@backblaze-labs/b2-sdk 0.1.0 → 0.2.0

package/dist/auth/file.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"file.cjs","sources":["../../src/auth/file.ts"],"sourcesContent":["import { mkdir, readFile, writeFile } from 'node:fs/promises'\nimport { dirname } from 'node:path'\nimport type { AuthorizeAccountResponse } from '../types/auth.ts'\nimport type { BucketId } from '../types/ids.ts'\nimport type { AccountInfo, UploadUrlEntry } from './account-info.ts'\nimport { InMemoryAccountInfo } from './in-memory.ts'\n\n/**\n * Node-only {@link AccountInfo} backend that persists the authorization\n * response to a JSON file. Upload URL pools remain in memory because URLs are\n * short-lived and shouldn't be shared across processes.\n *\n * On instantiation, call {@link FileAccountInfo.load} to populate state from\n * disk (or start fresh if the file is missing or corrupt). The authorization\n * response is written back to disk on every {@link setAuth} or {@link clear}\n * call so a process restart can resume without re-authorizing.\n *\n * This module imports `node:fs/promises`; do not load it in browser bundles.\n */\nexport class FileAccountInfo implements AccountInfo {\n  private readonly inner = new InMemoryAccountInfo()\n  private writeQueue: Promise<void> = Promise.resolve()\n\n  /**\n   * Constructs a `FileAccountInfo` bound to a JSON file on disk. The file is\n   * created on the first `setAuth` write; reading it back happens via\n   * {@link load}.\n   *\n   * @param path - Absolute path to the JSON file that backs this account info.\n   */\n  constructor(public readonly path: string) {}\n\n  /**\n   * Reads the JSON file at the configured path and populates in-memory state.\n   * If the file is missing or contains invalid JSON, leaves state empty and\n   * returns silently (a re-auth is expected next).\n   *\n   * @returns A promise that resolves when load is complete.\n   */\n  async load(): Promise<void> {\n    try {\n      const text = await readFile(this.path, 'utf8')\n      const parsed = JSON.parse(text) as AuthorizeAccountResponse\n      this.inner.setAuth(parsed)\n    } catch {\n      // Missing file, invalid JSON, or permission denied: start empty.\n    }\n  }\n\n  /**\n   * Persists the current auth response to the file. Atomically queues writes\n   * so concurrent updates serialize.\n   *\n   * @returns A promise that resolves when the write completes.\n   */\n  private flush(): Promise<void> {\n    const auth = this.inner.getAuth()\n    const next = this.writeQueue.then(async () => {\n      if (auth === null) {\n        try {\n          await writeFile(this.path, '', 'utf8')\n        } catch {\n          // Best-effort\n        }\n        return\n      }\n      await mkdir(dirname(this.path), { recursive: true })\n      await writeFile(this.path, JSON.stringify(auth), 'utf8')\n    })\n    this.writeQueue = next.catch(() => {})\n    return next\n  }\n\n  /**\n   * Stores the given authorization response and triggers an async write to disk.\n   *\n   * @param auth - The authorize-account response to persist.\n   */\n  setAuth(auth: AuthorizeAccountResponse): void {\n    this.inner.setAuth(auth)\n    void this.flush()\n  }\n\n  /**\n   * Returns the currently cached authorization response, or `null` if none.\n   *\n   * @returns The cached authorization response, or `null` if not authorized.\n   */\n  getAuth(): AuthorizeAccountResponse | null {\n    return this.inner.getAuth()\n  }\n\n  /** Discards in-memory state and clears the on-disk file. */\n  clear(): void {\n    this.inner.clear()\n    void this.flush()\n  }\n\n  /**\n   * Returns the cached B2 API URL.\n   *\n   * @returns The base URL for B2 API calls.\n   */\n  getApiUrl(): string {\n    return this.inner.getApiUrl()\n  }\n\n  /**\n   * Returns the cached file-download URL.\n   *\n   * @returns The base URL for file downloads.\n   */\n  getDownloadUrl(): string {\n    return this.inner.getDownloadUrl()\n  }\n\n  /**\n   * Returns the cached session authorization token.\n   *\n   * @returns The current authorization token.\n   */\n  getAuthToken(): string {\n    return this.inner.getAuthToken()\n  }\n\n  /**\n   * Returns the cached account identifier.\n   *\n   * @returns The authorized account ID.\n   */\n  getAccountId(): string {\n    return this.inner.getAccountId()\n  }\n\n  /**\n   * Returns the server-recommended part size for multipart uploads.\n   *\n   * @returns The recommended part size in bytes.\n   */\n  getRecommendedPartSize(): number {\n    return this.inner.getRecommendedPartSize()\n  }\n\n  /**\n   * Returns the server-enforced minimum part size for multipart uploads.\n   *\n   * @returns The absolute minimum part size in bytes.\n   */\n  getAbsoluteMinimumPartSize(): number {\n    return this.inner.getAbsoluteMinimumPartSize()\n  }\n\n  /**\n   * Returns the cached S3-compatible API URL.\n   *\n   * @returns The base URL for the S3-compatible API.\n   */\n  getS3ApiUrl(): string {\n    return this.inner.getS3ApiUrl()\n  }\n\n  /**\n   * Returns the bucket the key is restricted to, if any.\n   *\n   * @returns The restricted bucket ID, or `null` if the key is unrestricted.\n   */\n  getAllowedBucketId(): BucketId | null {\n    return this.inner.getAllowedBucketId()\n  }\n\n  /**\n   * Takes an upload URL from the in-memory pool for the given bucket.\n   *\n   * @param bucketId - Bucket to check out an upload URL for.\n   *\n   * @returns A reusable upload URL entry, or `null` if none are pooled.\n   */\n  checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null {\n    return this.inner.checkoutUploadUrl(bucketId)\n  }\n\n  /**\n   * Returns a still-valid upload URL to the pool for reuse.\n   *\n   * @param bucketId - Bucket the upload URL belongs to.\n   * @param entry - Upload URL entry to return.\n   */\n  returnUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.inner.returnUploadUrl(bucketId, entry)\n  }\n\n  /**\n   * Removes an upload URL from the pool after an upload error.\n   *\n   * @param bucketId - Bucket the failed upload URL belongs to.\n   * @param entry - Upload URL entry to evict.\n   */\n  evictUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.inner.evictUploadUrl(bucketId, entry)\n  }\n\n  /**\n   * Takes a large-file part upload URL from the in-memory pool.\n   *\n   * @param fileId - Large file to check out a part upload URL for.\n   *\n   * @returns A reusable part upload URL entry, or `null` if none are pooled.\n   */\n  checkoutPartUploadUrl(fileId: string): UploadUrlEntry | null {\n    return this.inner.checkoutPartUploadUrl(fileId)\n  }\n\n  /**\n   * Returns a still-valid part upload URL to the pool for reuse.\n   *\n   * @param fileId - Large file the part upload URL belongs to.\n   * @param entry - Part upload URL entry to return.\n   */\n  returnPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.inner.returnPartUploadUrl(fileId, entry)\n  }\n\n  /**\n   * Removes a part upload URL from the pool after an error.\n   *\n   * @param fileId - Large file the failed part upload URL belongs to.\n   * @param entry - Part upload URL entry to evict.\n   */\n  evictPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.inner.evictPartUploadUrl(fileId, entry)\n  }\n\n  /**\n   * Awaits any pending disk writes. Call before process exit to ensure the\n   * latest state is persisted.\n   *\n   * @returns A promise that resolves once all queued writes are flushed.\n   */\n  async flushed(): Promise<void> {\n    await this.writeQueue\n  }\n}\n"],"names":["InMemoryAccountInfo","readFile","writeFile","mkdir","dirname"],"mappings":";;;;;AAmBO,MAAM,gBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWlD,YAA4B,MAAc;AAAd,SAAA,OAAA;AAAA,EAAe;AAAA,EAV1B,QAAQ,IAAIA,SAAAA,oBAAA;AAAA,EACrB,aAA4B,QAAQ,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB5C,MAAM,OAAsB;AAC1B,QAAI;AACF,YAAM,OAAO,MAAMC,SAAAA,SAAS,KAAK,MAAM,MAAM;AAC7C,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,WAAK,MAAM,QAAQ,MAAM;AAAA,IAC3B,QAAQ;AAAA,IAER;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,QAAuB;AAC7B,UAAM,OAAO,KAAK,MAAM,QAAA;AACxB,UAAM,OAAO,KAAK,WAAW,KAAK,YAAY;AAC5C,UAAI,SAAS,MAAM;AACjB,YAAI;AACF,gBAAMC,SAAAA,UAAU,KAAK,MAAM,IAAI,MAAM;AAAA,QACvC,QAAQ;AAAA,QAER;AACA;AAAA,MACF;AACA,YAAMC,SAAAA,MAAMC,UAAAA,QAAQ,KAAK,IAAI,GAAG,EAAE,WAAW,MAAM;AACnD,YAAMF,SAAAA,UAAU,KAAK,MAAM,KAAK,UAAU,IAAI,GAAG,MAAM;AAAA,IACzD,CAAC;AACD,SAAK,aAAa,KAAK,MAAM,MAAM;AAAA,IAAC,CAAC;AACrC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,MAAsC;AAC5C,SAAK,MAAM,QAAQ,IAAI;AACvB,SAAK,KAAK,MAAA;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAA2C;AACzC,WAAO,KAAK,MAAM,QAAA;AAAA,EACpB;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,MAAM,MAAA;AACX,SAAK,KAAK,MAAA;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAoB;AAClB,WAAO,KAAK,MAAM,UAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAyB;AACvB,WAAO,KAAK,MAAM,eAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAuB;AACrB,WAAO,KAAK,MAAM,aAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAuB;AACrB,WAAO,KAAK,MAAM,aAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,yBAAiC;AAC/B,WAAO,KAAK,MAAM,uBAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,6BAAqC;AACnC,WAAO,KAAK,MAAM,2BAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAsB;AACpB,WAAO,KAAK,MAAM,YAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAsC;AACpC,WAAO,KAAK,MAAM,mBAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,kBAAkB,UAA2C;AAC3D,WAAO,KAAK,MAAM,kBAAkB,QAAQ;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,UAAoB,OAA6B;AAC/D,SAAK,MAAM,gBAAgB,UAAU,KAAK;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAe,UAAoB,OAA6B;AAC9D,SAAK,MAAM,eAAe,UAAU,KAAK;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,sBAAsB,QAAuC;AAC3D,WAAO,KAAK,MAAM,sBAAsB,MAAM;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,oBAAoB,QAAgB,OAA6B;AAC/D,SAAK,MAAM,oBAAoB,QAAQ,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,mBAAmB,QAAgB,OAA6B;AAC9D,SAAK,MAAM,mBAAmB,QAAQ,KAAK;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAyB;AAC7B,UAAM,KAAK;AAAA,EACb;AACF;;"}
+{"version":3,"file":"file.cjs","names":[],"sources":["../../src/auth/file.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto'\nimport { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'\nimport { basename, dirname, join } from 'node:path'\nimport type { AuthorizeAccountResponse } from '../types/auth.ts'\nimport type { BucketId } from '../types/ids.ts'\nimport type { AccountInfo, AuthContextAwareAccountInfo, UploadUrlEntry } from './account-info.ts'\nimport { InMemoryAccountInfo } from './in-memory.ts'\nimport { getRealmUrl } from './realms.ts'\n\nconst PRIVATE_FILE_MODE = 0o600\nconst PERSISTED_AUTH_VERSION = 1\nconst BUILT_IN_PRODUCTION_REALM_URL = getRealmUrl('production')\nconst BUILT_IN_STAGING_REALM_URL = getRealmUrl('staging')\nconst PRODUCTION_HOST_SUFFIX = 'backblazeb2.com'\nconst STAGING_HOST_SUFFIX = 'backblaze.net'\n\ninterface PersistedAuthState {\n  readonly _b2sdk?: {\n    readonly version?: number\n    readonly realmUrl?: string\n    readonly applicationKeyId?: string\n  }\n}\n\n/** Reason a loaded auth cache entry was ignored for the current client. */\nexport type FileAccountInfoDiscardReason =\n  | 'realm_mismatch'\n  | 'application_key_mismatch'\n  | 'endpoint_mismatch'\n\n/** Event emitted when a loaded cache entry is ignored without modifying disk. */\nexport interface FileAccountInfoDiscardEvent {\n  /** Absolute path of the auth cache file. */\n  readonly path: string\n  /** Why the loaded auth entry could not be reused. */\n  readonly reason: FileAccountInfoDiscardReason\n  /** Realm URL stored in the cache metadata, or null for legacy entries. */\n  readonly cachedRealmUrl: string | null | undefined\n  /** Realm URL configured on the current client, if already bound. */\n  readonly expectedRealmUrl: string | undefined\n  /** Application key ID stored in cache metadata, or null for legacy entries. */\n  readonly cachedApplicationKeyId: string | null | undefined\n  /** Application key ID configured on the current client, if already bound. */\n  readonly expectedApplicationKeyId: string | undefined\n}\n\n/** Event emitted when an asynchronous auth-cache write fails. */\nexport interface FileAccountInfoWriteErrorEvent {\n  /** Absolute path of the auth cache file. */\n  readonly path: string\n  /** Underlying filesystem or serialization error. */\n  readonly error: unknown\n}\n\n/** Optional observers for file-backed auth cache behavior. */\nexport interface FileAccountInfoOptions {\n  /**\n   * Called when loaded auth is ignored because its metadata or cached\n   * endpoints are unsafe for this client. The on-disk file is left untouched\n   * so another process using a different realm/key is not clobbered.\n   */\n  readonly onDiscard?: (event: FileAccountInfoDiscardEvent) => void\n  /** Called when an asynchronous auth-cache write fails. */\n  readonly onWriteError?: (event: FileAccountInfoWriteErrorEvent) => void\n}\n\nfunction readPersistedAuthState(value: unknown): {\n  auth: AuthorizeAccountResponse\n  realmUrl: string | null\n  applicationKeyId: string | null\n} | null {\n  if (value === null || typeof value !== 'object') return null\n\n  const maybeState = value as PersistedAuthState\n  if (\n    maybeState._b2sdk?.version !== undefined &&\n    maybeState._b2sdk.version !== PERSISTED_AUTH_VERSION\n  ) {\n    return null\n  }\n  const realmUrl =\n    maybeState._b2sdk !== undefined && typeof maybeState._b2sdk.realmUrl === 'string'\n      ? maybeState._b2sdk.realmUrl\n      : null\n  const applicationKeyId =\n    maybeState._b2sdk !== undefined && typeof maybeState._b2sdk.applicationKeyId === 'string'\n      ? maybeState._b2sdk.applicationKeyId\n      : null\n  return { auth: value as AuthorizeAccountResponse, realmUrl, applicationKeyId }\n}\n\nfunction isProductionBackblazeEndpoint(url: string): boolean {\n  try {\n    const parsed = new URL(url)\n    return parsed.protocol === 'https:' && hasHostSuffix(parsed.hostname, PRODUCTION_HOST_SUFFIX)\n  } catch {\n    return false\n  }\n}\n\nfunction isProductionAuthResponse(auth: AuthorizeAccountResponse): boolean {\n  try {\n    const storageApi = auth.apiInfo.storageApi\n    return [storageApi.apiUrl, storageApi.downloadUrl, storageApi.s3ApiUrl].every(\n      isProductionBackblazeEndpoint,\n    )\n  } catch {\n    return false\n  }\n}\n\nfunction verifiedRealmEndpointSuffix(realmUrl: string): string | null {\n  try {\n    const realm = new URL(realmUrl)\n    if (realm.origin === new URL(BUILT_IN_PRODUCTION_REALM_URL).origin) {\n      return PRODUCTION_HOST_SUFFIX\n    }\n    if (realm.origin === new URL(BUILT_IN_STAGING_REALM_URL).origin) {\n      return STAGING_HOST_SUFFIX\n    }\n  } catch {\n    // Fall through below.\n  }\n  return null\n}\n\nfunction hasHostSuffix(hostname: string, suffix: string): boolean {\n  const host = hostname.toLowerCase()\n  const lowered = suffix.toLowerCase()\n  return host === lowered || host.endsWith(`.${lowered}`)\n}\n\nfunction isEndpointInRealm(url: string, realmUrl: string): boolean {\n  try {\n    const realm = new URL(realmUrl)\n    const endpoint = new URL(url)\n    const endpointHost = endpoint.hostname.toLowerCase()\n    const realmHost = realm.hostname.toLowerCase()\n    if (isLoopbackEndpointHost(endpointHost) || isLoopbackEndpointHost(realmHost)) {\n      return endpoint.origin === realm.origin\n    }\n\n    const verifiedSuffix = verifiedRealmEndpointSuffix(realmUrl)\n    if (verifiedSuffix !== null) {\n      return endpoint.protocol === 'https:' && hasHostSuffix(endpointHost, verifiedSuffix)\n    }\n\n    return endpoint.protocol === realm.protocol && hasHostSuffix(endpointHost, realmHost)\n  } catch {\n    return false\n  }\n}\n\nfunction isLoopbackEndpointHost(host: string): boolean {\n  if (host === 'localhost' || host === '::1' || host === '[::1]') return true\n\n  const parts = host.split('.')\n  return (\n    parts.length === 4 &&\n    parts[0] === '127' &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  )\n}\n\nfunction authEndpointsMatchRealm(auth: AuthorizeAccountResponse, realmUrl: string): boolean {\n  try {\n    const storageApi = auth.apiInfo.storageApi\n    return [storageApi.apiUrl, storageApi.downloadUrl, storageApi.s3ApiUrl].every((url) =>\n      isEndpointInRealm(url, realmUrl),\n    )\n  } catch {\n    return false\n  }\n}\n\n/**\n * Node-only {@link AccountInfo} backend that persists the authorization\n * response to a JSON file. Upload URL pools remain in memory because URLs are\n * short-lived and shouldn't be shared across processes.\n * The JSON file contains a live B2 authorization token, so treat it as\n * sensitive and keep it out of shared or world-readable locations.\n * `FileAccountInfo` serializes writes within one process but does not provide\n * inter-process locking. If multiple processes share one path, use\n * {@link FileAccountInfoOptions.onDiscard} and {@link FileAccountInfoOptions.onWriteError}\n * to observe cache churn, or prefer one cache path per resolved realm and key.\n *\n * On instantiation, call {@link FileAccountInfo.load} to populate state from\n * disk (or start fresh if the file is missing or corrupt). The authorization\n * response is written back to disk on every {@link setAuth} or {@link clear}\n * call so a process restart can resume without re-authorizing.\n * Cache files without an SDK metadata application-key binding are ignored once\n * bound to a `B2Client`, because the SDK cannot verify which key wrote them.\n *\n * This module imports `node:fs/promises`; do not load it in browser bundles.\n */\nexport class FileAccountInfo implements AccountInfo, AuthContextAwareAccountInfo {\n  private readonly inner = new InMemoryAccountInfo()\n  private writeQueue: Promise<void> = Promise.resolve()\n  private realmUrl: string | undefined\n  private loadedAuthRealmUrl: string | null | undefined\n  private applicationKeyId: string | undefined\n  private loadedAuthApplicationKeyId: string | null | undefined\n\n  /**\n   * Constructs a `FileAccountInfo` bound to a JSON file on disk. The file is\n   * created on the first `setAuth` write; reading it back happens via\n   * {@link load}.\n   *\n   * @param path - Absolute path to the JSON file that backs this account info.\n   * @param options - Optional discard and write-error observers.\n   */\n  constructor(\n    public readonly path: string,\n    private readonly options: FileAccountInfoOptions = {},\n  ) {}\n\n  /**\n   * Reads the JSON file at the configured path and populates in-memory state.\n   * If the file is missing or contains invalid JSON, leaves state empty and\n   * returns silently (a re-auth is expected next).\n   *\n   * @returns A promise that resolves when load is complete.\n   */\n  async load(): Promise<void> {\n    try {\n      const text = await readFile(this.path, 'utf8')\n      const parsed = readPersistedAuthState(JSON.parse(text) as unknown)\n      if (parsed === null) return\n      this.inner.setAuth(parsed.auth)\n      this.loadedAuthRealmUrl = parsed.realmUrl\n      this.loadedAuthApplicationKeyId = parsed.applicationKeyId\n      this.discardMismatchedAuth()\n    } catch {\n      // Missing file, invalid JSON, or permission denied: start empty.\n    }\n  }\n\n  /**\n   * Binds this cache to the configured realm URL. `B2Client` calls this when a\n   * FileAccountInfo instance is supplied, so stale auth produced by another\n   * realm is discarded before it can be used.\n   *\n   * @param realmUrl - Resolved authorize-account realm URL for the client.\n   */\n  setRealmUrl(realmUrl: string): void {\n    this.realmUrl = realmUrl\n    this.discardMismatchedAuth()\n  }\n\n  /**\n   * Binds this cache to the configured application key ID. `B2Client` calls\n   * this when a FileAccountInfo instance is supplied, so stale auth produced by\n   * another key is discarded before it can be used.\n   *\n   * @param applicationKeyId - Application key ID configured on the client.\n   */\n  setApplicationKeyId(applicationKeyId: string): void {\n    this.applicationKeyId = applicationKeyId\n    this.discardMismatchedAuth()\n  }\n\n  private discardMismatchedAuth(): void {\n    const auth = this.inner.getAuth()\n    if (auth === null) return\n\n    const reason = this.mismatchReason(auth)\n    if (reason === null) return\n\n    this.inner.clear()\n    this.options.onDiscard?.({\n      path: this.path,\n      reason,\n      cachedRealmUrl: this.loadedAuthRealmUrl,\n      expectedRealmUrl: this.realmUrl,\n      cachedApplicationKeyId: this.loadedAuthApplicationKeyId,\n      expectedApplicationKeyId: this.applicationKeyId,\n    })\n    this.loadedAuthRealmUrl = undefined\n    this.loadedAuthApplicationKeyId = undefined\n  }\n\n  private mismatchReason(auth: AuthorizeAccountResponse): FileAccountInfoDiscardReason | null {\n    const realmMatches =\n      this.realmUrl === undefined ||\n      this.loadedAuthRealmUrl === this.realmUrl ||\n      (this.loadedAuthRealmUrl === null &&\n        this.realmUrl === BUILT_IN_PRODUCTION_REALM_URL &&\n        isProductionAuthResponse(auth))\n    const applicationKeyMatches =\n      this.applicationKeyId === undefined ||\n      this.loadedAuthApplicationKeyId === this.applicationKeyId\n    if (!realmMatches) return 'realm_mismatch'\n    if (!applicationKeyMatches) return 'application_key_mismatch'\n    if (this.realmUrl !== undefined && !authEndpointsMatchRealm(auth, this.realmUrl)) {\n      return 'endpoint_mismatch'\n    }\n\n    return null\n  }\n\n  /**\n   * Persists the current auth response to the file. Atomically queues writes\n   * so concurrent updates serialize.\n   *\n   * @returns A promise that resolves when the write completes.\n   */\n  private flush(): Promise<void> {\n    const auth = this.inner.getAuth()\n    const next = this.writeQueue.then(async () => {\n      if (auth === null) {\n        try {\n          await this.writePrivateFileAtomically('')\n        } catch {\n          // Best-effort\n        }\n        return\n      }\n      const contents =\n        this.realmUrl !== undefined\n          ? JSON.stringify({\n              ...auth,\n              _b2sdk: {\n                version: PERSISTED_AUTH_VERSION,\n                realmUrl: this.realmUrl,\n                ...(this.applicationKeyId !== undefined\n                  ? { applicationKeyId: this.applicationKeyId }\n                  : {}),\n              },\n            })\n          : JSON.stringify(auth)\n      await this.writePrivateFileAtomically(contents)\n    })\n    this.writeQueue = next.catch((error: unknown) => {\n      this.options.onWriteError?.({ path: this.path, error })\n    })\n    return next\n  }\n\n  private async writePrivateFileAtomically(contents: string): Promise<void> {\n    const dir = dirname(this.path)\n    const tempPath = join(dir, `.${basename(this.path)}.${process.pid}.${randomUUID()}.tmp`)\n    await mkdir(dir, { recursive: true })\n\n    try {\n      await writeFile(tempPath, contents, { encoding: 'utf8', mode: PRIVATE_FILE_MODE })\n      await chmod(tempPath, PRIVATE_FILE_MODE)\n      await rename(tempPath, this.path)\n      await chmod(this.path, PRIVATE_FILE_MODE)\n    } catch (error) {\n      await rm(tempPath, { force: true }).catch(() => {})\n      throw error\n    }\n  }\n\n  /**\n   * Stores the given authorization response and triggers an async write to disk.\n   *\n   * @param auth - The authorize-account response to persist.\n   */\n  setAuth(auth: AuthorizeAccountResponse): void {\n    this.inner.setAuth(auth)\n    this.loadedAuthRealmUrl = this.realmUrl ?? null\n    this.loadedAuthApplicationKeyId = this.applicationKeyId ?? null\n    void this.flush()\n  }\n\n  /**\n   * Returns the currently cached authorization response, or `null` if none.\n   *\n   * @returns The cached authorization response, or `null` if not authorized.\n   */\n  getAuth(): AuthorizeAccountResponse | null {\n    return this.inner.getAuth()\n  }\n\n  /** Discards in-memory state and clears the on-disk file. */\n  clear(): void {\n    this.inner.clear()\n    this.loadedAuthRealmUrl = undefined\n    this.loadedAuthApplicationKeyId = undefined\n    void this.flush()\n  }\n\n  /**\n   * Returns the cached B2 API URL.\n   *\n   * @returns The base URL for B2 API calls.\n   */\n  getApiUrl(): string {\n    return this.inner.getApiUrl()\n  }\n\n  /**\n   * Returns the cached file-download URL.\n   *\n   * @returns The base URL for file downloads.\n   */\n  getDownloadUrl(): string {\n    return this.inner.getDownloadUrl()\n  }\n\n  /**\n   * Returns the cached session authorization token.\n   *\n   * @returns The current authorization token.\n   */\n  getAuthToken(): string {\n    return this.inner.getAuthToken()\n  }\n\n  /**\n   * Returns the cached account identifier.\n   *\n   * @returns The authorized account ID.\n   */\n  getAccountId(): string {\n    return this.inner.getAccountId()\n  }\n\n  /**\n   * Returns the server-recommended part size for multipart uploads.\n   *\n   * @returns The recommended part size in bytes.\n   */\n  getRecommendedPartSize(): number {\n    return this.inner.getRecommendedPartSize()\n  }\n\n  /**\n   * Returns the server-enforced minimum part size for multipart uploads.\n   *\n   * @returns The absolute minimum part size in bytes.\n   */\n  getAbsoluteMinimumPartSize(): number {\n    return this.inner.getAbsoluteMinimumPartSize()\n  }\n\n  /**\n   * Returns the cached S3-compatible API URL.\n   *\n   * @returns The base URL for the S3-compatible API.\n   */\n  getS3ApiUrl(): string {\n    return this.inner.getS3ApiUrl()\n  }\n\n  /**\n   * Returns the bucket the key is restricted to, if any.\n   *\n   * @returns The restricted bucket ID, or `null` if the key is unrestricted.\n   */\n  getAllowedBucketId(): BucketId | null {\n    return this.inner.getAllowedBucketId()\n  }\n\n  /**\n   * Returns the buckets the key is restricted to, if any.\n   *\n   * @returns The restricted bucket IDs, or `null` if the key is unrestricted.\n   */\n  getAllowedBucketIds(): readonly BucketId[] | null {\n    return this.inner.getAllowedBucketIds()\n  }\n\n  /**\n   * Takes an upload URL from the in-memory pool for the given bucket.\n   *\n   * @param bucketId - Bucket to check out an upload URL for.\n   *\n   * @returns A reusable upload URL entry, or `null` if none are pooled.\n   */\n  checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null {\n    return this.inner.checkoutUploadUrl(bucketId)\n  }\n\n  /**\n   * Returns a still-valid upload URL to the pool for reuse.\n   *\n   * @param bucketId - Bucket the upload URL belongs to.\n   * @param entry - Upload URL entry to return.\n   */\n  returnUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.inner.returnUploadUrl(bucketId, entry)\n  }\n\n  /**\n   * Removes an upload URL from the pool after an upload error.\n   *\n   * @param bucketId - Bucket the failed upload URL belongs to.\n   * @param entry - Upload URL entry to evict.\n   */\n  evictUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.inner.evictUploadUrl(bucketId, entry)\n  }\n\n  /**\n   * Takes a large-file part upload URL from the in-memory pool.\n   *\n   * @param fileId - Large file to check out a part upload URL for.\n   *\n   * @returns A reusable part upload URL entry, or `null` if none are pooled.\n   */\n  checkoutPartUploadUrl(fileId: string): UploadUrlEntry | null {\n    return this.inner.checkoutPartUploadUrl(fileId)\n  }\n\n  /**\n   * Returns a still-valid part upload URL to the pool for reuse.\n   *\n   * @param fileId - Large file the part upload URL belongs to.\n   * @param entry - Part upload URL entry to return.\n   */\n  returnPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.inner.returnPartUploadUrl(fileId, entry)\n  }\n\n  /**\n   * Removes a part upload URL from the pool after an error.\n   *\n   * @param fileId - Large file the failed part upload URL belongs to.\n   * @param entry - Part upload URL entry to evict.\n   */\n  evictPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.inner.evictPartUploadUrl(fileId, entry)\n  }\n\n  /**\n   * Awaits any pending disk writes. Call before process exit to ensure the\n   * latest state is persisted.\n   *\n   * @returns A promise that resolves once all queued writes are flushed.\n   */\n  async flushed(): Promise<void> {\n    await this.writeQueue\n  }\n}\n"],"mappings":";;;;;;;AASA,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB;AAC/B,IAAM,gCAAgC,eAAA,YAAY,YAAY;AAC9D,IAAM,6BAA6B,eAAA,YAAY,SAAS;AACxD,IAAM,yBAAyB;AAC/B,IAAM,sBAAsB;AAoD5B,SAAS,uBAAuB,OAIvB;CACP,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CAExD,MAAM,aAAa;CACnB,IACE,WAAW,QAAQ,YAAY,KAAA,KAC/B,WAAW,OAAO,YAAY,wBAE9B,OAAO;CAUT,OAAO;EAAE,MAAM;EAAmC,UAPhD,WAAW,WAAW,KAAA,KAAa,OAAO,WAAW,OAAO,aAAa,WACrE,WAAW,OAAO,WAClB;EAKsD,kBAH1D,WAAW,WAAW,KAAA,KAAa,OAAO,WAAW,OAAO,qBAAqB,WAC7E,WAAW,OAAO,mBAClB;CACuE;AAC/E;AAEA,SAAS,8BAA8B,KAAsB;CAC3D,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,OAAO,OAAO,aAAa,YAAY,cAAc,OAAO,UAAU,sBAAsB;CAC9F,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,yBAAyB,MAAyC;CACzE,IAAI;EACF,MAAM,aAAa,KAAK,QAAQ;EAChC,OAAO;GAAC,WAAW;GAAQ,WAAW;GAAa,WAAW;EAAQ,CAAC,CAAC,MACtE,6BACF;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,4BAA4B,UAAiC;CACpE,IAAI;EACF,MAAM,QAAQ,IAAI,IAAI,QAAQ;EAC9B,IAAI,MAAM,WAAW,IAAI,IAAI,6BAA6B,CAAC,CAAC,QAC1D,OAAO;EAET,IAAI,MAAM,WAAW,IAAI,IAAI,0BAA0B,CAAC,CAAC,QACvD,OAAO;CAEX,QAAQ,CAER;CACA,OAAO;AACT;AAEA,SAAS,cAAc,UAAkB,QAAyB;CAChE,MAAM,OAAO,SAAS,YAAY;CAClC,MAAM,UAAU,OAAO,YAAY;CACnC,OAAO,SAAS,WAAW,KAAK,SAAS,IAAI,SAAS;AACxD;AAEA,SAAS,kBAAkB,KAAa,UAA2B;CACjE,IAAI;EACF,MAAM,QAAQ,IAAI,IAAI,QAAQ;EAC9B,MAAM,WAAW,IAAI,IAAI,GAAG;EAC5B,MAAM,eAAe,SAAS,SAAS,YAAY;EACnD,MAAM,YAAY,MAAM,SAAS,YAAY;EAC7C,IAAI,uBAAuB,YAAY,KAAK,uBAAuB,SAAS,GAC1E,OAAO,SAAS,WAAW,MAAM;EAGnC,MAAM,iBAAiB,4BAA4B,QAAQ;EAC3D,IAAI,mBAAmB,MACrB,OAAO,SAAS,aAAa,YAAY,cAAc,cAAc,cAAc;EAGrF,OAAO,SAAS,aAAa,MAAM,YAAY,cAAc,cAAc,SAAS;CACtF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,MAAuB;CACrD,IAAI,SAAS,eAAe,SAAS,SAAS,SAAS,SAAS,OAAO;CAEvE,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,OACE,MAAM,WAAW,KACjB,MAAM,OAAO,SACb,MAAM,OAAO,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG;AAEnE;AAEA,SAAS,wBAAwB,MAAgC,UAA2B;CAC1F,IAAI;EACF,MAAM,aAAa,KAAK,QAAQ;EAChC,OAAO;GAAC,WAAW;GAAQ,WAAW;GAAa,WAAW;EAAQ,CAAC,CAAC,OAAO,QAC7E,kBAAkB,KAAK,QAAQ,CACjC;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;AAsBA,IAAa,kBAAb,MAAiF;CAiB7D;CACC;CAjBnB,QAAyB,IAAI,kBAAA,oBAAoB;CACjD,aAAoC,QAAQ,QAAQ;CACpD;CACA;CACA;CACA;;;;;;;;;CAUA,YACE,MACA,UAAmD,CAAC,GACpD;EAFgB,KAAA,OAAA;EACC,KAAA,UAAA;CAChB;;;;;;;;CASH,MAAM,OAAsB;EAC1B,IAAI;GACF,MAAM,OAAO,OAAA,GAAA,iBAAA,SAAA,CAAe,KAAK,MAAM,MAAM;GAC7C,MAAM,SAAS,uBAAuB,KAAK,MAAM,IAAI,CAAY;GACjE,IAAI,WAAW,MAAM;GACrB,KAAK,MAAM,QAAQ,OAAO,IAAI;GAC9B,KAAK,qBAAqB,OAAO;GACjC,KAAK,6BAA6B,OAAO;GACzC,KAAK,sBAAsB;EAC7B,QAAQ,CAER;CACF;;;;;;;;CASA,YAAY,UAAwB;EAClC,KAAK,WAAW;EAChB,KAAK,sBAAsB;CAC7B;;;;;;;;CASA,oBAAoB,kBAAgC;EAClD,KAAK,mBAAmB;EACxB,KAAK,sBAAsB;CAC7B;CAEA,wBAAsC;EACpC,MAAM,OAAO,KAAK,MAAM,QAAQ;EAChC,IAAI,SAAS,MAAM;EAEnB,MAAM,SAAS,KAAK,eAAe,IAAI;EACvC,IAAI,WAAW,MAAM;EAErB,KAAK,MAAM,MAAM;EACjB,KAAK,QAAQ,YAAY;GACvB,MAAM,KAAK;GACX;GACA,gBAAgB,KAAK;GACrB,kBAAkB,KAAK;GACvB,wBAAwB,KAAK;GAC7B,0BAA0B,KAAK;EACjC,CAAC;EACD,KAAK,qBAAqB,KAAA;EAC1B,KAAK,6BAA6B,KAAA;CACpC;CAEA,eAAuB,MAAqE;EAC1F,MAAM,eACJ,KAAK,aAAa,KAAA,KAClB,KAAK,uBAAuB,KAAK,YAChC,KAAK,uBAAuB,QAC3B,KAAK,aAAa,iCAClB,yBAAyB,IAAI;EACjC,MAAM,wBACJ,KAAK,qBAAqB,KAAA,KAC1B,KAAK,+BAA+B,KAAK;EAC3C,IAAI,CAAC,cAAc,OAAO;EAC1B,IAAI,CAAC,uBAAuB,OAAO;EACnC,IAAI,KAAK,aAAa,KAAA,KAAa,CAAC,wBAAwB,MAAM,KAAK,QAAQ,GAC7E,OAAO;EAGT,OAAO;CACT;;;;;;;CAQA,QAA+B;EAC7B,MAAM,OAAO,KAAK,MAAM,QAAQ;EAChC,MAAM,OAAO,KAAK,WAAW,KAAK,YAAY;GAC5C,IAAI,SAAS,MAAM;IACjB,IAAI;KACF,MAAM,KAAK,2BAA2B,EAAE;IAC1C,QAAQ,CAER;IACA;GACF;GACA,MAAM,WACJ,KAAK,aAAa,KAAA,IACd,KAAK,UAAU;IACb,GAAG;IACH,QAAQ;KACN,SAAS;KACT,UAAU,KAAK;KACf,GAAI,KAAK,qBAAqB,KAAA,IAC1B,EAAE,kBAAkB,KAAK,iBAAiB,IAC1C,CAAC;IACP;GACF,CAAC,IACD,KAAK,UAAU,IAAI;GACzB,MAAM,KAAK,2BAA2B,QAAQ;EAChD,CAAC;EACD,KAAK,aAAa,KAAK,OAAO,UAAmB;GAC/C,KAAK,QAAQ,eAAe;IAAE,MAAM,KAAK;IAAM;GAAM,CAAC;EACxD,CAAC;EACD,OAAO;CACT;CAEA,MAAc,2BAA2B,UAAiC;EACxE,MAAM,OAAA,GAAA,UAAA,QAAA,CAAc,KAAK,IAAI;EAC7B,MAAM,YAAA,GAAA,UAAA,KAAA,CAAgB,KAAK,KAAA,GAAA,UAAA,SAAA,CAAa,KAAK,IAAI,EAAE,GAAG,QAAQ,IAAI,IAAA,GAAA,YAAA,WAAA,CAAc,EAAE,KAAK;EACvF,OAAA,GAAA,iBAAA,MAAA,CAAY,KAAK,EAAE,WAAW,KAAK,CAAC;EAEpC,IAAI;GACF,OAAA,GAAA,iBAAA,UAAA,CAAgB,UAAU,UAAU;IAAE,UAAU;IAAQ,MAAM;GAAkB,CAAC;GACjF,OAAA,GAAA,iBAAA,MAAA,CAAY,UAAU,iBAAiB;GACvC,OAAA,GAAA,iBAAA,OAAA,CAAa,UAAU,KAAK,IAAI;GAChC,OAAA,GAAA,iBAAA,MAAA,CAAY,KAAK,MAAM,iBAAiB;EAC1C,SAAS,OAAO;GACd,OAAA,GAAA,iBAAA,GAAA,CAAS,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;GAClD,MAAM;EACR;CACF;;;;;;CAOA,QAAQ,MAAsC;EAC5C,KAAK,MAAM,QAAQ,IAAI;EACvB,KAAK,qBAAqB,KAAK,YAAY;EAC3C,KAAK,6BAA6B,KAAK,oBAAoB;EAC3D,KAAU,MAAM;CAClB;;;;;;CAOA,UAA2C;EACzC,OAAO,KAAK,MAAM,QAAQ;CAC5B;;CAGA,QAAc;EACZ,KAAK,MAAM,MAAM;EACjB,KAAK,qBAAqB,KAAA;EAC1B,KAAK,6BAA6B,KAAA;EAClC,KAAU,MAAM;CAClB;;;;;;CAOA,YAAoB;EAClB,OAAO,KAAK,MAAM,UAAU;CAC9B;;;;;;CAOA,iBAAyB;EACvB,OAAO,KAAK,MAAM,eAAe;CACnC;;;;;;CAOA,eAAuB;EACrB,OAAO,KAAK,MAAM,aAAa;CACjC;;;;;;CAOA,eAAuB;EACrB,OAAO,KAAK,MAAM,aAAa;CACjC;;;;;;CAOA,yBAAiC;EAC/B,OAAO,KAAK,MAAM,uBAAuB;CAC3C;;;;;;CAOA,6BAAqC;EACnC,OAAO,KAAK,MAAM,2BAA2B;CAC/C;;;;;;CAOA,cAAsB;EACpB,OAAO,KAAK,MAAM,YAAY;CAChC;;;;;;CAOA,qBAAsC;EACpC,OAAO,KAAK,MAAM,mBAAmB;CACvC;;;;;;CAOA,sBAAkD;EAChD,OAAO,KAAK,MAAM,oBAAoB;CACxC;;;;;;;;CASA,kBAAkB,UAA2C;EAC3D,OAAO,KAAK,MAAM,kBAAkB,QAAQ;CAC9C;;;;;;;CAQA,gBAAgB,UAAoB,OAA6B;EAC/D,KAAK,MAAM,gBAAgB,UAAU,KAAK;CAC5C;;;;;;;CAQA,eAAe,UAAoB,OAA6B;EAC9D,KAAK,MAAM,eAAe,UAAU,KAAK;CAC3C;;;;;;;;CASA,sBAAsB,QAAuC;EAC3D,OAAO,KAAK,MAAM,sBAAsB,MAAM;CAChD;;;;;;;CAQA,oBAAoB,QAAgB,OAA6B;EAC/D,KAAK,MAAM,oBAAoB,QAAQ,KAAK;CAC9C;;;;;;;CAQA,mBAAmB,QAAgB,OAA6B;EAC9D,KAAK,MAAM,mBAAmB,QAAQ,KAAK;CAC7C;;;;;;;CAQA,MAAM,UAAyB;EAC7B,MAAM,KAAK;CACb;AACF"}

package/dist/auth/file.d.cts

@@ -1,30 +1,79 @@
 import { AuthorizeAccountResponse } from '../types/auth.js';
 import { BucketId } from '../types/ids.js';
-import { AccountInfo, UploadUrlEntry } from './account-info.js';
+import { AccountInfo, AuthContextAwareAccountInfo, UploadUrlEntry } from './account-info.js';
+/** Reason a loaded auth cache entry was ignored for the current client. */
+export type FileAccountInfoDiscardReason = 'realm_mismatch' | 'application_key_mismatch' | 'endpoint_mismatch';
+/** Event emitted when a loaded cache entry is ignored without modifying disk. */
+export interface FileAccountInfoDiscardEvent {
+    /** Absolute path of the auth cache file. */
+    readonly path: string;
+    /** Why the loaded auth entry could not be reused. */
+    readonly reason: FileAccountInfoDiscardReason;
+    /** Realm URL stored in the cache metadata, or null for legacy entries. */
+    readonly cachedRealmUrl: string | null | undefined;
+    /** Realm URL configured on the current client, if already bound. */
+    readonly expectedRealmUrl: string | undefined;
+    /** Application key ID stored in cache metadata, or null for legacy entries. */
+    readonly cachedApplicationKeyId: string | null | undefined;
+    /** Application key ID configured on the current client, if already bound. */
+    readonly expectedApplicationKeyId: string | undefined;
+}
+/** Event emitted when an asynchronous auth-cache write fails. */
+export interface FileAccountInfoWriteErrorEvent {
+    /** Absolute path of the auth cache file. */
+    readonly path: string;
+    /** Underlying filesystem or serialization error. */
+    readonly error: unknown;
+}
+/** Optional observers for file-backed auth cache behavior. */
+export interface FileAccountInfoOptions {
+    /**
+     * Called when loaded auth is ignored because its metadata or cached
+     * endpoints are unsafe for this client. The on-disk file is left untouched
+     * so another process using a different realm/key is not clobbered.
+     */
+    readonly onDiscard?: (event: FileAccountInfoDiscardEvent) => void;
+    /** Called when an asynchronous auth-cache write fails. */
+    readonly onWriteError?: (event: FileAccountInfoWriteErrorEvent) => void;
+}
 /**
  * Node-only {@link AccountInfo} backend that persists the authorization
  * response to a JSON file. Upload URL pools remain in memory because URLs are
  * short-lived and shouldn't be shared across processes.
+ * The JSON file contains a live B2 authorization token, so treat it as
+ * sensitive and keep it out of shared or world-readable locations.
+ * `FileAccountInfo` serializes writes within one process but does not provide
+ * inter-process locking. If multiple processes share one path, use
+ * {@link FileAccountInfoOptions.onDiscard} and {@link FileAccountInfoOptions.onWriteError}
+ * to observe cache churn, or prefer one cache path per resolved realm and key.
  *
  * On instantiation, call {@link FileAccountInfo.load} to populate state from
  * disk (or start fresh if the file is missing or corrupt). The authorization
  * response is written back to disk on every {@link setAuth} or {@link clear}
  * call so a process restart can resume without re-authorizing.
+ * Cache files without an SDK metadata application-key binding are ignored once
+ * bound to a `B2Client`, because the SDK cannot verify which key wrote them.
  *
  * This module imports `node:fs/promises`; do not load it in browser bundles.
  */
-export declare class FileAccountInfo implements AccountInfo {
+export declare class FileAccountInfo implements AccountInfo, AuthContextAwareAccountInfo {
     readonly path: string;
+    private readonly options;
     private readonly inner;
     private writeQueue;
+    private realmUrl;
+    private loadedAuthRealmUrl;
+    private applicationKeyId;
+    private loadedAuthApplicationKeyId;
     /**
      * Constructs a `FileAccountInfo` bound to a JSON file on disk. The file is
      * created on the first `setAuth` write; reading it back happens via
      * {@link load}.
      *
      * @param path - Absolute path to the JSON file that backs this account info.
+     * @param options - Optional discard and write-error observers.
      */
-    constructor(path: string);
+    constructor(path: string, options?: FileAccountInfoOptions);
     /**
      * Reads the JSON file at the configured path and populates in-memory state.
      * If the file is missing or contains invalid JSON, leaves state empty and
@@ -33,6 +82,24 @@ export declare class FileAccountInfo implements AccountInfo {
      * @returns A promise that resolves when load is complete.
      */
     load(): Promise<void>;
+    /**
+     * Binds this cache to the configured realm URL. `B2Client` calls this when a
+     * FileAccountInfo instance is supplied, so stale auth produced by another
+     * realm is discarded before it can be used.
+     *
+     * @param realmUrl - Resolved authorize-account realm URL for the client.
+     */
+    setRealmUrl(realmUrl: string): void;
+    /**
+     * Binds this cache to the configured application key ID. `B2Client` calls
+     * this when a FileAccountInfo instance is supplied, so stale auth produced by
+     * another key is discarded before it can be used.
+     *
+     * @param applicationKeyId - Application key ID configured on the client.
+     */
+    setApplicationKeyId(applicationKeyId: string): void;
+    private discardMismatchedAuth;
+    private mismatchReason;
     /**
      * Persists the current auth response to the file. Atomically queues writes
      * so concurrent updates serialize.
@@ -40,6 +107,7 @@ export declare class FileAccountInfo implements AccountInfo {
      * @returns A promise that resolves when the write completes.
      */
     private flush;
+    private writePrivateFileAtomically;
     /**
      * Stores the given authorization response and triggers an async write to disk.
      *
@@ -102,6 +170,12 @@ export declare class FileAccountInfo implements AccountInfo {
      * @returns The restricted bucket ID, or `null` if the key is unrestricted.
      */
     getAllowedBucketId(): BucketId | null;
+    /**
+     * Returns the buckets the key is restricted to, if any.
+     *
+     * @returns The restricted bucket IDs, or `null` if the key is unrestricted.
+     */
+    getAllowedBucketIds(): readonly BucketId[] | null;
     /**
      * Takes an upload URL from the in-memory pool for the given bucket.
      *

package/dist/auth/file.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/auth/file.js"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGpE;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,YAAW,WAAW;aAWrB,IAAI,EAAE,MAAM;IAVxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,UAAU,CAAmC;IAErD;;;;;;OAMG;gBACyB,IAAI,EAAE,MAAM;IAExC;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B;;;;;OAKG;IACH,OAAO,CAAC,KAAK;IAkBb;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAK7C;;;;OAIG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI;IAI1C,4DAA4D;IAC5D,KAAK,IAAI,IAAI;IAKb;;;;OAIG;IACH,SAAS,IAAI,MAAM;IAInB;;;;OAIG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAItB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAItB;;;;OAIG;IACH,sBAAsB,IAAI,MAAM;IAIhC;;;;OAIG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,kBAAkB,IAAI,QAAQ,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/auth/file.js"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAmBjG,2EAA2E;AAC3E,MAAM,MAAM,4BAA4B,GACpC,gBAAgB,GAChB,0BAA0B,GAC1B,mBAAmB,CAAA;AAEvB,iFAAiF;AACjF,MAAM,WAAW,2BAA2B;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAClD,oEAAoE;IACpE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,+EAA+E;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC1D,6EAA6E;IAC7E,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAA;CACtD;AAED,iEAAiE;AACjE,MAAM,WAAW,8BAA8B;IAC7C,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAA;IACjE,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI,CAAA;CACxE;AA+GD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,eAAgB,YAAW,WAAW,EAAE,2BAA2B;aAiB5D,IAAI,EAAE,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAjB1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,kBAAkB,CAA2B;IACrD,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,0BAA0B,CAA2B;IAE7D;;;;;;;OAOG;gBAEe,IAAI,EAAE,MAAM,EACX,OAAO,GAAE,sBAA2B;IAGvD;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKnC;;;;;;OAMG;IACH,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI;IAKnD,OAAO,CAAC,qBAAqB;IAoB7B,OAAO,CAAC,cAAc;IAmBtB;;;;;OAKG;IACH,OAAO,CAAC,KAAK;YAgCC,0BAA0B;IAgBxC;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAO7C;;;;OAIG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI;IAI1C,4DAA4D;IAC5D,KAAK,IAAI,IAAI;IAOb;;;;OAIG;IACH,SAAS,IAAI,MAAM;IAInB;;;;OAIG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAItB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAItB;;;;OAIG;IACH,sBAAsB,IAAI,MAAM;IAIhC;;;;OAIG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,kBAAkB,IAAI,QAAQ,GAAG,IAAI;IAIrC;;;;OAIG;IACH,mBAAmB,IAAI,SAAS,QAAQ,EAAE,GAAG,IAAI;IAIjD;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}

package/dist/auth/file.d.ts

@@ -1,30 +1,79 @@
 import { AuthorizeAccountResponse } from '../types/auth.js';
 import { BucketId } from '../types/ids.js';
-import { AccountInfo, UploadUrlEntry } from './account-info.js';
+import { AccountInfo, AuthContextAwareAccountInfo, UploadUrlEntry } from './account-info.js';
+/** Reason a loaded auth cache entry was ignored for the current client. */
+export type FileAccountInfoDiscardReason = 'realm_mismatch' | 'application_key_mismatch' | 'endpoint_mismatch';
+/** Event emitted when a loaded cache entry is ignored without modifying disk. */
+export interface FileAccountInfoDiscardEvent {
+    /** Absolute path of the auth cache file. */
+    readonly path: string;
+    /** Why the loaded auth entry could not be reused. */
+    readonly reason: FileAccountInfoDiscardReason;
+    /** Realm URL stored in the cache metadata, or null for legacy entries. */
+    readonly cachedRealmUrl: string | null | undefined;
+    /** Realm URL configured on the current client, if already bound. */
+    readonly expectedRealmUrl: string | undefined;
+    /** Application key ID stored in cache metadata, or null for legacy entries. */
+    readonly cachedApplicationKeyId: string | null | undefined;
+    /** Application key ID configured on the current client, if already bound. */
+    readonly expectedApplicationKeyId: string | undefined;
+}
+/** Event emitted when an asynchronous auth-cache write fails. */
+export interface FileAccountInfoWriteErrorEvent {
+    /** Absolute path of the auth cache file. */
+    readonly path: string;
+    /** Underlying filesystem or serialization error. */
+    readonly error: unknown;
+}
+/** Optional observers for file-backed auth cache behavior. */
+export interface FileAccountInfoOptions {
+    /**
+     * Called when loaded auth is ignored because its metadata or cached
+     * endpoints are unsafe for this client. The on-disk file is left untouched
+     * so another process using a different realm/key is not clobbered.
+     */
+    readonly onDiscard?: (event: FileAccountInfoDiscardEvent) => void;
+    /** Called when an asynchronous auth-cache write fails. */
+    readonly onWriteError?: (event: FileAccountInfoWriteErrorEvent) => void;
+}
 /**
  * Node-only {@link AccountInfo} backend that persists the authorization
  * response to a JSON file. Upload URL pools remain in memory because URLs are
  * short-lived and shouldn't be shared across processes.
+ * The JSON file contains a live B2 authorization token, so treat it as
+ * sensitive and keep it out of shared or world-readable locations.
+ * `FileAccountInfo` serializes writes within one process but does not provide
+ * inter-process locking. If multiple processes share one path, use
+ * {@link FileAccountInfoOptions.onDiscard} and {@link FileAccountInfoOptions.onWriteError}
+ * to observe cache churn, or prefer one cache path per resolved realm and key.
  *
  * On instantiation, call {@link FileAccountInfo.load} to populate state from
  * disk (or start fresh if the file is missing or corrupt). The authorization
  * response is written back to disk on every {@link setAuth} or {@link clear}
  * call so a process restart can resume without re-authorizing.
+ * Cache files without an SDK metadata application-key binding are ignored once
+ * bound to a `B2Client`, because the SDK cannot verify which key wrote them.
  *
  * This module imports `node:fs/promises`; do not load it in browser bundles.
  */
-export declare class FileAccountInfo implements AccountInfo {
+export declare class FileAccountInfo implements AccountInfo, AuthContextAwareAccountInfo {
     readonly path: string;
+    private readonly options;
     private readonly inner;
     private writeQueue;
+    private realmUrl;
+    private loadedAuthRealmUrl;
+    private applicationKeyId;
+    private loadedAuthApplicationKeyId;
     /**
      * Constructs a `FileAccountInfo` bound to a JSON file on disk. The file is
      * created on the first `setAuth` write; reading it back happens via
      * {@link load}.
      *
      * @param path - Absolute path to the JSON file that backs this account info.
+     * @param options - Optional discard and write-error observers.
      */
-    constructor(path: string);
+    constructor(path: string, options?: FileAccountInfoOptions);
     /**
      * Reads the JSON file at the configured path and populates in-memory state.
      * If the file is missing or contains invalid JSON, leaves state empty and
@@ -33,6 +82,24 @@ export declare class FileAccountInfo implements AccountInfo {
      * @returns A promise that resolves when load is complete.
      */
     load(): Promise<void>;
+    /**
+     * Binds this cache to the configured realm URL. `B2Client` calls this when a
+     * FileAccountInfo instance is supplied, so stale auth produced by another
+     * realm is discarded before it can be used.
+     *
+     * @param realmUrl - Resolved authorize-account realm URL for the client.
+     */
+    setRealmUrl(realmUrl: string): void;
+    /**
+     * Binds this cache to the configured application key ID. `B2Client` calls
+     * this when a FileAccountInfo instance is supplied, so stale auth produced by
+     * another key is discarded before it can be used.
+     *
+     * @param applicationKeyId - Application key ID configured on the client.
+     */
+    setApplicationKeyId(applicationKeyId: string): void;
+    private discardMismatchedAuth;
+    private mismatchReason;
     /**
      * Persists the current auth response to the file. Atomically queues writes
      * so concurrent updates serialize.
@@ -40,6 +107,7 @@ export declare class FileAccountInfo implements AccountInfo {
      * @returns A promise that resolves when the write completes.
      */
     private flush;
+    private writePrivateFileAtomically;
     /**
      * Stores the given authorization response and triggers an async write to disk.
      *
@@ -102,6 +170,12 @@ export declare class FileAccountInfo implements AccountInfo {
      * @returns The restricted bucket ID, or `null` if the key is unrestricted.
      */
     getAllowedBucketId(): BucketId | null;
+    /**
+     * Returns the buckets the key is restricted to, if any.
+     *
+     * @returns The restricted bucket IDs, or `null` if the key is unrestricted.
+     */
+    getAllowedBucketIds(): readonly BucketId[] | null;
     /**
      * Takes an upload URL from the in-memory pool for the given bucket.
      *

package/dist/auth/file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/auth/file.js"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGpE;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,YAAW,WAAW;aAWrB,IAAI,EAAE,MAAM;IAVxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,UAAU,CAAmC;IAErD;;;;;;OAMG;gBACyB,IAAI,EAAE,MAAM;IAExC;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B;;;;;OAKG;IACH,OAAO,CAAC,KAAK;IAkBb;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAK7C;;;;OAIG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI;IAI1C,4DAA4D;IAC5D,KAAK,IAAI,IAAI;IAKb;;;;OAIG;IACH,SAAS,IAAI,MAAM;IAInB;;;;OAIG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAItB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAItB;;;;OAIG;IACH,sBAAsB,IAAI,MAAM;IAIhC;;;;OAIG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,kBAAkB,IAAI,QAAQ,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/auth/file.js"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAmBjG,2EAA2E;AAC3E,MAAM,MAAM,4BAA4B,GACpC,gBAAgB,GAChB,0BAA0B,GAC1B,mBAAmB,CAAA;AAEvB,iFAAiF;AACjF,MAAM,WAAW,2BAA2B;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAClD,oEAAoE;IACpE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,+EAA+E;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC1D,6EAA6E;IAC7E,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAA;CACtD;AAED,iEAAiE;AACjE,MAAM,WAAW,8BAA8B;IAC7C,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAA;IACjE,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI,CAAA;CACxE;AA+GD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,eAAgB,YAAW,WAAW,EAAE,2BAA2B;aAiB5D,IAAI,EAAE,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAjB1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,kBAAkB,CAA2B;IACrD,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,0BAA0B,CAA2B;IAE7D;;;;;;;OAOG;gBAEe,IAAI,EAAE,MAAM,EACX,OAAO,GAAE,sBAA2B;IAGvD;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKnC;;;;;;OAMG;IACH,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI;IAKnD,OAAO,CAAC,qBAAqB;IAoB7B,OAAO,CAAC,cAAc;IAmBtB;;;;;OAKG;IACH,OAAO,CAAC,KAAK;YAgCC,0BAA0B;IAgBxC;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAO7C;;;;OAIG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI;IAI1C,4DAA4D;IAC5D,KAAK,IAAI,IAAI;IAOb;;;;OAIG;IACH,SAAS,IAAI,MAAM;IAInB;;;;OAIG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAItB;;;;OAIG;IACH,YAAY,IAAI,MAAM;IAItB;;;;OAIG;IACH,sBAAsB,IAAI,MAAM;IAIhC;;;;OAIG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,kBAAkB,IAAI,QAAQ,GAAG,IAAI;IAIrC;;;;OAIG;IACH,mBAAmB,IAAI,SAAS,QAAQ,EAAE,GAAG,IAAI;IAIjD;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}