@backblaze-labs/b2-sdk 0.1.0 → 0.2.0

package/dist/auth/file.js.map

@@ -1 +1 @@
-{"version":3,"file":"file.js","sources":["../../src/auth/file.ts"],"sourcesContent":["import { mkdir, readFile, writeFile } from 'node:fs/promises'\nimport { dirname } from 'node:path'\nimport type { AuthorizeAccountResponse } from '../types/auth.ts'\nimport type { BucketId } from '../types/ids.ts'\nimport type { AccountInfo, UploadUrlEntry } from './account-info.ts'\nimport { InMemoryAccountInfo } from './in-memory.ts'\n\n/**\n * Node-only {@link AccountInfo} backend that persists the authorization\n * response to a JSON file. Upload URL pools remain in memory because URLs are\n * short-lived and shouldn't be shared across processes.\n *\n * On instantiation, call {@link FileAccountInfo.load} to populate state from\n * disk (or start fresh if the file is missing or corrupt). The authorization\n * response is written back to disk on every {@link setAuth} or {@link clear}\n * call so a process restart can resume without re-authorizing.\n *\n * This module imports `node:fs/promises`; do not load it in browser bundles.\n */\nexport class FileAccountInfo implements AccountInfo {\n  private readonly inner = new InMemoryAccountInfo()\n  private writeQueue: Promise<void> = Promise.resolve()\n\n  /**\n   * Constructs a `FileAccountInfo` bound to a JSON file on disk. The file is\n   * created on the first `setAuth` write; reading it back happens via\n   * {@link load}.\n   *\n   * @param path - Absolute path to the JSON file that backs this account info.\n   */\n  constructor(public readonly path: string) {}\n\n  /**\n   * Reads the JSON file at the configured path and populates in-memory state.\n   * If the file is missing or contains invalid JSON, leaves state empty and\n   * returns silently (a re-auth is expected next).\n   *\n   * @returns A promise that resolves when load is complete.\n   */\n  async load(): Promise<void> {\n    try {\n      const text = await readFile(this.path, 'utf8')\n      const parsed = JSON.parse(text) as AuthorizeAccountResponse\n      this.inner.setAuth(parsed)\n    } catch {\n      // Missing file, invalid JSON, or permission denied: start empty.\n    }\n  }\n\n  /**\n   * Persists the current auth response to the file. Atomically queues writes\n   * so concurrent updates serialize.\n   *\n   * @returns A promise that resolves when the write completes.\n   */\n  private flush(): Promise<void> {\n    const auth = this.inner.getAuth()\n    const next = this.writeQueue.then(async () => {\n      if (auth === null) {\n        try {\n          await writeFile(this.path, '', 'utf8')\n        } catch {\n          // Best-effort\n        }\n        return\n      }\n      await mkdir(dirname(this.path), { recursive: true })\n      await writeFile(this.path, JSON.stringify(auth), 'utf8')\n    })\n    this.writeQueue = next.catch(() => {})\n    return next\n  }\n\n  /**\n   * Stores the given authorization response and triggers an async write to disk.\n   *\n   * @param auth - The authorize-account response to persist.\n   */\n  setAuth(auth: AuthorizeAccountResponse): void {\n    this.inner.setAuth(auth)\n    void this.flush()\n  }\n\n  /**\n   * Returns the currently cached authorization response, or `null` if none.\n   *\n   * @returns The cached authorization response, or `null` if not authorized.\n   */\n  getAuth(): AuthorizeAccountResponse | null {\n    return this.inner.getAuth()\n  }\n\n  /** Discards in-memory state and clears the on-disk file. */\n  clear(): void {\n    this.inner.clear()\n    void this.flush()\n  }\n\n  /**\n   * Returns the cached B2 API URL.\n   *\n   * @returns The base URL for B2 API calls.\n   */\n  getApiUrl(): string {\n    return this.inner.getApiUrl()\n  }\n\n  /**\n   * Returns the cached file-download URL.\n   *\n   * @returns The base URL for file downloads.\n   */\n  getDownloadUrl(): string {\n    return this.inner.getDownloadUrl()\n  }\n\n  /**\n   * Returns the cached session authorization token.\n   *\n   * @returns The current authorization token.\n   */\n  getAuthToken(): string {\n    return this.inner.getAuthToken()\n  }\n\n  /**\n   * Returns the cached account identifier.\n   *\n   * @returns The authorized account ID.\n   */\n  getAccountId(): string {\n    return this.inner.getAccountId()\n  }\n\n  /**\n   * Returns the server-recommended part size for multipart uploads.\n   *\n   * @returns The recommended part size in bytes.\n   */\n  getRecommendedPartSize(): number {\n    return this.inner.getRecommendedPartSize()\n  }\n\n  /**\n   * Returns the server-enforced minimum part size for multipart uploads.\n   *\n   * @returns The absolute minimum part size in bytes.\n   */\n  getAbsoluteMinimumPartSize(): number {\n    return this.inner.getAbsoluteMinimumPartSize()\n  }\n\n  /**\n   * Returns the cached S3-compatible API URL.\n   *\n   * @returns The base URL for the S3-compatible API.\n   */\n  getS3ApiUrl(): string {\n    return this.inner.getS3ApiUrl()\n  }\n\n  /**\n   * Returns the bucket the key is restricted to, if any.\n   *\n   * @returns The restricted bucket ID, or `null` if the key is unrestricted.\n   */\n  getAllowedBucketId(): BucketId | null {\n    return this.inner.getAllowedBucketId()\n  }\n\n  /**\n   * Takes an upload URL from the in-memory pool for the given bucket.\n   *\n   * @param bucketId - Bucket to check out an upload URL for.\n   *\n   * @returns A reusable upload URL entry, or `null` if none are pooled.\n   */\n  checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null {\n    return this.inner.checkoutUploadUrl(bucketId)\n  }\n\n  /**\n   * Returns a still-valid upload URL to the pool for reuse.\n   *\n   * @param bucketId - Bucket the upload URL belongs to.\n   * @param entry - Upload URL entry to return.\n   */\n  returnUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.inner.returnUploadUrl(bucketId, entry)\n  }\n\n  /**\n   * Removes an upload URL from the pool after an upload error.\n   *\n   * @param bucketId - Bucket the failed upload URL belongs to.\n   * @param entry - Upload URL entry to evict.\n   */\n  evictUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.inner.evictUploadUrl(bucketId, entry)\n  }\n\n  /**\n   * Takes a large-file part upload URL from the in-memory pool.\n   *\n   * @param fileId - Large file to check out a part upload URL for.\n   *\n   * @returns A reusable part upload URL entry, or `null` if none are pooled.\n   */\n  checkoutPartUploadUrl(fileId: string): UploadUrlEntry | null {\n    return this.inner.checkoutPartUploadUrl(fileId)\n  }\n\n  /**\n   * Returns a still-valid part upload URL to the pool for reuse.\n   *\n   * @param fileId - Large file the part upload URL belongs to.\n   * @param entry - Part upload URL entry to return.\n   */\n  returnPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.inner.returnPartUploadUrl(fileId, entry)\n  }\n\n  /**\n   * Removes a part upload URL from the pool after an error.\n   *\n   * @param fileId - Large file the failed part upload URL belongs to.\n   * @param entry - Part upload URL entry to evict.\n   */\n  evictPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.inner.evictPartUploadUrl(fileId, entry)\n  }\n\n  /**\n   * Awaits any pending disk writes. Call before process exit to ensure the\n   * latest state is persisted.\n   *\n   * @returns A promise that resolves once all queued writes are flushed.\n   */\n  async flushed(): Promise<void> {\n    await this.writeQueue\n  }\n}\n"],"names":[],"mappings":";;;AAmBO,MAAM,gBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWlD,YAA4B,MAAc;AAAd,SAAA,OAAA;AAAA,EAAe;AAAA,EAV1B,QAAQ,IAAI,oBAAA;AAAA,EACrB,aAA4B,QAAQ,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB5C,MAAM,OAAsB;AAC1B,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM;AAC7C,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,WAAK,MAAM,QAAQ,MAAM;AAAA,IAC3B,QAAQ;AAAA,IAER;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,QAAuB;AAC7B,UAAM,OAAO,KAAK,MAAM,QAAA;AACxB,UAAM,OAAO,KAAK,WAAW,KAAK,YAAY;AAC5C,UAAI,SAAS,MAAM;AACjB,YAAI;AACF,gBAAM,UAAU,KAAK,MAAM,IAAI,MAAM;AAAA,QACvC,QAAQ;AAAA,QAER;AACA;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,KAAK,IAAI,GAAG,EAAE,WAAW,MAAM;AACnD,YAAM,UAAU,KAAK,MAAM,KAAK,UAAU,IAAI,GAAG,MAAM;AAAA,IACzD,CAAC;AACD,SAAK,aAAa,KAAK,MAAM,MAAM;AAAA,IAAC,CAAC;AACrC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,MAAsC;AAC5C,SAAK,MAAM,QAAQ,IAAI;AACvB,SAAK,KAAK,MAAA;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAA2C;AACzC,WAAO,KAAK,MAAM,QAAA;AAAA,EACpB;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,MAAM,MAAA;AACX,SAAK,KAAK,MAAA;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAoB;AAClB,WAAO,KAAK,MAAM,UAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAyB;AACvB,WAAO,KAAK,MAAM,eAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAuB;AACrB,WAAO,KAAK,MAAM,aAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAuB;AACrB,WAAO,KAAK,MAAM,aAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,yBAAiC;AAC/B,WAAO,KAAK,MAAM,uBAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,6BAAqC;AACnC,WAAO,KAAK,MAAM,2BAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAsB;AACpB,WAAO,KAAK,MAAM,YAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAsC;AACpC,WAAO,KAAK,MAAM,mBAAA;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,kBAAkB,UAA2C;AAC3D,WAAO,KAAK,MAAM,kBAAkB,QAAQ;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,UAAoB,OAA6B;AAC/D,SAAK,MAAM,gBAAgB,UAAU,KAAK;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAe,UAAoB,OAA6B;AAC9D,SAAK,MAAM,eAAe,UAAU,KAAK;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,sBAAsB,QAAuC;AAC3D,WAAO,KAAK,MAAM,sBAAsB,MAAM;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,oBAAoB,QAAgB,OAA6B;AAC/D,SAAK,MAAM,oBAAoB,QAAQ,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,mBAAmB,QAAgB,OAA6B;AAC9D,SAAK,MAAM,mBAAmB,QAAQ,KAAK;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAyB;AAC7B,UAAM,KAAK;AAAA,EACb;AACF;"}
+{"version":3,"file":"file.js","names":[],"sources":["../../src/auth/file.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto'\nimport { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'\nimport { basename, dirname, join } from 'node:path'\nimport type { AuthorizeAccountResponse } from '../types/auth.ts'\nimport type { BucketId } from '../types/ids.ts'\nimport type { AccountInfo, AuthContextAwareAccountInfo, UploadUrlEntry } from './account-info.ts'\nimport { InMemoryAccountInfo } from './in-memory.ts'\nimport { getRealmUrl } from './realms.ts'\n\nconst PRIVATE_FILE_MODE = 0o600\nconst PERSISTED_AUTH_VERSION = 1\nconst BUILT_IN_PRODUCTION_REALM_URL = getRealmUrl('production')\nconst BUILT_IN_STAGING_REALM_URL = getRealmUrl('staging')\nconst PRODUCTION_HOST_SUFFIX = 'backblazeb2.com'\nconst STAGING_HOST_SUFFIX = 'backblaze.net'\n\ninterface PersistedAuthState {\n  readonly _b2sdk?: {\n    readonly version?: number\n    readonly realmUrl?: string\n    readonly applicationKeyId?: string\n  }\n}\n\n/** Reason a loaded auth cache entry was ignored for the current client. */\nexport type FileAccountInfoDiscardReason =\n  | 'realm_mismatch'\n  | 'application_key_mismatch'\n  | 'endpoint_mismatch'\n\n/** Event emitted when a loaded cache entry is ignored without modifying disk. */\nexport interface FileAccountInfoDiscardEvent {\n  /** Absolute path of the auth cache file. */\n  readonly path: string\n  /** Why the loaded auth entry could not be reused. */\n  readonly reason: FileAccountInfoDiscardReason\n  /** Realm URL stored in the cache metadata, or null for legacy entries. */\n  readonly cachedRealmUrl: string | null | undefined\n  /** Realm URL configured on the current client, if already bound. */\n  readonly expectedRealmUrl: string | undefined\n  /** Application key ID stored in cache metadata, or null for legacy entries. */\n  readonly cachedApplicationKeyId: string | null | undefined\n  /** Application key ID configured on the current client, if already bound. */\n  readonly expectedApplicationKeyId: string | undefined\n}\n\n/** Event emitted when an asynchronous auth-cache write fails. */\nexport interface FileAccountInfoWriteErrorEvent {\n  /** Absolute path of the auth cache file. */\n  readonly path: string\n  /** Underlying filesystem or serialization error. */\n  readonly error: unknown\n}\n\n/** Optional observers for file-backed auth cache behavior. */\nexport interface FileAccountInfoOptions {\n  /**\n   * Called when loaded auth is ignored because its metadata or cached\n   * endpoints are unsafe for this client. The on-disk file is left untouched\n   * so another process using a different realm/key is not clobbered.\n   */\n  readonly onDiscard?: (event: FileAccountInfoDiscardEvent) => void\n  /** Called when an asynchronous auth-cache write fails. */\n  readonly onWriteError?: (event: FileAccountInfoWriteErrorEvent) => void\n}\n\nfunction readPersistedAuthState(value: unknown): {\n  auth: AuthorizeAccountResponse\n  realmUrl: string | null\n  applicationKeyId: string | null\n} | null {\n  if (value === null || typeof value !== 'object') return null\n\n  const maybeState = value as PersistedAuthState\n  if (\n    maybeState._b2sdk?.version !== undefined &&\n    maybeState._b2sdk.version !== PERSISTED_AUTH_VERSION\n  ) {\n    return null\n  }\n  const realmUrl =\n    maybeState._b2sdk !== undefined && typeof maybeState._b2sdk.realmUrl === 'string'\n      ? maybeState._b2sdk.realmUrl\n      : null\n  const applicationKeyId =\n    maybeState._b2sdk !== undefined && typeof maybeState._b2sdk.applicationKeyId === 'string'\n      ? maybeState._b2sdk.applicationKeyId\n      : null\n  return { auth: value as AuthorizeAccountResponse, realmUrl, applicationKeyId }\n}\n\nfunction isProductionBackblazeEndpoint(url: string): boolean {\n  try {\n    const parsed = new URL(url)\n    return parsed.protocol === 'https:' && hasHostSuffix(parsed.hostname, PRODUCTION_HOST_SUFFIX)\n  } catch {\n    return false\n  }\n}\n\nfunction isProductionAuthResponse(auth: AuthorizeAccountResponse): boolean {\n  try {\n    const storageApi = auth.apiInfo.storageApi\n    return [storageApi.apiUrl, storageApi.downloadUrl, storageApi.s3ApiUrl].every(\n      isProductionBackblazeEndpoint,\n    )\n  } catch {\n    return false\n  }\n}\n\nfunction verifiedRealmEndpointSuffix(realmUrl: string): string | null {\n  try {\n    const realm = new URL(realmUrl)\n    if (realm.origin === new URL(BUILT_IN_PRODUCTION_REALM_URL).origin) {\n      return PRODUCTION_HOST_SUFFIX\n    }\n    if (realm.origin === new URL(BUILT_IN_STAGING_REALM_URL).origin) {\n      return STAGING_HOST_SUFFIX\n    }\n  } catch {\n    // Fall through below.\n  }\n  return null\n}\n\nfunction hasHostSuffix(hostname: string, suffix: string): boolean {\n  const host = hostname.toLowerCase()\n  const lowered = suffix.toLowerCase()\n  return host === lowered || host.endsWith(`.${lowered}`)\n}\n\nfunction isEndpointInRealm(url: string, realmUrl: string): boolean {\n  try {\n    const realm = new URL(realmUrl)\n    const endpoint = new URL(url)\n    const endpointHost = endpoint.hostname.toLowerCase()\n    const realmHost = realm.hostname.toLowerCase()\n    if (isLoopbackEndpointHost(endpointHost) || isLoopbackEndpointHost(realmHost)) {\n      return endpoint.origin === realm.origin\n    }\n\n    const verifiedSuffix = verifiedRealmEndpointSuffix(realmUrl)\n    if (verifiedSuffix !== null) {\n      return endpoint.protocol === 'https:' && hasHostSuffix(endpointHost, verifiedSuffix)\n    }\n\n    return endpoint.protocol === realm.protocol && hasHostSuffix(endpointHost, realmHost)\n  } catch {\n    return false\n  }\n}\n\nfunction isLoopbackEndpointHost(host: string): boolean {\n  if (host === 'localhost' || host === '::1' || host === '[::1]') return true\n\n  const parts = host.split('.')\n  return (\n    parts.length === 4 &&\n    parts[0] === '127' &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  )\n}\n\nfunction authEndpointsMatchRealm(auth: AuthorizeAccountResponse, realmUrl: string): boolean {\n  try {\n    const storageApi = auth.apiInfo.storageApi\n    return [storageApi.apiUrl, storageApi.downloadUrl, storageApi.s3ApiUrl].every((url) =>\n      isEndpointInRealm(url, realmUrl),\n    )\n  } catch {\n    return false\n  }\n}\n\n/**\n * Node-only {@link AccountInfo} backend that persists the authorization\n * response to a JSON file. Upload URL pools remain in memory because URLs are\n * short-lived and shouldn't be shared across processes.\n * The JSON file contains a live B2 authorization token, so treat it as\n * sensitive and keep it out of shared or world-readable locations.\n * `FileAccountInfo` serializes writes within one process but does not provide\n * inter-process locking. If multiple processes share one path, use\n * {@link FileAccountInfoOptions.onDiscard} and {@link FileAccountInfoOptions.onWriteError}\n * to observe cache churn, or prefer one cache path per resolved realm and key.\n *\n * On instantiation, call {@link FileAccountInfo.load} to populate state from\n * disk (or start fresh if the file is missing or corrupt). The authorization\n * response is written back to disk on every {@link setAuth} or {@link clear}\n * call so a process restart can resume without re-authorizing.\n * Cache files without an SDK metadata application-key binding are ignored once\n * bound to a `B2Client`, because the SDK cannot verify which key wrote them.\n *\n * This module imports `node:fs/promises`; do not load it in browser bundles.\n */\nexport class FileAccountInfo implements AccountInfo, AuthContextAwareAccountInfo {\n  private readonly inner = new InMemoryAccountInfo()\n  private writeQueue: Promise<void> = Promise.resolve()\n  private realmUrl: string | undefined\n  private loadedAuthRealmUrl: string | null | undefined\n  private applicationKeyId: string | undefined\n  private loadedAuthApplicationKeyId: string | null | undefined\n\n  /**\n   * Constructs a `FileAccountInfo` bound to a JSON file on disk. The file is\n   * created on the first `setAuth` write; reading it back happens via\n   * {@link load}.\n   *\n   * @param path - Absolute path to the JSON file that backs this account info.\n   * @param options - Optional discard and write-error observers.\n   */\n  constructor(\n    public readonly path: string,\n    private readonly options: FileAccountInfoOptions = {},\n  ) {}\n\n  /**\n   * Reads the JSON file at the configured path and populates in-memory state.\n   * If the file is missing or contains invalid JSON, leaves state empty and\n   * returns silently (a re-auth is expected next).\n   *\n   * @returns A promise that resolves when load is complete.\n   */\n  async load(): Promise<void> {\n    try {\n      const text = await readFile(this.path, 'utf8')\n      const parsed = readPersistedAuthState(JSON.parse(text) as unknown)\n      if (parsed === null) return\n      this.inner.setAuth(parsed.auth)\n      this.loadedAuthRealmUrl = parsed.realmUrl\n      this.loadedAuthApplicationKeyId = parsed.applicationKeyId\n      this.discardMismatchedAuth()\n    } catch {\n      // Missing file, invalid JSON, or permission denied: start empty.\n    }\n  }\n\n  /**\n   * Binds this cache to the configured realm URL. `B2Client` calls this when a\n   * FileAccountInfo instance is supplied, so stale auth produced by another\n   * realm is discarded before it can be used.\n   *\n   * @param realmUrl - Resolved authorize-account realm URL for the client.\n   */\n  setRealmUrl(realmUrl: string): void {\n    this.realmUrl = realmUrl\n    this.discardMismatchedAuth()\n  }\n\n  /**\n   * Binds this cache to the configured application key ID. `B2Client` calls\n   * this when a FileAccountInfo instance is supplied, so stale auth produced by\n   * another key is discarded before it can be used.\n   *\n   * @param applicationKeyId - Application key ID configured on the client.\n   */\n  setApplicationKeyId(applicationKeyId: string): void {\n    this.applicationKeyId = applicationKeyId\n    this.discardMismatchedAuth()\n  }\n\n  private discardMismatchedAuth(): void {\n    const auth = this.inner.getAuth()\n    if (auth === null) return\n\n    const reason = this.mismatchReason(auth)\n    if (reason === null) return\n\n    this.inner.clear()\n    this.options.onDiscard?.({\n      path: this.path,\n      reason,\n      cachedRealmUrl: this.loadedAuthRealmUrl,\n      expectedRealmUrl: this.realmUrl,\n      cachedApplicationKeyId: this.loadedAuthApplicationKeyId,\n      expectedApplicationKeyId: this.applicationKeyId,\n    })\n    this.loadedAuthRealmUrl = undefined\n    this.loadedAuthApplicationKeyId = undefined\n  }\n\n  private mismatchReason(auth: AuthorizeAccountResponse): FileAccountInfoDiscardReason | null {\n    const realmMatches =\n      this.realmUrl === undefined ||\n      this.loadedAuthRealmUrl === this.realmUrl ||\n      (this.loadedAuthRealmUrl === null &&\n        this.realmUrl === BUILT_IN_PRODUCTION_REALM_URL &&\n        isProductionAuthResponse(auth))\n    const applicationKeyMatches =\n      this.applicationKeyId === undefined ||\n      this.loadedAuthApplicationKeyId === this.applicationKeyId\n    if (!realmMatches) return 'realm_mismatch'\n    if (!applicationKeyMatches) return 'application_key_mismatch'\n    if (this.realmUrl !== undefined && !authEndpointsMatchRealm(auth, this.realmUrl)) {\n      return 'endpoint_mismatch'\n    }\n\n    return null\n  }\n\n  /**\n   * Persists the current auth response to the file. Atomically queues writes\n   * so concurrent updates serialize.\n   *\n   * @returns A promise that resolves when the write completes.\n   */\n  private flush(): Promise<void> {\n    const auth = this.inner.getAuth()\n    const next = this.writeQueue.then(async () => {\n      if (auth === null) {\n        try {\n          await this.writePrivateFileAtomically('')\n        } catch {\n          // Best-effort\n        }\n        return\n      }\n      const contents =\n        this.realmUrl !== undefined\n          ? JSON.stringify({\n              ...auth,\n              _b2sdk: {\n                version: PERSISTED_AUTH_VERSION,\n                realmUrl: this.realmUrl,\n                ...(this.applicationKeyId !== undefined\n                  ? { applicationKeyId: this.applicationKeyId }\n                  : {}),\n              },\n            })\n          : JSON.stringify(auth)\n      await this.writePrivateFileAtomically(contents)\n    })\n    this.writeQueue = next.catch((error: unknown) => {\n      this.options.onWriteError?.({ path: this.path, error })\n    })\n    return next\n  }\n\n  private async writePrivateFileAtomically(contents: string): Promise<void> {\n    const dir = dirname(this.path)\n    const tempPath = join(dir, `.${basename(this.path)}.${process.pid}.${randomUUID()}.tmp`)\n    await mkdir(dir, { recursive: true })\n\n    try {\n      await writeFile(tempPath, contents, { encoding: 'utf8', mode: PRIVATE_FILE_MODE })\n      await chmod(tempPath, PRIVATE_FILE_MODE)\n      await rename(tempPath, this.path)\n      await chmod(this.path, PRIVATE_FILE_MODE)\n    } catch (error) {\n      await rm(tempPath, { force: true }).catch(() => {})\n      throw error\n    }\n  }\n\n  /**\n   * Stores the given authorization response and triggers an async write to disk.\n   *\n   * @param auth - The authorize-account response to persist.\n   */\n  setAuth(auth: AuthorizeAccountResponse): void {\n    this.inner.setAuth(auth)\n    this.loadedAuthRealmUrl = this.realmUrl ?? null\n    this.loadedAuthApplicationKeyId = this.applicationKeyId ?? null\n    void this.flush()\n  }\n\n  /**\n   * Returns the currently cached authorization response, or `null` if none.\n   *\n   * @returns The cached authorization response, or `null` if not authorized.\n   */\n  getAuth(): AuthorizeAccountResponse | null {\n    return this.inner.getAuth()\n  }\n\n  /** Discards in-memory state and clears the on-disk file. */\n  clear(): void {\n    this.inner.clear()\n    this.loadedAuthRealmUrl = undefined\n    this.loadedAuthApplicationKeyId = undefined\n    void this.flush()\n  }\n\n  /**\n   * Returns the cached B2 API URL.\n   *\n   * @returns The base URL for B2 API calls.\n   */\n  getApiUrl(): string {\n    return this.inner.getApiUrl()\n  }\n\n  /**\n   * Returns the cached file-download URL.\n   *\n   * @returns The base URL for file downloads.\n   */\n  getDownloadUrl(): string {\n    return this.inner.getDownloadUrl()\n  }\n\n  /**\n   * Returns the cached session authorization token.\n   *\n   * @returns The current authorization token.\n   */\n  getAuthToken(): string {\n    return this.inner.getAuthToken()\n  }\n\n  /**\n   * Returns the cached account identifier.\n   *\n   * @returns The authorized account ID.\n   */\n  getAccountId(): string {\n    return this.inner.getAccountId()\n  }\n\n  /**\n   * Returns the server-recommended part size for multipart uploads.\n   *\n   * @returns The recommended part size in bytes.\n   */\n  getRecommendedPartSize(): number {\n    return this.inner.getRecommendedPartSize()\n  }\n\n  /**\n   * Returns the server-enforced minimum part size for multipart uploads.\n   *\n   * @returns The absolute minimum part size in bytes.\n   */\n  getAbsoluteMinimumPartSize(): number {\n    return this.inner.getAbsoluteMinimumPartSize()\n  }\n\n  /**\n   * Returns the cached S3-compatible API URL.\n   *\n   * @returns The base URL for the S3-compatible API.\n   */\n  getS3ApiUrl(): string {\n    return this.inner.getS3ApiUrl()\n  }\n\n  /**\n   * Returns the bucket the key is restricted to, if any.\n   *\n   * @returns The restricted bucket ID, or `null` if the key is unrestricted.\n   */\n  getAllowedBucketId(): BucketId | null {\n    return this.inner.getAllowedBucketId()\n  }\n\n  /**\n   * Returns the buckets the key is restricted to, if any.\n   *\n   * @returns The restricted bucket IDs, or `null` if the key is unrestricted.\n   */\n  getAllowedBucketIds(): readonly BucketId[] | null {\n    return this.inner.getAllowedBucketIds()\n  }\n\n  /**\n   * Takes an upload URL from the in-memory pool for the given bucket.\n   *\n   * @param bucketId - Bucket to check out an upload URL for.\n   *\n   * @returns A reusable upload URL entry, or `null` if none are pooled.\n   */\n  checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null {\n    return this.inner.checkoutUploadUrl(bucketId)\n  }\n\n  /**\n   * Returns a still-valid upload URL to the pool for reuse.\n   *\n   * @param bucketId - Bucket the upload URL belongs to.\n   * @param entry - Upload URL entry to return.\n   */\n  returnUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.inner.returnUploadUrl(bucketId, entry)\n  }\n\n  /**\n   * Removes an upload URL from the pool after an upload error.\n   *\n   * @param bucketId - Bucket the failed upload URL belongs to.\n   * @param entry - Upload URL entry to evict.\n   */\n  evictUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.inner.evictUploadUrl(bucketId, entry)\n  }\n\n  /**\n   * Takes a large-file part upload URL from the in-memory pool.\n   *\n   * @param fileId - Large file to check out a part upload URL for.\n   *\n   * @returns A reusable part upload URL entry, or `null` if none are pooled.\n   */\n  checkoutPartUploadUrl(fileId: string): UploadUrlEntry | null {\n    return this.inner.checkoutPartUploadUrl(fileId)\n  }\n\n  /**\n   * Returns a still-valid part upload URL to the pool for reuse.\n   *\n   * @param fileId - Large file the part upload URL belongs to.\n   * @param entry - Part upload URL entry to return.\n   */\n  returnPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.inner.returnPartUploadUrl(fileId, entry)\n  }\n\n  /**\n   * Removes a part upload URL from the pool after an error.\n   *\n   * @param fileId - Large file the failed part upload URL belongs to.\n   * @param entry - Part upload URL entry to evict.\n   */\n  evictPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.inner.evictPartUploadUrl(fileId, entry)\n  }\n\n  /**\n   * Awaits any pending disk writes. Call before process exit to ensure the\n   * latest state is persisted.\n   *\n   * @returns A promise that resolves once all queued writes are flushed.\n   */\n  async flushed(): Promise<void> {\n    await this.writeQueue\n  }\n}\n"],"mappings":";;;;;;AASA,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB;AAC/B,IAAM,gCAAgC,YAAY,YAAY;AAC9D,IAAM,6BAA6B,YAAY,SAAS;AACxD,IAAM,yBAAyB;AAC/B,IAAM,sBAAsB;AAoD5B,SAAS,uBAAuB,OAIvB;CACP,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CAExD,MAAM,aAAa;CACnB,IACE,WAAW,QAAQ,YAAY,KAAA,KAC/B,WAAW,OAAO,YAAY,wBAE9B,OAAO;CAUT,OAAO;EAAE,MAAM;EAAmC,UAPhD,WAAW,WAAW,KAAA,KAAa,OAAO,WAAW,OAAO,aAAa,WACrE,WAAW,OAAO,WAClB;EAKsD,kBAH1D,WAAW,WAAW,KAAA,KAAa,OAAO,WAAW,OAAO,qBAAqB,WAC7E,WAAW,OAAO,mBAClB;CACuE;AAC/E;AAEA,SAAS,8BAA8B,KAAsB;CAC3D,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,OAAO,OAAO,aAAa,YAAY,cAAc,OAAO,UAAU,sBAAsB;CAC9F,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,yBAAyB,MAAyC;CACzE,IAAI;EACF,MAAM,aAAa,KAAK,QAAQ;EAChC,OAAO;GAAC,WAAW;GAAQ,WAAW;GAAa,WAAW;EAAQ,CAAC,CAAC,MACtE,6BACF;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,4BAA4B,UAAiC;CACpE,IAAI;EACF,MAAM,QAAQ,IAAI,IAAI,QAAQ;EAC9B,IAAI,MAAM,WAAW,IAAI,IAAI,6BAA6B,CAAC,CAAC,QAC1D,OAAO;EAET,IAAI,MAAM,WAAW,IAAI,IAAI,0BAA0B,CAAC,CAAC,QACvD,OAAO;CAEX,QAAQ,CAER;CACA,OAAO;AACT;AAEA,SAAS,cAAc,UAAkB,QAAyB;CAChE,MAAM,OAAO,SAAS,YAAY;CAClC,MAAM,UAAU,OAAO,YAAY;CACnC,OAAO,SAAS,WAAW,KAAK,SAAS,IAAI,SAAS;AACxD;AAEA,SAAS,kBAAkB,KAAa,UAA2B;CACjE,IAAI;EACF,MAAM,QAAQ,IAAI,IAAI,QAAQ;EAC9B,MAAM,WAAW,IAAI,IAAI,GAAG;EAC5B,MAAM,eAAe,SAAS,SAAS,YAAY;EACnD,MAAM,YAAY,MAAM,SAAS,YAAY;EAC7C,IAAI,uBAAuB,YAAY,KAAK,uBAAuB,SAAS,GAC1E,OAAO,SAAS,WAAW,MAAM;EAGnC,MAAM,iBAAiB,4BAA4B,QAAQ;EAC3D,IAAI,mBAAmB,MACrB,OAAO,SAAS,aAAa,YAAY,cAAc,cAAc,cAAc;EAGrF,OAAO,SAAS,aAAa,MAAM,YAAY,cAAc,cAAc,SAAS;CACtF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,MAAuB;CACrD,IAAI,SAAS,eAAe,SAAS,SAAS,SAAS,SAAS,OAAO;CAEvE,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,OACE,MAAM,WAAW,KACjB,MAAM,OAAO,SACb,MAAM,OAAO,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG;AAEnE;AAEA,SAAS,wBAAwB,MAAgC,UAA2B;CAC1F,IAAI;EACF,MAAM,aAAa,KAAK,QAAQ;EAChC,OAAO;GAAC,WAAW;GAAQ,WAAW;GAAa,WAAW;EAAQ,CAAC,CAAC,OAAO,QAC7E,kBAAkB,KAAK,QAAQ,CACjC;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;AAsBA,IAAa,kBAAb,MAAiF;CAiB7D;CACC;CAjBnB,QAAyB,IAAI,oBAAoB;CACjD,aAAoC,QAAQ,QAAQ;CACpD;CACA;CACA;CACA;;;;;;;;;CAUA,YACE,MACA,UAAmD,CAAC,GACpD;EAFgB,KAAA,OAAA;EACC,KAAA,UAAA;CAChB;;;;;;;;CASH,MAAM,OAAsB;EAC1B,IAAI;GACF,MAAM,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM;GAC7C,MAAM,SAAS,uBAAuB,KAAK,MAAM,IAAI,CAAY;GACjE,IAAI,WAAW,MAAM;GACrB,KAAK,MAAM,QAAQ,OAAO,IAAI;GAC9B,KAAK,qBAAqB,OAAO;GACjC,KAAK,6BAA6B,OAAO;GACzC,KAAK,sBAAsB;EAC7B,QAAQ,CAER;CACF;;;;;;;;CASA,YAAY,UAAwB;EAClC,KAAK,WAAW;EAChB,KAAK,sBAAsB;CAC7B;;;;;;;;CASA,oBAAoB,kBAAgC;EAClD,KAAK,mBAAmB;EACxB,KAAK,sBAAsB;CAC7B;CAEA,wBAAsC;EACpC,MAAM,OAAO,KAAK,MAAM,QAAQ;EAChC,IAAI,SAAS,MAAM;EAEnB,MAAM,SAAS,KAAK,eAAe,IAAI;EACvC,IAAI,WAAW,MAAM;EAErB,KAAK,MAAM,MAAM;EACjB,KAAK,QAAQ,YAAY;GACvB,MAAM,KAAK;GACX;GACA,gBAAgB,KAAK;GACrB,kBAAkB,KAAK;GACvB,wBAAwB,KAAK;GAC7B,0BAA0B,KAAK;EACjC,CAAC;EACD,KAAK,qBAAqB,KAAA;EAC1B,KAAK,6BAA6B,KAAA;CACpC;CAEA,eAAuB,MAAqE;EAC1F,MAAM,eACJ,KAAK,aAAa,KAAA,KAClB,KAAK,uBAAuB,KAAK,YAChC,KAAK,uBAAuB,QAC3B,KAAK,aAAa,iCAClB,yBAAyB,IAAI;EACjC,MAAM,wBACJ,KAAK,qBAAqB,KAAA,KAC1B,KAAK,+BAA+B,KAAK;EAC3C,IAAI,CAAC,cAAc,OAAO;EAC1B,IAAI,CAAC,uBAAuB,OAAO;EACnC,IAAI,KAAK,aAAa,KAAA,KAAa,CAAC,wBAAwB,MAAM,KAAK,QAAQ,GAC7E,OAAO;EAGT,OAAO;CACT;;;;;;;CAQA,QAA+B;EAC7B,MAAM,OAAO,KAAK,MAAM,QAAQ;EAChC,MAAM,OAAO,KAAK,WAAW,KAAK,YAAY;GAC5C,IAAI,SAAS,MAAM;IACjB,IAAI;KACF,MAAM,KAAK,2BAA2B,EAAE;IAC1C,QAAQ,CAER;IACA;GACF;GACA,MAAM,WACJ,KAAK,aAAa,KAAA,IACd,KAAK,UAAU;IACb,GAAG;IACH,QAAQ;KACN,SAAS;KACT,UAAU,KAAK;KACf,GAAI,KAAK,qBAAqB,KAAA,IAC1B,EAAE,kBAAkB,KAAK,iBAAiB,IAC1C,CAAC;IACP;GACF,CAAC,IACD,KAAK,UAAU,IAAI;GACzB,MAAM,KAAK,2BAA2B,QAAQ;EAChD,CAAC;EACD,KAAK,aAAa,KAAK,OAAO,UAAmB;GAC/C,KAAK,QAAQ,eAAe;IAAE,MAAM,KAAK;IAAM;GAAM,CAAC;EACxD,CAAC;EACD,OAAO;CACT;CAEA,MAAc,2BAA2B,UAAiC;EACxE,MAAM,MAAM,QAAQ,KAAK,IAAI;EAC7B,MAAM,WAAW,KAAK,KAAK,IAAI,SAAS,KAAK,IAAI,EAAE,GAAG,QAAQ,IAAI,GAAG,WAAW,EAAE,KAAK;EACvF,MAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;EAEpC,IAAI;GACF,MAAM,UAAU,UAAU,UAAU;IAAE,UAAU;IAAQ,MAAM;GAAkB,CAAC;GACjF,MAAM,MAAM,UAAU,iBAAiB;GACvC,MAAM,OAAO,UAAU,KAAK,IAAI;GAChC,MAAM,MAAM,KAAK,MAAM,iBAAiB;EAC1C,SAAS,OAAO;GACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;GAClD,MAAM;EACR;CACF;;;;;;CAOA,QAAQ,MAAsC;EAC5C,KAAK,MAAM,QAAQ,IAAI;EACvB,KAAK,qBAAqB,KAAK,YAAY;EAC3C,KAAK,6BAA6B,KAAK,oBAAoB;EAC3D,KAAU,MAAM;CAClB;;;;;;CAOA,UAA2C;EACzC,OAAO,KAAK,MAAM,QAAQ;CAC5B;;CAGA,QAAc;EACZ,KAAK,MAAM,MAAM;EACjB,KAAK,qBAAqB,KAAA;EAC1B,KAAK,6BAA6B,KAAA;EAClC,KAAU,MAAM;CAClB;;;;;;CAOA,YAAoB;EAClB,OAAO,KAAK,MAAM,UAAU;CAC9B;;;;;;CAOA,iBAAyB;EACvB,OAAO,KAAK,MAAM,eAAe;CACnC;;;;;;CAOA,eAAuB;EACrB,OAAO,KAAK,MAAM,aAAa;CACjC;;;;;;CAOA,eAAuB;EACrB,OAAO,KAAK,MAAM,aAAa;CACjC;;;;;;CAOA,yBAAiC;EAC/B,OAAO,KAAK,MAAM,uBAAuB;CAC3C;;;;;;CAOA,6BAAqC;EACnC,OAAO,KAAK,MAAM,2BAA2B;CAC/C;;;;;;CAOA,cAAsB;EACpB,OAAO,KAAK,MAAM,YAAY;CAChC;;;;;;CAOA,qBAAsC;EACpC,OAAO,KAAK,MAAM,mBAAmB;CACvC;;;;;;CAOA,sBAAkD;EAChD,OAAO,KAAK,MAAM,oBAAoB;CACxC;;;;;;;;CASA,kBAAkB,UAA2C;EAC3D,OAAO,KAAK,MAAM,kBAAkB,QAAQ;CAC9C;;;;;;;CAQA,gBAAgB,UAAoB,OAA6B;EAC/D,KAAK,MAAM,gBAAgB,UAAU,KAAK;CAC5C;;;;;;;CAQA,eAAe,UAAoB,OAA6B;EAC9D,KAAK,MAAM,eAAe,UAAU,KAAK;CAC3C;;;;;;;;CASA,sBAAsB,QAAuC;EAC3D,OAAO,KAAK,MAAM,sBAAsB,MAAM;CAChD;;;;;;;CAQA,oBAAoB,QAAgB,OAA6B;EAC/D,KAAK,MAAM,oBAAoB,QAAQ,KAAK;CAC9C;;;;;;;CAQA,mBAAmB,QAAgB,OAA6B;EAC9D,KAAK,MAAM,mBAAmB,QAAQ,KAAK;CAC7C;;;;;;;CAQA,MAAM,UAAyB;EAC7B,MAAM,KAAK;CACb;AACF"}

package/dist/auth/in-memory.cjs

@@ -1,184 +1,213 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const uploadUrlPool = require("./upload-url-pool.cjs");
-class InMemoryAccountInfo {
-  /** Cached authorization response, or null before authorize() is called. */
-  auth = null;
-  /** Pool of reusable small-file upload URLs, keyed by bucket ID. */
-  uploadUrls = new uploadUrlPool.UploadUrlPool();
-  /** Pool of reusable large-file part upload URLs, keyed by file ID. */
-  partUploadUrls = new uploadUrlPool.UploadUrlPool();
-  /**
-   * Store a fresh authorization response, replacing any previous state.
-   *
-   * @param auth - The authorize account response to store.
-   */
-  setAuth(auth) {
-    this.auth = auth;
-    this.uploadUrls.clear();
-    this.partUploadUrls.clear();
-  }
-  /**
-   * Return the current authorization response, or null if not authorized.
-   *
-   * @returns The cached authorization response, or null if not yet authorized.
-   */
-  getAuth() {
-    return this.auth;
-  }
-  /** Discard all cached authorization state and upload URLs. */
-  clear() {
-    this.auth = null;
-    this.uploadUrls.clear();
-    this.partUploadUrls.clear();
-  }
-  /**
-   * Base URL for B2 API calls.
-   *
-   * @returns The base URL for B2 API calls.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getApiUrl() {
-    return this.requireAuth().apiInfo.storageApi.apiUrl;
-  }
-  /**
-   * Base URL for file downloads.
-   *
-   * @returns The base URL for file downloads.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getDownloadUrl() {
-    return this.requireAuth().apiInfo.storageApi.downloadUrl;
-  }
-  /**
-   * Current authorization token.
-   *
-   * @returns The current authorization token.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getAuthToken() {
-    return this.requireAuth().authorizationToken;
-  }
-  /**
-   * The authorized account ID.
-   *
-   * @returns The authorized account identifier.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getAccountId() {
-    return this.requireAuth().accountId;
-  }
-  /**
-   * Server-recommended part size for large file uploads, in bytes.
-   *
-   * @returns The server-recommended part size in bytes.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getRecommendedPartSize() {
-    return this.requireAuth().apiInfo.storageApi.recommendedPartSize;
-  }
-  /**
-   * Smallest allowed part size for large file uploads, in bytes.
-   *
-   * @returns The smallest allowed part size in bytes.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getAbsoluteMinimumPartSize() {
-    return this.requireAuth().apiInfo.storageApi.absoluteMinimumPartSize;
-  }
-  /**
-   * Base URL for the S3-compatible API.
-   *
-   * @returns The base URL for the S3-compatible API.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getS3ApiUrl() {
-    return this.requireAuth().apiInfo.storageApi.s3ApiUrl;
-  }
-  /**
-   * Bucket ID the key is restricted to, or null if unrestricted.
-   *
-   * @returns The restricted bucket identifier, or null if the key is unrestricted.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getAllowedBucketId() {
-    return this.requireAuth().apiInfo.storageApi.allowed.bucketId ?? null;
-  }
-  /**
-   * Take an upload URL from the pool for the given bucket, or null if none available.
-   *
-   * @param bucketId - The bucket to check out an upload URL for.
-   *
-   * @returns A reusable upload URL entry, or null if none are available.
-   */
-  checkoutUploadUrl(bucketId) {
-    return this.uploadUrls.checkout(bucketId);
-  }
-  /**
-   * Return a still-valid upload URL to the pool for reuse.
-   *
-   * @param bucketId - The bucket the upload URL belongs to.
-   * @param entry - The upload URL entry to return to the pool.
-   */
-  returnUploadUrl(bucketId, entry) {
-    this.uploadUrls.checkin(bucketId, entry);
-  }
-  /**
-   * Remove an upload URL from the pool after an upload error.
-   *
-   * @param bucketId - The bucket the failed upload URL belongs to.
-   * @param entry - The upload URL entry to remove from the pool.
-   */
-  evictUploadUrl(bucketId, entry) {
-    this.uploadUrls.evict(bucketId, entry);
-  }
-  /**
-   * Take a large-file part upload URL from the pool, or null if none available.
-   *
-   * @param fileId - The large file to check out a part upload URL for.
-   *
-   * @returns A reusable part upload URL entry, or null if none are available.
-   */
-  checkoutPartUploadUrl(fileId) {
-    return this.partUploadUrls.checkout(fileId);
-  }
-  /**
-   * Return a still-valid part upload URL to the pool for reuse.
-   *
-   * @param fileId - The large file the part upload URL belongs to.
-   * @param entry - The part upload URL entry to return to the pool.
-   */
-  returnPartUploadUrl(fileId, entry) {
-    this.partUploadUrls.checkin(fileId, entry);
-  }
-  /**
-   * Remove a part upload URL from the pool after an error.
-   *
-   * @param fileId - The large file the failed part upload URL belongs to.
-   * @param entry - The part upload URL entry to remove from the pool.
-   */
-  evictPartUploadUrl(fileId, entry) {
-    this.partUploadUrls.evict(fileId, entry);
-  }
-  /**
-   * Retrieve the cached auth response or throw if not yet authorized.
-   *
-   * @returns The cached authorization response.
-   *
-   * @throws Error if authorize() has not been called.
-   */
-  requireAuth() {
-    if (!this.auth) throw new Error("Not authorized. Call authorize() first.");
-    return this.auth;
-  }
-}
+const require_upload_url_pool = require("./upload-url-pool.cjs");
+//#region src/auth/in-memory.ts
+/**
+* In-memory implementation of {@link AccountInfo}.
+* Stores the authorization response and upload URL pools in plain object fields.
+* Suitable for short-lived processes or tests; state is lost when the process exits.
+*/
+var InMemoryAccountInfo = class {
+	/** Cached authorization response, or null before authorize() is called. */
+	auth = null;
+	/** Pool of reusable small-file upload URLs, keyed by bucket ID. */
+	uploadUrls = new require_upload_url_pool.UploadUrlPool();
+	/** Pool of reusable large-file part upload URLs, keyed by file ID. */
+	partUploadUrls = new require_upload_url_pool.UploadUrlPool();
+	/**
+	* Store a fresh authorization response, replacing any previous state.
+	*
+	* @param auth - The authorize account response to store.
+	*/
+	setAuth(auth) {
+		this.auth = auth;
+		this.uploadUrls.clear();
+		this.partUploadUrls.clear();
+	}
+	/**
+	* Return the current authorization response, or null if not authorized.
+	*
+	* @returns The cached authorization response, or null if not yet authorized.
+	*/
+	getAuth() {
+		return this.auth;
+	}
+	/** Discard all cached authorization state and upload URLs. */
+	clear() {
+		this.auth = null;
+		this.uploadUrls.clear();
+		this.partUploadUrls.clear();
+	}
+	/**
+	* Base URL for B2 API calls.
+	*
+	* @returns The base URL for B2 API calls.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getApiUrl() {
+		return this.requireAuth().apiInfo.storageApi.apiUrl;
+	}
+	/**
+	* Base URL for file downloads.
+	*
+	* @returns The base URL for file downloads.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getDownloadUrl() {
+		return this.requireAuth().apiInfo.storageApi.downloadUrl;
+	}
+	/**
+	* Current authorization token.
+	*
+	* @returns The current authorization token.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAuthToken() {
+		return this.requireAuth().authorizationToken;
+	}
+	/**
+	* The authorized account ID.
+	*
+	* @returns The authorized account identifier.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAccountId() {
+		return this.requireAuth().accountId;
+	}
+	/**
+	* Server-recommended part size for large file uploads, in bytes.
+	*
+	* @returns The server-recommended part size in bytes.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getRecommendedPartSize() {
+		return this.requireAuth().apiInfo.storageApi.recommendedPartSize;
+	}
+	/**
+	* Smallest allowed part size for large file uploads, in bytes.
+	*
+	* @returns The smallest allowed part size in bytes.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAbsoluteMinimumPartSize() {
+		return this.requireAuth().apiInfo.storageApi.absoluteMinimumPartSize;
+	}
+	/**
+	* Base URL for the S3-compatible API.
+	*
+	* @returns The base URL for the S3-compatible API.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getS3ApiUrl() {
+		return this.requireAuth().apiInfo.storageApi.s3ApiUrl;
+	}
+	/**
+	* Bucket ID the key is restricted to, or null if unrestricted.
+	*
+	* @returns The restricted bucket identifier, or null if the key is unrestricted.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAllowedBucketId() {
+		const allowed = this.requireAuth().apiInfo.storageApi.allowed;
+		const buckets = allowed.buckets;
+		if (buckets === void 0) return allowed.bucketId ?? null;
+		if (buckets !== null) {
+			if (buckets.length !== 1) throw new Error("Authorized key is not restricted to exactly one bucket; use getAllowedBucketIds()");
+			return buckets[0]?.id ?? null;
+		}
+		return null;
+	}
+	/**
+	* Bucket IDs the key is restricted to, or null if unrestricted.
+	*
+	* @returns The restricted bucket identifiers, or null if the key is unrestricted.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAllowedBucketIds() {
+		const allowed = this.requireAuth().apiInfo.storageApi.allowed;
+		const buckets = allowed.buckets;
+		if (buckets === void 0) {
+			const legacyBucketId = allowed.bucketId ?? null;
+			return legacyBucketId === null ? null : [legacyBucketId];
+		}
+		return buckets === null ? null : buckets.map((bucket) => bucket.id);
+	}
+	/**
+	* Take an upload URL from the pool for the given bucket, or null if none available.
+	*
+	* @param bucketId - The bucket to check out an upload URL for.
+	*
+	* @returns A reusable upload URL entry, or null if none are available.
+	*/
+	checkoutUploadUrl(bucketId) {
+		return this.uploadUrls.checkout(bucketId);
+	}
+	/**
+	* Return a still-valid upload URL to the pool for reuse.
+	*
+	* @param bucketId - The bucket the upload URL belongs to.
+	* @param entry - The upload URL entry to return to the pool.
+	*/
+	returnUploadUrl(bucketId, entry) {
+		this.uploadUrls.checkin(bucketId, entry);
+	}
+	/**
+	* Remove an upload URL from the pool after an upload error.
+	*
+	* @param bucketId - The bucket the failed upload URL belongs to.
+	* @param entry - The upload URL entry to remove from the pool.
+	*/
+	evictUploadUrl(bucketId, entry) {
+		this.uploadUrls.evict(bucketId, entry);
+	}
+	/**
+	* Take a large-file part upload URL from the pool, or null if none available.
+	*
+	* @param fileId - The large file to check out a part upload URL for.
+	*
+	* @returns A reusable part upload URL entry, or null if none are available.
+	*/
+	checkoutPartUploadUrl(fileId) {
+		return this.partUploadUrls.checkout(fileId);
+	}
+	/**
+	* Return a still-valid part upload URL to the pool for reuse.
+	*
+	* @param fileId - The large file the part upload URL belongs to.
+	* @param entry - The part upload URL entry to return to the pool.
+	*/
+	returnPartUploadUrl(fileId, entry) {
+		this.partUploadUrls.checkin(fileId, entry);
+	}
+	/**
+	* Remove a part upload URL from the pool after an error.
+	*
+	* @param fileId - The large file the failed part upload URL belongs to.
+	* @param entry - The part upload URL entry to remove from the pool.
+	*/
+	evictPartUploadUrl(fileId, entry) {
+		this.partUploadUrls.evict(fileId, entry);
+	}
+	/**
+	* Retrieve the cached auth response or throw if not yet authorized.
+	*
+	* @returns The cached authorization response.
+	*
+	* @throws Error if authorize() has not been called.
+	*/
+	requireAuth() {
+		if (!this.auth) throw new Error("Not authorized. Call authorize() first.");
+		return this.auth;
+	}
+};
+//#endregion
 exports.InMemoryAccountInfo = InMemoryAccountInfo;
-//# sourceMappingURL=in-memory.cjs.map
+
+//# sourceMappingURL=in-memory.cjs.map

package/dist/auth/in-memory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"in-memory.cjs","sources":["../../src/auth/in-memory.ts"],"sourcesContent":["import type { AuthorizeAccountResponse } from '../types/auth.ts'\nimport type { BucketId } from '../types/ids.ts'\nimport type { AccountInfo, UploadUrlEntry } from './account-info.ts'\nimport { UploadUrlPool } from './upload-url-pool.ts'\n\n/**\n * In-memory implementation of {@link AccountInfo}.\n * Stores the authorization response and upload URL pools in plain object fields.\n * Suitable for short-lived processes or tests; state is lost when the process exits.\n */\nexport class InMemoryAccountInfo implements AccountInfo {\n  /** Cached authorization response, or null before authorize() is called. */\n  private auth: AuthorizeAccountResponse | null = null\n  /** Pool of reusable small-file upload URLs, keyed by bucket ID. */\n  private readonly uploadUrls = new UploadUrlPool()\n  /** Pool of reusable large-file part upload URLs, keyed by file ID. */\n  private readonly partUploadUrls = new UploadUrlPool()\n\n  /**\n   * Store a fresh authorization response, replacing any previous state.\n   *\n   * @param auth - The authorize account response to store.\n   */\n  setAuth(auth: AuthorizeAccountResponse): void {\n    this.auth = auth\n    this.uploadUrls.clear()\n    this.partUploadUrls.clear()\n  }\n\n  /**\n   * Return the current authorization response, or null if not authorized.\n   *\n   * @returns The cached authorization response, or null if not yet authorized.\n   */\n  getAuth(): AuthorizeAccountResponse | null {\n    return this.auth\n  }\n\n  /** Discard all cached authorization state and upload URLs. */\n  clear(): void {\n    this.auth = null\n    this.uploadUrls.clear()\n    this.partUploadUrls.clear()\n  }\n\n  /**\n   * Base URL for B2 API calls.\n   *\n   * @returns The base URL for B2 API calls.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getApiUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.apiUrl\n  }\n\n  /**\n   * Base URL for file downloads.\n   *\n   * @returns The base URL for file downloads.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getDownloadUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.downloadUrl\n  }\n\n  /**\n   * Current authorization token.\n   *\n   * @returns The current authorization token.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAuthToken(): string {\n    return this.requireAuth().authorizationToken as string\n  }\n\n  /**\n   * The authorized account ID.\n   *\n   * @returns The authorized account identifier.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAccountId(): string {\n    return this.requireAuth().accountId as string\n  }\n\n  /**\n   * Server-recommended part size for large file uploads, in bytes.\n   *\n   * @returns The server-recommended part size in bytes.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getRecommendedPartSize(): number {\n    return this.requireAuth().apiInfo.storageApi.recommendedPartSize\n  }\n\n  /**\n   * Smallest allowed part size for large file uploads, in bytes.\n   *\n   * @returns The smallest allowed part size in bytes.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAbsoluteMinimumPartSize(): number {\n    return this.requireAuth().apiInfo.storageApi.absoluteMinimumPartSize\n  }\n\n  /**\n   * Base URL for the S3-compatible API.\n   *\n   * @returns The base URL for the S3-compatible API.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getS3ApiUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.s3ApiUrl\n  }\n\n  /**\n   * Bucket ID the key is restricted to, or null if unrestricted.\n   *\n   * @returns The restricted bucket identifier, or null if the key is unrestricted.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAllowedBucketId(): BucketId | null {\n    return this.requireAuth().apiInfo.storageApi.allowed.bucketId ?? null\n  }\n\n  /**\n   * Take an upload URL from the pool for the given bucket, or null if none available.\n   *\n   * @param bucketId - The bucket to check out an upload URL for.\n   *\n   * @returns A reusable upload URL entry, or null if none are available.\n   */\n  checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null {\n    return this.uploadUrls.checkout(bucketId as string)\n  }\n\n  /**\n   * Return a still-valid upload URL to the pool for reuse.\n   *\n   * @param bucketId - The bucket the upload URL belongs to.\n   * @param entry - The upload URL entry to return to the pool.\n   */\n  returnUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.uploadUrls.checkin(bucketId as string, entry)\n  }\n\n  /**\n   * Remove an upload URL from the pool after an upload error.\n   *\n   * @param bucketId - The bucket the failed upload URL belongs to.\n   * @param entry - The upload URL entry to remove from the pool.\n   */\n  evictUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.uploadUrls.evict(bucketId as string, entry)\n  }\n\n  /**\n   * Take a large-file part upload URL from the pool, or null if none available.\n   *\n   * @param fileId - The large file to check out a part upload URL for.\n   *\n   * @returns A reusable part upload URL entry, or null if none are available.\n   */\n  checkoutPartUploadUrl(fileId: string): UploadUrlEntry | null {\n    return this.partUploadUrls.checkout(fileId)\n  }\n\n  /**\n   * Return a still-valid part upload URL to the pool for reuse.\n   *\n   * @param fileId - The large file the part upload URL belongs to.\n   * @param entry - The part upload URL entry to return to the pool.\n   */\n  returnPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.partUploadUrls.checkin(fileId, entry)\n  }\n\n  /**\n   * Remove a part upload URL from the pool after an error.\n   *\n   * @param fileId - The large file the failed part upload URL belongs to.\n   * @param entry - The part upload URL entry to remove from the pool.\n   */\n  evictPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.partUploadUrls.evict(fileId, entry)\n  }\n\n  /**\n   * Retrieve the cached auth response or throw if not yet authorized.\n   *\n   * @returns The cached authorization response.\n   *\n   * @throws Error if authorize() has not been called.\n   */\n  private requireAuth(): AuthorizeAccountResponse {\n    if (!this.auth) throw new Error('Not authorized. Call authorize() first.')\n    return this.auth\n  }\n}\n"],"names":["UploadUrlPool"],"mappings":";;;AAUO,MAAM,oBAA2C;AAAA;AAAA,EAE9C,OAAwC;AAAA;AAAA,EAE/B,aAAa,IAAIA,cAAAA,cAAA;AAAA;AAAA,EAEjB,iBAAiB,IAAIA,cAAAA,cAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,QAAQ,MAAsC;AAC5C,SAAK,OAAO;AACZ,SAAK,WAAW,MAAA;AAChB,SAAK,eAAe,MAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAA2C;AACzC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,OAAO;AACZ,SAAK,WAAW,MAAA;AAChB,SAAK,eAAe,MAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAoB;AAClB,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAyB;AACvB,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAuB;AACrB,WAAO,KAAK,cAAc;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAuB;AACrB,WAAO,KAAK,cAAc;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,yBAAiC;AAC/B,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,6BAAqC;AACnC,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,cAAsB;AACpB,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,qBAAsC;AACpC,WAAO,KAAK,cAAc,QAAQ,WAAW,QAAQ,YAAY;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,kBAAkB,UAA2C;AAC3D,WAAO,KAAK,WAAW,SAAS,QAAkB;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,UAAoB,OAA6B;AAC/D,SAAK,WAAW,QAAQ,UAAoB,KAAK;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAe,UAAoB,OAA6B;AAC9D,SAAK,WAAW,MAAM,UAAoB,KAAK;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,sBAAsB,QAAuC;AAC3D,WAAO,KAAK,eAAe,SAAS,MAAM;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,oBAAoB,QAAgB,OAA6B;AAC/D,SAAK,eAAe,QAAQ,QAAQ,KAAK;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,mBAAmB,QAAgB,OAA6B;AAC9D,SAAK,eAAe,MAAM,QAAQ,KAAK;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cAAwC;AAC9C,QAAI,CAAC,KAAK,KAAM,OAAM,IAAI,MAAM,yCAAyC;AACzE,WAAO,KAAK;AAAA,EACd;AACF;;"}
+{"version":3,"file":"in-memory.cjs","names":[],"sources":["../../src/auth/in-memory.ts"],"sourcesContent":["import type { AuthorizeAccountResponse } from '../types/auth.ts'\nimport type { BucketId } from '../types/ids.ts'\nimport type { AccountInfo, UploadUrlEntry } from './account-info.ts'\nimport { UploadUrlPool } from './upload-url-pool.ts'\n\n/**\n * In-memory implementation of {@link AccountInfo}.\n * Stores the authorization response and upload URL pools in plain object fields.\n * Suitable for short-lived processes or tests; state is lost when the process exits.\n */\nexport class InMemoryAccountInfo implements AccountInfo {\n  /** Cached authorization response, or null before authorize() is called. */\n  private auth: AuthorizeAccountResponse | null = null\n  /** Pool of reusable small-file upload URLs, keyed by bucket ID. */\n  private readonly uploadUrls = new UploadUrlPool()\n  /** Pool of reusable large-file part upload URLs, keyed by file ID. */\n  private readonly partUploadUrls = new UploadUrlPool()\n\n  /**\n   * Store a fresh authorization response, replacing any previous state.\n   *\n   * @param auth - The authorize account response to store.\n   */\n  setAuth(auth: AuthorizeAccountResponse): void {\n    this.auth = auth\n    this.uploadUrls.clear()\n    this.partUploadUrls.clear()\n  }\n\n  /**\n   * Return the current authorization response, or null if not authorized.\n   *\n   * @returns The cached authorization response, or null if not yet authorized.\n   */\n  getAuth(): AuthorizeAccountResponse | null {\n    return this.auth\n  }\n\n  /** Discard all cached authorization state and upload URLs. */\n  clear(): void {\n    this.auth = null\n    this.uploadUrls.clear()\n    this.partUploadUrls.clear()\n  }\n\n  /**\n   * Base URL for B2 API calls.\n   *\n   * @returns The base URL for B2 API calls.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getApiUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.apiUrl\n  }\n\n  /**\n   * Base URL for file downloads.\n   *\n   * @returns The base URL for file downloads.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getDownloadUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.downloadUrl\n  }\n\n  /**\n   * Current authorization token.\n   *\n   * @returns The current authorization token.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAuthToken(): string {\n    return this.requireAuth().authorizationToken as string\n  }\n\n  /**\n   * The authorized account ID.\n   *\n   * @returns The authorized account identifier.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAccountId(): string {\n    return this.requireAuth().accountId as string\n  }\n\n  /**\n   * Server-recommended part size for large file uploads, in bytes.\n   *\n   * @returns The server-recommended part size in bytes.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getRecommendedPartSize(): number {\n    return this.requireAuth().apiInfo.storageApi.recommendedPartSize\n  }\n\n  /**\n   * Smallest allowed part size for large file uploads, in bytes.\n   *\n   * @returns The smallest allowed part size in bytes.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAbsoluteMinimumPartSize(): number {\n    return this.requireAuth().apiInfo.storageApi.absoluteMinimumPartSize\n  }\n\n  /**\n   * Base URL for the S3-compatible API.\n   *\n   * @returns The base URL for the S3-compatible API.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getS3ApiUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.s3ApiUrl\n  }\n\n  /**\n   * Bucket ID the key is restricted to, or null if unrestricted.\n   *\n   * @returns The restricted bucket identifier, or null if the key is unrestricted.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAllowedBucketId(): BucketId | null {\n    const allowed = this.requireAuth().apiInfo.storageApi.allowed\n    const buckets: typeof allowed.buckets | undefined = allowed.buckets\n    if (buckets === undefined) {\n      return allowed.bucketId ?? null\n    }\n    if (buckets !== null) {\n      if (buckets.length !== 1) {\n        throw new Error(\n          'Authorized key is not restricted to exactly one bucket; use getAllowedBucketIds()',\n        )\n      }\n      return buckets[0]?.id ?? null\n    }\n    return null\n  }\n\n  /**\n   * Bucket IDs the key is restricted to, or null if unrestricted.\n   *\n   * @returns The restricted bucket identifiers, or null if the key is unrestricted.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAllowedBucketIds(): readonly BucketId[] | null {\n    const allowed = this.requireAuth().apiInfo.storageApi.allowed\n    const buckets: typeof allowed.buckets | undefined = allowed.buckets\n    if (buckets === undefined) {\n      const legacyBucketId = allowed.bucketId ?? null\n      return legacyBucketId === null ? null : [legacyBucketId]\n    }\n    return buckets === null ? null : buckets.map((bucket) => bucket.id)\n  }\n\n  /**\n   * Take an upload URL from the pool for the given bucket, or null if none available.\n   *\n   * @param bucketId - The bucket to check out an upload URL for.\n   *\n   * @returns A reusable upload URL entry, or null if none are available.\n   */\n  checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null {\n    return this.uploadUrls.checkout(bucketId as string)\n  }\n\n  /**\n   * Return a still-valid upload URL to the pool for reuse.\n   *\n   * @param bucketId - The bucket the upload URL belongs to.\n   * @param entry - The upload URL entry to return to the pool.\n   */\n  returnUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.uploadUrls.checkin(bucketId as string, entry)\n  }\n\n  /**\n   * Remove an upload URL from the pool after an upload error.\n   *\n   * @param bucketId - The bucket the failed upload URL belongs to.\n   * @param entry - The upload URL entry to remove from the pool.\n   */\n  evictUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.uploadUrls.evict(bucketId as string, entry)\n  }\n\n  /**\n   * Take a large-file part upload URL from the pool, or null if none available.\n   *\n   * @param fileId - The large file to check out a part upload URL for.\n   *\n   * @returns A reusable part upload URL entry, or null if none are available.\n   */\n  checkoutPartUploadUrl(fileId: string): UploadUrlEntry | null {\n    return this.partUploadUrls.checkout(fileId)\n  }\n\n  /**\n   * Return a still-valid part upload URL to the pool for reuse.\n   *\n   * @param fileId - The large file the part upload URL belongs to.\n   * @param entry - The part upload URL entry to return to the pool.\n   */\n  returnPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.partUploadUrls.checkin(fileId, entry)\n  }\n\n  /**\n   * Remove a part upload URL from the pool after an error.\n   *\n   * @param fileId - The large file the failed part upload URL belongs to.\n   * @param entry - The part upload URL entry to remove from the pool.\n   */\n  evictPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.partUploadUrls.evict(fileId, entry)\n  }\n\n  /**\n   * Retrieve the cached auth response or throw if not yet authorized.\n   *\n   * @returns The cached authorization response.\n   *\n   * @throws Error if authorize() has not been called.\n   */\n  private requireAuth(): AuthorizeAccountResponse {\n    if (!this.auth) throw new Error('Not authorized. Call authorize() first.')\n    return this.auth\n  }\n}\n"],"mappings":";;;;;;;AAUA,IAAa,sBAAb,MAAwD;;CAEtD,OAAgD;;CAEhD,aAA8B,IAAI,wBAAA,cAAc;;CAEhD,iBAAkC,IAAI,wBAAA,cAAc;;;;;;CAOpD,QAAQ,MAAsC;EAC5C,KAAK,OAAO;EACZ,KAAK,WAAW,MAAM;EACtB,KAAK,eAAe,MAAM;CAC5B;;;;;;CAOA,UAA2C;EACzC,OAAO,KAAK;CACd;;CAGA,QAAc;EACZ,KAAK,OAAO;EACZ,KAAK,WAAW,MAAM;EACtB,KAAK,eAAe,MAAM;CAC5B;;;;;;;;CASA,YAAoB;EAClB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,iBAAyB;EACvB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,eAAuB;EACrB,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,eAAuB;EACrB,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,yBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,6BAAqC;EACnC,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,cAAsB;EACpB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,qBAAsC;EACpC,MAAM,UAAU,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;EACtD,MAAM,UAA8C,QAAQ;EAC5D,IAAI,YAAY,KAAA,GACd,OAAO,QAAQ,YAAY;EAE7B,IAAI,YAAY,MAAM;GACpB,IAAI,QAAQ,WAAW,GACrB,MAAM,IAAI,MACR,mFACF;GAEF,OAAO,QAAQ,EAAE,EAAE,MAAM;EAC3B;EACA,OAAO;CACT;;;;;;;;CASA,sBAAkD;EAChD,MAAM,UAAU,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;EACtD,MAAM,UAA8C,QAAQ;EAC5D,IAAI,YAAY,KAAA,GAAW;GACzB,MAAM,iBAAiB,QAAQ,YAAY;GAC3C,OAAO,mBAAmB,OAAO,OAAO,CAAC,cAAc;EACzD;EACA,OAAO,YAAY,OAAO,OAAO,QAAQ,KAAK,WAAW,OAAO,EAAE;CACpE;;;;;;;;CASA,kBAAkB,UAA2C;EAC3D,OAAO,KAAK,WAAW,SAAS,QAAkB;CACpD;;;;;;;CAQA,gBAAgB,UAAoB,OAA6B;EAC/D,KAAK,WAAW,QAAQ,UAAoB,KAAK;CACnD;;;;;;;CAQA,eAAe,UAAoB,OAA6B;EAC9D,KAAK,WAAW,MAAM,UAAoB,KAAK;CACjD;;;;;;;;CASA,sBAAsB,QAAuC;EAC3D,OAAO,KAAK,eAAe,SAAS,MAAM;CAC5C;;;;;;;CAQA,oBAAoB,QAAgB,OAA6B;EAC/D,KAAK,eAAe,QAAQ,QAAQ,KAAK;CAC3C;;;;;;;CAQA,mBAAmB,QAAgB,OAA6B;EAC9D,KAAK,eAAe,MAAM,QAAQ,KAAK;CACzC;;;;;;;;CASA,cAAgD;EAC9C,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,yCAAyC;EACzE,OAAO,KAAK;CACd;AACF"}

package/dist/auth/in-memory.d.cts

@@ -91,6 +91,14 @@ export declare class InMemoryAccountInfo implements AccountInfo {
      * @throws Error if not yet authorized.
      */
     getAllowedBucketId(): BucketId | null;
+    /**
+     * Bucket IDs the key is restricted to, or null if unrestricted.
+     *
+     * @returns The restricted bucket identifiers, or null if the key is unrestricted.
+     *
+     * @throws Error if not yet authorized.
+     */
+    getAllowedBucketIds(): readonly BucketId[] | null;
     /**
      * Take an upload URL from the pool for the given bucket, or null if none available.
      *

package/dist/auth/in-memory.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"in-memory.d.ts","sourceRoot":"","sources":["../../src/auth/in-memory.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGpE;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CAAwC;IACpD,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAM7C;;;;OAIG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI;IAI1C,8DAA8D;IAC9D,KAAK,IAAI,IAAI;IAMb;;;;;;OAMG;IACH,SAAS,IAAI,MAAM;IAInB;;;;;;OAMG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;OAMG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;OAMG;IACH,sBAAsB,IAAI,MAAM;IAIhC;;;;;;OAMG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;;;OAMG;IACH,kBAAkB,IAAI,QAAQ,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;CAIpB"}
+{"version":3,"file":"in-memory.d.ts","sourceRoot":"","sources":["../../src/auth/in-memory.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGpE;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CAAwC;IACpD,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAM7C;;;;OAIG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI;IAI1C,8DAA8D;IAC9D,KAAK,IAAI,IAAI;IAMb;;;;;;OAMG;IACH,SAAS,IAAI,MAAM;IAInB;;;;;;OAMG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;OAMG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;OAMG;IACH,sBAAsB,IAAI,MAAM;IAIhC;;;;;;OAMG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;;;OAMG;IACH,kBAAkB,IAAI,QAAQ,GAAG,IAAI;IAiBrC;;;;;;OAMG;IACH,mBAAmB,IAAI,SAAS,QAAQ,EAAE,GAAG,IAAI;IAUjD;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;CAIpB"}

package/dist/auth/in-memory.d.ts

@@ -91,6 +91,14 @@ export declare class InMemoryAccountInfo implements AccountInfo {
      * @throws Error if not yet authorized.
      */
     getAllowedBucketId(): BucketId | null;
+    /**
+     * Bucket IDs the key is restricted to, or null if unrestricted.
+     *
+     * @returns The restricted bucket identifiers, or null if the key is unrestricted.
+     *
+     * @throws Error if not yet authorized.
+     */
+    getAllowedBucketIds(): readonly BucketId[] | null;
     /**
      * Take an upload URL from the pool for the given bucket, or null if none available.
      *

package/dist/auth/in-memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"in-memory.d.ts","sourceRoot":"","sources":["../../src/auth/in-memory.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGpE;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CAAwC;IACpD,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAM7C;;;;OAIG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI;IAI1C,8DAA8D;IAC9D,KAAK,IAAI,IAAI;IAMb;;;;;;OAMG;IACH,SAAS,IAAI,MAAM;IAInB;;;;;;OAMG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;OAMG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;OAMG;IACH,sBAAsB,IAAI,MAAM;IAIhC;;;;;;OAMG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;;;OAMG;IACH,kBAAkB,IAAI,QAAQ,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;CAIpB"}
+{"version":3,"file":"in-memory.d.ts","sourceRoot":"","sources":["../../src/auth/in-memory.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGpE;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CAAwC;IACpD,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAM7C;;;;OAIG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI;IAI1C,8DAA8D;IAC9D,KAAK,IAAI,IAAI;IAMb;;;;;;OAMG;IACH,SAAS,IAAI,MAAM;IAInB;;;;;;OAMG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;OAMG;IACH,YAAY,IAAI,MAAM;IAItB;;;;;;OAMG;IACH,sBAAsB,IAAI,MAAM;IAIhC;;;;;;OAMG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;;;OAMG;IACH,kBAAkB,IAAI,QAAQ,GAAG,IAAI;IAiBrC;;;;;;OAMG;IACH,mBAAmB,IAAI,SAAS,QAAQ,EAAE,GAAG,IAAI;IAUjD;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIhE;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAI/D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;CAIpB"}