS,0BAA0B,KAAA,IACnC,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;EACP,CAAC;CACH;;;;;;;;;;;;;;;;;CAkBA,aAAa,SAAmE;EAC9E,OAAO,kBAAA,cACL,OAAO,WAAyC;GAC9C,MAAM,OAAO,MAAM,KAAK,SAAS;IAC/B,UAAU,SAAS,YAAA;IACnB,GAAI,WAAW,KAAA,IAAY,EAAE,uBAAuB,OAAO,IAAI,CAAC;GAClE,CAAC;GACD,OAAO;IAAE,MAAM;IAAM,YAAY,KAAK,wBAAwB,KAAA;GAAU;EAC1E,IACC,SAAS,KAAK,MACf,SAAS,MACX;CACF;;;;;;;CAQA,MAAM,UAAU,kBAA6D;EAC3E,OAAO,KAAK,IAAI,UAAU,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG,EACvF,iBACF,CAAC;CACH;;;;;;;;;;;;;CAcA,gBAAgB,QAAsD;EACpE,MAAM,OAAO,KAAK,YAAY,QAAQ;EACtC,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,yCAAyC;EACpE,MAAM,YAAY,IAAI,IAAY,KAAK,QAAQ,WAAW,QAAQ,YAAY;EAC9E,MAAM,UAAU,OAAO,QAAQ,QAAQ,CAAC,UAAU,IAAI,GAAa,CAAC;EACpE,OAAO;GAAE,IAAI,QAAQ,WAAW;GAAG;EAAQ;CAC7C;AACF;AAEA,SAAS,2BACP,aACA,UACA,kBACM;CACN,YAAY,sBAAsB,gBAAgB;CAClD,YAAY,cAAc,QAAQ;AACpC"}