@backblaze-labs/b2-sdk 0.1.0 → 0.2.0

package/dist/auth/in-memory.js

@@ -1,184 +1,213 @@
 import { UploadUrlPool } from "./upload-url-pool.js";
-class InMemoryAccountInfo {
-  /** Cached authorization response, or null before authorize() is called. */
-  auth = null;
-  /** Pool of reusable small-file upload URLs, keyed by bucket ID. */
-  uploadUrls = new UploadUrlPool();
-  /** Pool of reusable large-file part upload URLs, keyed by file ID. */
-  partUploadUrls = new UploadUrlPool();
-  /**
-   * Store a fresh authorization response, replacing any previous state.
-   *
-   * @param auth - The authorize account response to store.
-   */
-  setAuth(auth) {
-    this.auth = auth;
-    this.uploadUrls.clear();
-    this.partUploadUrls.clear();
-  }
-  /**
-   * Return the current authorization response, or null if not authorized.
-   *
-   * @returns The cached authorization response, or null if not yet authorized.
-   */
-  getAuth() {
-    return this.auth;
-  }
-  /** Discard all cached authorization state and upload URLs. */
-  clear() {
-    this.auth = null;
-    this.uploadUrls.clear();
-    this.partUploadUrls.clear();
-  }
-  /**
-   * Base URL for B2 API calls.
-   *
-   * @returns The base URL for B2 API calls.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getApiUrl() {
-    return this.requireAuth().apiInfo.storageApi.apiUrl;
-  }
-  /**
-   * Base URL for file downloads.
-   *
-   * @returns The base URL for file downloads.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getDownloadUrl() {
-    return this.requireAuth().apiInfo.storageApi.downloadUrl;
-  }
-  /**
-   * Current authorization token.
-   *
-   * @returns The current authorization token.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getAuthToken() {
-    return this.requireAuth().authorizationToken;
-  }
-  /**
-   * The authorized account ID.
-   *
-   * @returns The authorized account identifier.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getAccountId() {
-    return this.requireAuth().accountId;
-  }
-  /**
-   * Server-recommended part size for large file uploads, in bytes.
-   *
-   * @returns The server-recommended part size in bytes.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getRecommendedPartSize() {
-    return this.requireAuth().apiInfo.storageApi.recommendedPartSize;
-  }
-  /**
-   * Smallest allowed part size for large file uploads, in bytes.
-   *
-   * @returns The smallest allowed part size in bytes.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getAbsoluteMinimumPartSize() {
-    return this.requireAuth().apiInfo.storageApi.absoluteMinimumPartSize;
-  }
-  /**
-   * Base URL for the S3-compatible API.
-   *
-   * @returns The base URL for the S3-compatible API.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getS3ApiUrl() {
-    return this.requireAuth().apiInfo.storageApi.s3ApiUrl;
-  }
-  /**
-   * Bucket ID the key is restricted to, or null if unrestricted.
-   *
-   * @returns The restricted bucket identifier, or null if the key is unrestricted.
-   *
-   * @throws Error if not yet authorized.
-   */
-  getAllowedBucketId() {
-    return this.requireAuth().apiInfo.storageApi.allowed.bucketId ?? null;
-  }
-  /**
-   * Take an upload URL from the pool for the given bucket, or null if none available.
-   *
-   * @param bucketId - The bucket to check out an upload URL for.
-   *
-   * @returns A reusable upload URL entry, or null if none are available.
-   */
-  checkoutUploadUrl(bucketId) {
-    return this.uploadUrls.checkout(bucketId);
-  }
-  /**
-   * Return a still-valid upload URL to the pool for reuse.
-   *
-   * @param bucketId - The bucket the upload URL belongs to.
-   * @param entry - The upload URL entry to return to the pool.
-   */
-  returnUploadUrl(bucketId, entry) {
-    this.uploadUrls.checkin(bucketId, entry);
-  }
-  /**
-   * Remove an upload URL from the pool after an upload error.
-   *
-   * @param bucketId - The bucket the failed upload URL belongs to.
-   * @param entry - The upload URL entry to remove from the pool.
-   */
-  evictUploadUrl(bucketId, entry) {
-    this.uploadUrls.evict(bucketId, entry);
-  }
-  /**
-   * Take a large-file part upload URL from the pool, or null if none available.
-   *
-   * @param fileId - The large file to check out a part upload URL for.
-   *
-   * @returns A reusable part upload URL entry, or null if none are available.
-   */
-  checkoutPartUploadUrl(fileId) {
-    return this.partUploadUrls.checkout(fileId);
-  }
-  /**
-   * Return a still-valid part upload URL to the pool for reuse.
-   *
-   * @param fileId - The large file the part upload URL belongs to.
-   * @param entry - The part upload URL entry to return to the pool.
-   */
-  returnPartUploadUrl(fileId, entry) {
-    this.partUploadUrls.checkin(fileId, entry);
-  }
-  /**
-   * Remove a part upload URL from the pool after an error.
-   *
-   * @param fileId - The large file the failed part upload URL belongs to.
-   * @param entry - The part upload URL entry to remove from the pool.
-   */
-  evictPartUploadUrl(fileId, entry) {
-    this.partUploadUrls.evict(fileId, entry);
-  }
-  /**
-   * Retrieve the cached auth response or throw if not yet authorized.
-   *
-   * @returns The cached authorization response.
-   *
-   * @throws Error if authorize() has not been called.
-   */
-  requireAuth() {
-    if (!this.auth) throw new Error("Not authorized. Call authorize() first.");
-    return this.auth;
-  }
-}
-export {
-  InMemoryAccountInfo
+//#region src/auth/in-memory.ts
+/**
+* In-memory implementation of {@link AccountInfo}.
+* Stores the authorization response and upload URL pools in plain object fields.
+* Suitable for short-lived processes or tests; state is lost when the process exits.
+*/
+var InMemoryAccountInfo = class {
+	/** Cached authorization response, or null before authorize() is called. */
+	auth = null;
+	/** Pool of reusable small-file upload URLs, keyed by bucket ID. */
+	uploadUrls = new UploadUrlPool();
+	/** Pool of reusable large-file part upload URLs, keyed by file ID. */
+	partUploadUrls = new UploadUrlPool();
+	/**
+	* Store a fresh authorization response, replacing any previous state.
+	*
+	* @param auth - The authorize account response to store.
+	*/
+	setAuth(auth) {
+		this.auth = auth;
+		this.uploadUrls.clear();
+		this.partUploadUrls.clear();
+	}
+	/**
+	* Return the current authorization response, or null if not authorized.
+	*
+	* @returns The cached authorization response, or null if not yet authorized.
+	*/
+	getAuth() {
+		return this.auth;
+	}
+	/** Discard all cached authorization state and upload URLs. */
+	clear() {
+		this.auth = null;
+		this.uploadUrls.clear();
+		this.partUploadUrls.clear();
+	}
+	/**
+	* Base URL for B2 API calls.
+	*
+	* @returns The base URL for B2 API calls.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getApiUrl() {
+		return this.requireAuth().apiInfo.storageApi.apiUrl;
+	}
+	/**
+	* Base URL for file downloads.
+	*
+	* @returns The base URL for file downloads.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getDownloadUrl() {
+		return this.requireAuth().apiInfo.storageApi.downloadUrl;
+	}
+	/**
+	* Current authorization token.
+	*
+	* @returns The current authorization token.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAuthToken() {
+		return this.requireAuth().authorizationToken;
+	}
+	/**
+	* The authorized account ID.
+	*
+	* @returns The authorized account identifier.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAccountId() {
+		return this.requireAuth().accountId;
+	}
+	/**
+	* Server-recommended part size for large file uploads, in bytes.
+	*
+	* @returns The server-recommended part size in bytes.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getRecommendedPartSize() {
+		return this.requireAuth().apiInfo.storageApi.recommendedPartSize;
+	}
+	/**
+	* Smallest allowed part size for large file uploads, in bytes.
+	*
+	* @returns The smallest allowed part size in bytes.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAbsoluteMinimumPartSize() {
+		return this.requireAuth().apiInfo.storageApi.absoluteMinimumPartSize;
+	}
+	/**
+	* Base URL for the S3-compatible API.
+	*
+	* @returns The base URL for the S3-compatible API.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getS3ApiUrl() {
+		return this.requireAuth().apiInfo.storageApi.s3ApiUrl;
+	}
+	/**
+	* Bucket ID the key is restricted to, or null if unrestricted.
+	*
+	* @returns The restricted bucket identifier, or null if the key is unrestricted.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAllowedBucketId() {
+		const allowed = this.requireAuth().apiInfo.storageApi.allowed;
+		const buckets = allowed.buckets;
+		if (buckets === void 0) return allowed.bucketId ?? null;
+		if (buckets !== null) {
+			if (buckets.length !== 1) throw new Error("Authorized key is not restricted to exactly one bucket; use getAllowedBucketIds()");
+			return buckets[0]?.id ?? null;
+		}
+		return null;
+	}
+	/**
+	* Bucket IDs the key is restricted to, or null if unrestricted.
+	*
+	* @returns The restricted bucket identifiers, or null if the key is unrestricted.
+	*
+	* @throws Error if not yet authorized.
+	*/
+	getAllowedBucketIds() {
+		const allowed = this.requireAuth().apiInfo.storageApi.allowed;
+		const buckets = allowed.buckets;
+		if (buckets === void 0) {
+			const legacyBucketId = allowed.bucketId ?? null;
+			return legacyBucketId === null ? null : [legacyBucketId];
+		}
+		return buckets === null ? null : buckets.map((bucket) => bucket.id);
+	}
+	/**
+	* Take an upload URL from the pool for the given bucket, or null if none available.
+	*
+	* @param bucketId - The bucket to check out an upload URL for.
+	*
+	* @returns A reusable upload URL entry, or null if none are available.
+	*/
+	checkoutUploadUrl(bucketId) {
+		return this.uploadUrls.checkout(bucketId);
+	}
+	/**
+	* Return a still-valid upload URL to the pool for reuse.
+	*
+	* @param bucketId - The bucket the upload URL belongs to.
+	* @param entry - The upload URL entry to return to the pool.
+	*/
+	returnUploadUrl(bucketId, entry) {
+		this.uploadUrls.checkin(bucketId, entry);
+	}
+	/**
+	* Remove an upload URL from the pool after an upload error.
+	*
+	* @param bucketId - The bucket the failed upload URL belongs to.
+	* @param entry - The upload URL entry to remove from the pool.
+	*/
+	evictUploadUrl(bucketId, entry) {
+		this.uploadUrls.evict(bucketId, entry);
+	}
+	/**
+	* Take a large-file part upload URL from the pool, or null if none available.
+	*
+	* @param fileId - The large file to check out a part upload URL for.
+	*
+	* @returns A reusable part upload URL entry, or null if none are available.
+	*/
+	checkoutPartUploadUrl(fileId) {
+		return this.partUploadUrls.checkout(fileId);
+	}
+	/**
+	* Return a still-valid part upload URL to the pool for reuse.
+	*
+	* @param fileId - The large file the part upload URL belongs to.
+	* @param entry - The part upload URL entry to return to the pool.
+	*/
+	returnPartUploadUrl(fileId, entry) {
+		this.partUploadUrls.checkin(fileId, entry);
+	}
+	/**
+	* Remove a part upload URL from the pool after an error.
+	*
+	* @param fileId - The large file the failed part upload URL belongs to.
+	* @param entry - The part upload URL entry to remove from the pool.
+	*/
+	evictPartUploadUrl(fileId, entry) {
+		this.partUploadUrls.evict(fileId, entry);
+	}
+	/**
+	* Retrieve the cached auth response or throw if not yet authorized.
+	*
+	* @returns The cached authorization response.
+	*
+	* @throws Error if authorize() has not been called.
+	*/
+	requireAuth() {
+		if (!this.auth) throw new Error("Not authorized. Call authorize() first.");
+		return this.auth;
+	}
 };
-//# sourceMappingURL=in-memory.js.map
+//#endregion
+export { InMemoryAccountInfo };
+
+//# sourceMappingURL=in-memory.js.map

package/dist/auth/in-memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"in-memory.js","sources":["../../src/auth/in-memory.ts"],"sourcesContent":["import type { AuthorizeAccountResponse } from '../types/auth.ts'\nimport type { BucketId } from '../types/ids.ts'\nimport type { AccountInfo, UploadUrlEntry } from './account-info.ts'\nimport { UploadUrlPool } from './upload-url-pool.ts'\n\n/**\n * In-memory implementation of {@link AccountInfo}.\n * Stores the authorization response and upload URL pools in plain object fields.\n * Suitable for short-lived processes or tests; state is lost when the process exits.\n */\nexport class InMemoryAccountInfo implements AccountInfo {\n  /** Cached authorization response, or null before authorize() is called. */\n  private auth: AuthorizeAccountResponse | null = null\n  /** Pool of reusable small-file upload URLs, keyed by bucket ID. */\n  private readonly uploadUrls = new UploadUrlPool()\n  /** Pool of reusable large-file part upload URLs, keyed by file ID. */\n  private readonly partUploadUrls = new UploadUrlPool()\n\n  /**\n   * Store a fresh authorization response, replacing any previous state.\n   *\n   * @param auth - The authorize account response to store.\n   */\n  setAuth(auth: AuthorizeAccountResponse): void {\n    this.auth = auth\n    this.uploadUrls.clear()\n    this.partUploadUrls.clear()\n  }\n\n  /**\n   * Return the current authorization response, or null if not authorized.\n   *\n   * @returns The cached authorization response, or null if not yet authorized.\n   */\n  getAuth(): AuthorizeAccountResponse | null {\n    return this.auth\n  }\n\n  /** Discard all cached authorization state and upload URLs. */\n  clear(): void {\n    this.auth = null\n    this.uploadUrls.clear()\n    this.partUploadUrls.clear()\n  }\n\n  /**\n   * Base URL for B2 API calls.\n   *\n   * @returns The base URL for B2 API calls.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getApiUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.apiUrl\n  }\n\n  /**\n   * Base URL for file downloads.\n   *\n   * @returns The base URL for file downloads.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getDownloadUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.downloadUrl\n  }\n\n  /**\n   * Current authorization token.\n   *\n   * @returns The current authorization token.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAuthToken(): string {\n    return this.requireAuth().authorizationToken as string\n  }\n\n  /**\n   * The authorized account ID.\n   *\n   * @returns The authorized account identifier.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAccountId(): string {\n    return this.requireAuth().accountId as string\n  }\n\n  /**\n   * Server-recommended part size for large file uploads, in bytes.\n   *\n   * @returns The server-recommended part size in bytes.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getRecommendedPartSize(): number {\n    return this.requireAuth().apiInfo.storageApi.recommendedPartSize\n  }\n\n  /**\n   * Smallest allowed part size for large file uploads, in bytes.\n   *\n   * @returns The smallest allowed part size in bytes.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAbsoluteMinimumPartSize(): number {\n    return this.requireAuth().apiInfo.storageApi.absoluteMinimumPartSize\n  }\n\n  /**\n   * Base URL for the S3-compatible API.\n   *\n   * @returns The base URL for the S3-compatible API.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getS3ApiUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.s3ApiUrl\n  }\n\n  /**\n   * Bucket ID the key is restricted to, or null if unrestricted.\n   *\n   * @returns The restricted bucket identifier, or null if the key is unrestricted.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAllowedBucketId(): BucketId | null {\n    return this.requireAuth().apiInfo.storageApi.allowed.bucketId ?? null\n  }\n\n  /**\n   * Take an upload URL from the pool for the given bucket, or null if none available.\n   *\n   * @param bucketId - The bucket to check out an upload URL for.\n   *\n   * @returns A reusable upload URL entry, or null if none are available.\n   */\n  checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null {\n    return this.uploadUrls.checkout(bucketId as string)\n  }\n\n  /**\n   * Return a still-valid upload URL to the pool for reuse.\n   *\n   * @param bucketId - The bucket the upload URL belongs to.\n   * @param entry - The upload URL entry to return to the pool.\n   */\n  returnUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.uploadUrls.checkin(bucketId as string, entry)\n  }\n\n  /**\n   * Remove an upload URL from the pool after an upload error.\n   *\n   * @param bucketId - The bucket the failed upload URL belongs to.\n   * @param entry - The upload URL entry to remove from the pool.\n   */\n  evictUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.uploadUrls.evict(bucketId as string, entry)\n  }\n\n  /**\n   * Take a large-file part upload URL from the pool, or null if none available.\n   *\n   * @param fileId - The large file to check out a part upload URL for.\n   *\n   * @returns A reusable part upload URL entry, or null if none are available.\n   */\n  checkoutPartUploadUrl(fileId: string): UploadUrlEntry | null {\n    return this.partUploadUrls.checkout(fileId)\n  }\n\n  /**\n   * Return a still-valid part upload URL to the pool for reuse.\n   *\n   * @param fileId - The large file the part upload URL belongs to.\n   * @param entry - The part upload URL entry to return to the pool.\n   */\n  returnPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.partUploadUrls.checkin(fileId, entry)\n  }\n\n  /**\n   * Remove a part upload URL from the pool after an error.\n   *\n   * @param fileId - The large file the failed part upload URL belongs to.\n   * @param entry - The part upload URL entry to remove from the pool.\n   */\n  evictPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.partUploadUrls.evict(fileId, entry)\n  }\n\n  /**\n   * Retrieve the cached auth response or throw if not yet authorized.\n   *\n   * @returns The cached authorization response.\n   *\n   * @throws Error if authorize() has not been called.\n   */\n  private requireAuth(): AuthorizeAccountResponse {\n    if (!this.auth) throw new Error('Not authorized. Call authorize() first.')\n    return this.auth\n  }\n}\n"],"names":[],"mappings":";AAUO,MAAM,oBAA2C;AAAA;AAAA,EAE9C,OAAwC;AAAA;AAAA,EAE/B,aAAa,IAAI,cAAA;AAAA;AAAA,EAEjB,iBAAiB,IAAI,cAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,QAAQ,MAAsC;AAC5C,SAAK,OAAO;AACZ,SAAK,WAAW,MAAA;AAChB,SAAK,eAAe,MAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAA2C;AACzC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,OAAO;AACZ,SAAK,WAAW,MAAA;AAChB,SAAK,eAAe,MAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAoB;AAClB,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAyB;AACvB,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAuB;AACrB,WAAO,KAAK,cAAc;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAuB;AACrB,WAAO,KAAK,cAAc;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,yBAAiC;AAC/B,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,6BAAqC;AACnC,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,cAAsB;AACpB,WAAO,KAAK,YAAA,EAAc,QAAQ,WAAW;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,qBAAsC;AACpC,WAAO,KAAK,cAAc,QAAQ,WAAW,QAAQ,YAAY;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,kBAAkB,UAA2C;AAC3D,WAAO,KAAK,WAAW,SAAS,QAAkB;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,UAAoB,OAA6B;AAC/D,SAAK,WAAW,QAAQ,UAAoB,KAAK;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAe,UAAoB,OAA6B;AAC9D,SAAK,WAAW,MAAM,UAAoB,KAAK;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,sBAAsB,QAAuC;AAC3D,WAAO,KAAK,eAAe,SAAS,MAAM;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,oBAAoB,QAAgB,OAA6B;AAC/D,SAAK,eAAe,QAAQ,QAAQ,KAAK;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,mBAAmB,QAAgB,OAA6B;AAC9D,SAAK,eAAe,MAAM,QAAQ,KAAK;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cAAwC;AAC9C,QAAI,CAAC,KAAK,KAAM,OAAM,IAAI,MAAM,yCAAyC;AACzE,WAAO,KAAK;AAAA,EACd;AACF;"}
+{"version":3,"file":"in-memory.js","names":[],"sources":["../../src/auth/in-memory.ts"],"sourcesContent":["import type { AuthorizeAccountResponse } from '../types/auth.ts'\nimport type { BucketId } from '../types/ids.ts'\nimport type { AccountInfo, UploadUrlEntry } from './account-info.ts'\nimport { UploadUrlPool } from './upload-url-pool.ts'\n\n/**\n * In-memory implementation of {@link AccountInfo}.\n * Stores the authorization response and upload URL pools in plain object fields.\n * Suitable for short-lived processes or tests; state is lost when the process exits.\n */\nexport class InMemoryAccountInfo implements AccountInfo {\n  /** Cached authorization response, or null before authorize() is called. */\n  private auth: AuthorizeAccountResponse | null = null\n  /** Pool of reusable small-file upload URLs, keyed by bucket ID. */\n  private readonly uploadUrls = new UploadUrlPool()\n  /** Pool of reusable large-file part upload URLs, keyed by file ID. */\n  private readonly partUploadUrls = new UploadUrlPool()\n\n  /**\n   * Store a fresh authorization response, replacing any previous state.\n   *\n   * @param auth - The authorize account response to store.\n   */\n  setAuth(auth: AuthorizeAccountResponse): void {\n    this.auth = auth\n    this.uploadUrls.clear()\n    this.partUploadUrls.clear()\n  }\n\n  /**\n   * Return the current authorization response, or null if not authorized.\n   *\n   * @returns The cached authorization response, or null if not yet authorized.\n   */\n  getAuth(): AuthorizeAccountResponse | null {\n    return this.auth\n  }\n\n  /** Discard all cached authorization state and upload URLs. */\n  clear(): void {\n    this.auth = null\n    this.uploadUrls.clear()\n    this.partUploadUrls.clear()\n  }\n\n  /**\n   * Base URL for B2 API calls.\n   *\n   * @returns The base URL for B2 API calls.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getApiUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.apiUrl\n  }\n\n  /**\n   * Base URL for file downloads.\n   *\n   * @returns The base URL for file downloads.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getDownloadUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.downloadUrl\n  }\n\n  /**\n   * Current authorization token.\n   *\n   * @returns The current authorization token.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAuthToken(): string {\n    return this.requireAuth().authorizationToken as string\n  }\n\n  /**\n   * The authorized account ID.\n   *\n   * @returns The authorized account identifier.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAccountId(): string {\n    return this.requireAuth().accountId as string\n  }\n\n  /**\n   * Server-recommended part size for large file uploads, in bytes.\n   *\n   * @returns The server-recommended part size in bytes.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getRecommendedPartSize(): number {\n    return this.requireAuth().apiInfo.storageApi.recommendedPartSize\n  }\n\n  /**\n   * Smallest allowed part size for large file uploads, in bytes.\n   *\n   * @returns The smallest allowed part size in bytes.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAbsoluteMinimumPartSize(): number {\n    return this.requireAuth().apiInfo.storageApi.absoluteMinimumPartSize\n  }\n\n  /**\n   * Base URL for the S3-compatible API.\n   *\n   * @returns The base URL for the S3-compatible API.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getS3ApiUrl(): string {\n    return this.requireAuth().apiInfo.storageApi.s3ApiUrl\n  }\n\n  /**\n   * Bucket ID the key is restricted to, or null if unrestricted.\n   *\n   * @returns The restricted bucket identifier, or null if the key is unrestricted.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAllowedBucketId(): BucketId | null {\n    const allowed = this.requireAuth().apiInfo.storageApi.allowed\n    const buckets: typeof allowed.buckets | undefined = allowed.buckets\n    if (buckets === undefined) {\n      return allowed.bucketId ?? null\n    }\n    if (buckets !== null) {\n      if (buckets.length !== 1) {\n        throw new Error(\n          'Authorized key is not restricted to exactly one bucket; use getAllowedBucketIds()',\n        )\n      }\n      return buckets[0]?.id ?? null\n    }\n    return null\n  }\n\n  /**\n   * Bucket IDs the key is restricted to, or null if unrestricted.\n   *\n   * @returns The restricted bucket identifiers, or null if the key is unrestricted.\n   *\n   * @throws Error if not yet authorized.\n   */\n  getAllowedBucketIds(): readonly BucketId[] | null {\n    const allowed = this.requireAuth().apiInfo.storageApi.allowed\n    const buckets: typeof allowed.buckets | undefined = allowed.buckets\n    if (buckets === undefined) {\n      const legacyBucketId = allowed.bucketId ?? null\n      return legacyBucketId === null ? null : [legacyBucketId]\n    }\n    return buckets === null ? null : buckets.map((bucket) => bucket.id)\n  }\n\n  /**\n   * Take an upload URL from the pool for the given bucket, or null if none available.\n   *\n   * @param bucketId - The bucket to check out an upload URL for.\n   *\n   * @returns A reusable upload URL entry, or null if none are available.\n   */\n  checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null {\n    return this.uploadUrls.checkout(bucketId as string)\n  }\n\n  /**\n   * Return a still-valid upload URL to the pool for reuse.\n   *\n   * @param bucketId - The bucket the upload URL belongs to.\n   * @param entry - The upload URL entry to return to the pool.\n   */\n  returnUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.uploadUrls.checkin(bucketId as string, entry)\n  }\n\n  /**\n   * Remove an upload URL from the pool after an upload error.\n   *\n   * @param bucketId - The bucket the failed upload URL belongs to.\n   * @param entry - The upload URL entry to remove from the pool.\n   */\n  evictUploadUrl(bucketId: BucketId, entry: UploadUrlEntry): void {\n    this.uploadUrls.evict(bucketId as string, entry)\n  }\n\n  /**\n   * Take a large-file part upload URL from the pool, or null if none available.\n   *\n   * @param fileId - The large file to check out a part upload URL for.\n   *\n   * @returns A reusable part upload URL entry, or null if none are available.\n   */\n  checkoutPartUploadUrl(fileId: string): UploadUrlEntry | null {\n    return this.partUploadUrls.checkout(fileId)\n  }\n\n  /**\n   * Return a still-valid part upload URL to the pool for reuse.\n   *\n   * @param fileId - The large file the part upload URL belongs to.\n   * @param entry - The part upload URL entry to return to the pool.\n   */\n  returnPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.partUploadUrls.checkin(fileId, entry)\n  }\n\n  /**\n   * Remove a part upload URL from the pool after an error.\n   *\n   * @param fileId - The large file the failed part upload URL belongs to.\n   * @param entry - The part upload URL entry to remove from the pool.\n   */\n  evictPartUploadUrl(fileId: string, entry: UploadUrlEntry): void {\n    this.partUploadUrls.evict(fileId, entry)\n  }\n\n  /**\n   * Retrieve the cached auth response or throw if not yet authorized.\n   *\n   * @returns The cached authorization response.\n   *\n   * @throws Error if authorize() has not been called.\n   */\n  private requireAuth(): AuthorizeAccountResponse {\n    if (!this.auth) throw new Error('Not authorized. Call authorize() first.')\n    return this.auth\n  }\n}\n"],"mappings":";;;;;;;AAUA,IAAa,sBAAb,MAAwD;;CAEtD,OAAgD;;CAEhD,aAA8B,IAAI,cAAc;;CAEhD,iBAAkC,IAAI,cAAc;;;;;;CAOpD,QAAQ,MAAsC;EAC5C,KAAK,OAAO;EACZ,KAAK,WAAW,MAAM;EACtB,KAAK,eAAe,MAAM;CAC5B;;;;;;CAOA,UAA2C;EACzC,OAAO,KAAK;CACd;;CAGA,QAAc;EACZ,KAAK,OAAO;EACZ,KAAK,WAAW,MAAM;EACtB,KAAK,eAAe,MAAM;CAC5B;;;;;;;;CASA,YAAoB;EAClB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,iBAAyB;EACvB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,eAAuB;EACrB,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,eAAuB;EACrB,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,yBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,6BAAqC;EACnC,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,cAAsB;EACpB,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;CAC/C;;;;;;;;CASA,qBAAsC;EACpC,MAAM,UAAU,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;EACtD,MAAM,UAA8C,QAAQ;EAC5D,IAAI,YAAY,KAAA,GACd,OAAO,QAAQ,YAAY;EAE7B,IAAI,YAAY,MAAM;GACpB,IAAI,QAAQ,WAAW,GACrB,MAAM,IAAI,MACR,mFACF;GAEF,OAAO,QAAQ,EAAE,EAAE,MAAM;EAC3B;EACA,OAAO;CACT;;;;;;;;CASA,sBAAkD;EAChD,MAAM,UAAU,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW;EACtD,MAAM,UAA8C,QAAQ;EAC5D,IAAI,YAAY,KAAA,GAAW;GACzB,MAAM,iBAAiB,QAAQ,YAAY;GAC3C,OAAO,mBAAmB,OAAO,OAAO,CAAC,cAAc;EACzD;EACA,OAAO,YAAY,OAAO,OAAO,QAAQ,KAAK,WAAW,OAAO,EAAE;CACpE;;;;;;;;CASA,kBAAkB,UAA2C;EAC3D,OAAO,KAAK,WAAW,SAAS,QAAkB;CACpD;;;;;;;CAQA,gBAAgB,UAAoB,OAA6B;EAC/D,KAAK,WAAW,QAAQ,UAAoB,KAAK;CACnD;;;;;;;CAQA,eAAe,UAAoB,OAA6B;EAC9D,KAAK,WAAW,MAAM,UAAoB,KAAK;CACjD;;;;;;;;CASA,sBAAsB,QAAuC;EAC3D,OAAO,KAAK,eAAe,SAAS,MAAM;CAC5C;;;;;;;CAQA,oBAAoB,QAAgB,OAA6B;EAC/D,KAAK,eAAe,QAAQ,QAAQ,KAAK;CAC3C;;;;;;;CAQA,mBAAmB,QAAgB,OAA6B;EAC9D,KAAK,eAAe,MAAM,QAAQ,KAAK;CACzC;;;;;;;;CASA,cAAgD;EAC9C,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,yCAAyC;EACzE,OAAO,KAAK;CACd;AACF"}

package/dist/auth/index.cjs

@@ -1,10 +1,8 @@
-"use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const inMemory = require("./in-memory.cjs");
-const uploadUrlPool = require("./upload-url-pool.cjs");
-const realms = require("./realms.cjs");
-exports.InMemoryAccountInfo = inMemory.InMemoryAccountInfo;
-exports.UploadUrlPool = uploadUrlPool.UploadUrlPool;
-exports.REALM_URLS = realms.REALM_URLS;
-exports.getRealmUrl = realms.getRealmUrl;
-//# sourceMappingURL=index.cjs.map
+const require_upload_url_pool = require("./upload-url-pool.cjs");
+const require_in_memory = require("./in-memory.cjs");
+const require_realms = require("./realms.cjs");
+exports.InMemoryAccountInfo = require_in_memory.InMemoryAccountInfo;
+exports.REALM_URLS = require_realms.REALM_URLS;
+exports.UploadUrlPool = require_upload_url_pool.UploadUrlPool;
+exports.getRealmUrl = require_realms.getRealmUrl;

package/dist/auth/index.d.cts

@@ -1,6 +1,7 @@
 /** @packageDocumentation */
-export type { AccountInfo, UploadUrlEntry } from './account-info.js';
+export type { AccountInfo, AuthContextAwareAccountInfo, UploadUrlEntry } from './account-info.js';
 export { InMemoryAccountInfo } from './in-memory.js';
-export { UploadUrlPool } from './upload-url-pool.js';
+export type { RealmName } from './realms.js';
 export { getRealmUrl, REALM_URLS } from './realms.js';
+export { UploadUrlPool } from './upload-url-pool.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.js"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.js"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,YAAY,EAAE,WAAW,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/auth/index.d.ts

@@ -1,6 +1,7 @@
 /** @packageDocumentation */
-export type { AccountInfo, UploadUrlEntry } from './account-info.js';
+export type { AccountInfo, AuthContextAwareAccountInfo, UploadUrlEntry } from './account-info.js';
 export { InMemoryAccountInfo } from './in-memory.js';
-export { UploadUrlPool } from './upload-url-pool.js';
+export type { RealmName } from './realms.js';
 export { getRealmUrl, REALM_URLS } from './realms.js';
+export { UploadUrlPool } from './upload-url-pool.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.js"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.js"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,YAAY,EAAE,WAAW,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/auth/index.js

@@ -1,10 +1,4 @@
-import { InMemoryAccountInfo } from "./in-memory.js";
 import { UploadUrlPool } from "./upload-url-pool.js";
+import { InMemoryAccountInfo } from "./in-memory.js";
 import { REALM_URLS, getRealmUrl } from "./realms.js";
-export {
-  InMemoryAccountInfo,
-  REALM_URLS,
-  UploadUrlPool,
-  getRealmUrl
-};
-//# sourceMappingURL=index.js.map
+export { InMemoryAccountInfo, REALM_URLS, UploadUrlPool, getRealmUrl };

package/dist/auth/realms.cjs

@@ -1,12 +1,85 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const REALM_URLS = {
-  production: "https://api.backblazeb2.com",
-  staging: "https://api.backblazeb2.com"
+const require_url_redaction = require("../internal/url-redaction.cjs");
+const require_errors_index = require("../errors/index.cjs");
+//#region src/auth/realms.ts
+var VERIFIED_REALM_URLS = {
+	/** Public production B2 Native API authorize endpoint. */
+	production: "https://api.backblazeb2.com",
+	/** Backblaze staging authorize endpoint from the official Python SDK realm map. */
+	staging: "https://api.backblaze.net"
 };
+/**
+* Built-in realm aliases to their `b2_authorize_account` base API URLs.
+* The object remains a mutable `Record<string, string>` for source
+* compatibility with earlier SDK versions that let applications add local
+* aliases. SDK internals validate only the built-in aliases in
+* `VERIFIED_REALM_URLS`; pass direct custom realm URLs to `B2Client` instead
+* of relying on mutation for new code.
+*/
+var REALM_URLS = { ...VERIFIED_REALM_URLS };
+var HTTP_REALM_URL_WITH_HOST = /^https?:\/\/[^/?#]/i;
+function parseAbsoluteRealmUrl(realmUrl) {
+	try {
+		return new URL(realmUrl);
+	} catch {
+		return null;
+	}
+}
+function realmUrlForError(realmUrl, url = parseAbsoluteRealmUrl(realmUrl)) {
+	return require_url_redaction.redactUrlForError(url ?? realmUrl, { invalidUrlLabel: "<invalid realm URL>" });
+}
+function isLoopbackHost(hostname) {
+	const host = hostname.toLowerCase();
+	if (host === "[::1]" || host === "::1") return true;
+	const parts = host.split(".");
+	return parts.length === 4 && parts[0] === "127" && parts.every((part) => /^\d+$/.test(part) && Number(part) <= 255);
+}
+function assertAuthorizableRealmScheme(realmUrl, url) {
+	if ((url.protocol === "https:" || url.protocol === "http:") && (!HTTP_REALM_URL_WITH_HOST.test(realmUrl) || url.hostname === "")) throw new require_errors_index.B2RealmConfigurationError(`realm URL must be an absolute HTTP(S) URL with a hostname for authorization: ${realmUrlForError(realmUrl, url)}`);
+	if (url.protocol === "https:") return;
+	if (url.protocol === "http:" && isLoopbackHost(url.hostname)) return;
+	if (url.protocol === "http:") throw new require_errors_index.B2RealmConfigurationError(`refusing to send credentials over plaintext HTTP realm: ${realmUrlForError(realmUrl, url)}`);
+	throw new require_errors_index.B2RealmConfigurationError(`realm URL must use HTTPS or loopback IP HTTP for authorization: ${realmUrlForError(realmUrl, url)}`);
+}
+function assertRealmBaseUrl(realmUrl, url) {
+	if (url.username === "" && url.password === "" && url.search === "" && url.hash === "") return;
+	throw new require_errors_index.B2RealmConfigurationError(`realm URL must not include credentials, query, or fragment for authorization: ${realmUrlForError(realmUrl, url)}`);
+}
+/**
+* Validate a realm URL before it is used for credential-bearing authorization.
+* Any accepted custom HTTPS host receives the application key during authorize;
+* do not derive custom realm URLs from untrusted input. Realm URLs must be base
+* URLs without userinfo, query strings, or fragments.
+*
+* @param realmUrl - The resolved realm URL to validate.
+*
+* @throws B2RealmConfigurationError when the realm URL is not absolute, is not
+* a base URL, uses an unsupported scheme, or uses non-loopback plaintext HTTP.
+* Loopback IP HTTP is accepted only for local testing and sends the application
+* key unencrypted to whichever process is listening on that address and port.
+*/
+function assertSecureRealmUrl(realmUrl) {
+	const url = parseAbsoluteRealmUrl(realmUrl);
+	if (url === null) throw new require_errors_index.B2RealmConfigurationError(`realm URL must be absolute for authorization: ${realmUrlForError(realmUrl, url)}`);
+	assertRealmBaseUrl(realmUrl, url);
+	assertAuthorizableRealmScheme(realmUrl, url);
+}
+function isRealmName(realm) {
+	return Object.hasOwn(VERIFIED_REALM_URLS, realm);
+}
+/**
+* Resolve a realm name to its base API URL. Unknown strings are returned
+* unchanged so callers can resolve custom aliases before authorization.
+*
+* @param realm - The realm name or direct URL to resolve.
+*
+* @returns The mapped base API URL for a known realm, otherwise `realm`.
+*/
 function getRealmUrl(realm) {
-  return REALM_URLS[realm] ?? realm;
+	return isRealmName(realm) ? VERIFIED_REALM_URLS[realm] : realm;
 }
+//#endregion
 exports.REALM_URLS = REALM_URLS;
+exports.assertSecureRealmUrl = assertSecureRealmUrl;
 exports.getRealmUrl = getRealmUrl;
-//# sourceMappingURL=realms.cjs.map
+
+//# sourceMappingURL=realms.cjs.map

package/dist/auth/realms.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"realms.cjs","sources":["../../src/auth/realms.ts"],"sourcesContent":["/** Map of known realm names to their base API URLs. */\nexport const REALM_URLS: Record<string, string> = {\n  production: 'https://api.backblazeb2.com',\n  staging: 'https://api.backblazeb2.com',\n}\n\n/**\n * Resolve a realm name to its base API URL.\n * If the realm is not a known name, it is returned as-is (assumed to be a URL).\n *\n * @param realm - The realm name or direct URL to resolve.\n *\n * @returns The base API URL for the given realm.\n */\nexport function getRealmUrl(realm: string): string {\n  return REALM_URLS[realm] ?? realm\n}\n"],"names":[],"mappings":";;AACO,MAAM,aAAqC;AAAA,EAChD,YAAY;AAAA,EACZ,SAAS;AACX;AAUO,SAAS,YAAY,OAAuB;AACjD,SAAO,WAAW,KAAK,KAAK;AAC9B;;;"}
+{"version":3,"file":"realms.cjs","names":[],"sources":["../../src/auth/realms.ts"],"sourcesContent":["import { B2RealmConfigurationError } from '../errors/index.ts'\nimport { redactUrlForError } from '../internal/url-redaction.ts'\n\n/** Name of a verified built-in auth realm alias. */\nexport type RealmName = 'production' | 'staging'\n\nconst VERIFIED_REALM_URLS = {\n  /** Public production B2 Native API authorize endpoint. */\n  production: 'https://api.backblazeb2.com',\n  /** Backblaze staging authorize endpoint from the official Python SDK realm map. */\n  staging: 'https://api.backblaze.net',\n} as const satisfies Record<RealmName, string>\n\n/**\n * Built-in realm aliases to their `b2_authorize_account` base API URLs.\n * The object remains a mutable `Record<string, string>` for source\n * compatibility with earlier SDK versions that let applications add local\n * aliases. SDK internals validate only the built-in aliases in\n * `VERIFIED_REALM_URLS`; pass direct custom realm URLs to `B2Client` instead\n * of relying on mutation for new code.\n */\nexport const REALM_URLS: Record<string, string> = { ...VERIFIED_REALM_URLS }\n\n// `new URL('https:example.com')` normalizes to `https://example.com/`;\n// require the raw URL to use authority syntax before credentials are sent.\nconst HTTP_REALM_URL_WITH_HOST = /^https?:\\/\\/[^/?#]/i\n\nfunction parseAbsoluteRealmUrl(realmUrl: string): URL | null {\n  try {\n    return new URL(realmUrl)\n  } catch {\n    return null\n  }\n}\n\nfunction realmUrlForError(realmUrl: string, url = parseAbsoluteRealmUrl(realmUrl)): string {\n  return redactUrlForError(url ?? realmUrl, { invalidUrlLabel: '<invalid realm URL>' })\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase()\n  if (host === '[::1]' || host === '::1') return true\n\n  // Intentionally excludes `localhost`: it is resolver-controlled, while this\n  // gate decides whether application-key credentials may be sent over HTTP.\n  const parts = host.split('.')\n  return (\n    parts.length === 4 &&\n    parts[0] === '127' &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  )\n}\n\nfunction assertAuthorizableRealmScheme(realmUrl: string, url: URL): void {\n  if (\n    (url.protocol === 'https:' || url.protocol === 'http:') &&\n    (!HTTP_REALM_URL_WITH_HOST.test(realmUrl) || url.hostname === '')\n  ) {\n    throw new B2RealmConfigurationError(\n      `realm URL must be an absolute HTTP(S) URL with a hostname for authorization: ${realmUrlForError(realmUrl, url)}`,\n    )\n  }\n  if (url.protocol === 'https:') return\n  if (url.protocol === 'http:' && isLoopbackHost(url.hostname)) return\n  if (url.protocol === 'http:') {\n    throw new B2RealmConfigurationError(\n      `refusing to send credentials over plaintext HTTP realm: ${realmUrlForError(realmUrl, url)}`,\n    )\n  }\n  throw new B2RealmConfigurationError(\n    `realm URL must use HTTPS or loopback IP HTTP for authorization: ${realmUrlForError(realmUrl, url)}`,\n  )\n}\n\nfunction assertRealmBaseUrl(realmUrl: string, url: URL): void {\n  if (url.username === '' && url.password === '' && url.search === '' && url.hash === '') return\n  throw new B2RealmConfigurationError(\n    `realm URL must not include credentials, query, or fragment for authorization: ${realmUrlForError(realmUrl, url)}`,\n  )\n}\n\n/**\n * Validate a realm URL before it is used for credential-bearing authorization.\n * Any accepted custom HTTPS host receives the application key during authorize;\n * do not derive custom realm URLs from untrusted input. Realm URLs must be base\n * URLs without userinfo, query strings, or fragments.\n *\n * @param realmUrl - The resolved realm URL to validate.\n *\n * @throws B2RealmConfigurationError when the realm URL is not absolute, is not\n * a base URL, uses an unsupported scheme, or uses non-loopback plaintext HTTP.\n * Loopback IP HTTP is accepted only for local testing and sends the application\n * key unencrypted to whichever process is listening on that address and port.\n */\nexport function assertSecureRealmUrl(realmUrl: string): void {\n  const url = parseAbsoluteRealmUrl(realmUrl)\n  if (url === null) {\n    throw new B2RealmConfigurationError(\n      `realm URL must be absolute for authorization: ${realmUrlForError(realmUrl, url)}`,\n    )\n  }\n\n  assertRealmBaseUrl(realmUrl, url)\n  assertAuthorizableRealmScheme(realmUrl, url)\n}\n\nfunction isRealmName(realm: string): realm is RealmName {\n  return Object.hasOwn(VERIFIED_REALM_URLS, realm)\n}\n\n/**\n * Resolve a realm name to its base API URL. Unknown strings are returned\n * unchanged so callers can resolve custom aliases before authorization.\n *\n * @param realm - The realm name or direct URL to resolve.\n *\n * @returns The mapped base API URL for a known realm, otherwise `realm`.\n */\nexport function getRealmUrl(realm: string): string {\n  return isRealmName(realm) ? VERIFIED_REALM_URLS[realm] : realm\n}\n"],"mappings":";;;AAMA,IAAM,sBAAsB;;CAE1B,YAAY;;CAEZ,SAAS;AACX;;;;;;;;;AAUA,IAAa,aAAqC,EAAE,GAAG,oBAAoB;AAI3E,IAAM,2BAA2B;AAEjC,SAAS,sBAAsB,UAA8B;CAC3D,IAAI;EACF,OAAO,IAAI,IAAI,QAAQ;CACzB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,iBAAiB,UAAkB,MAAM,sBAAsB,QAAQ,GAAW;CACzF,OAAO,sBAAA,kBAAkB,OAAO,UAAU,EAAE,iBAAiB,sBAAsB,CAAC;AACtF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,OAAO,SAAS,YAAY;CAClC,IAAI,SAAS,WAAW,SAAS,OAAO,OAAO;CAI/C,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,OACE,MAAM,WAAW,KACjB,MAAM,OAAO,SACb,MAAM,OAAO,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG;AAEnE;AAEA,SAAS,8BAA8B,UAAkB,KAAgB;CACvE,KACG,IAAI,aAAa,YAAY,IAAI,aAAa,aAC9C,CAAC,yBAAyB,KAAK,QAAQ,KAAK,IAAI,aAAa,KAE9D,MAAM,IAAI,qBAAA,0BACR,gFAAgF,iBAAiB,UAAU,GAAG,GAChH;CAEF,IAAI,IAAI,aAAa,UAAU;CAC/B,IAAI,IAAI,aAAa,WAAW,eAAe,IAAI,QAAQ,GAAG;CAC9D,IAAI,IAAI,aAAa,SACnB,MAAM,IAAI,qBAAA,0BACR,2DAA2D,iBAAiB,UAAU,GAAG,GAC3F;CAEF,MAAM,IAAI,qBAAA,0BACR,mEAAmE,iBAAiB,UAAU,GAAG,GACnG;AACF;AAEA,SAAS,mBAAmB,UAAkB,KAAgB;CAC5D,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,WAAW,MAAM,IAAI,SAAS,IAAI;CACxF,MAAM,IAAI,qBAAA,0BACR,iFAAiF,iBAAiB,UAAU,GAAG,GACjH;AACF;;;;;;;;;;;;;;AAeA,SAAgB,qBAAqB,UAAwB;CAC3D,MAAM,MAAM,sBAAsB,QAAQ;CAC1C,IAAI,QAAQ,MACV,MAAM,IAAI,qBAAA,0BACR,iDAAiD,iBAAiB,UAAU,GAAG,GACjF;CAGF,mBAAmB,UAAU,GAAG;CAChC,8BAA8B,UAAU,GAAG;AAC7C;AAEA,SAAS,YAAY,OAAmC;CACtD,OAAO,OAAO,OAAO,qBAAqB,KAAK;AACjD;;;;;;;;;AAUA,SAAgB,YAAY,OAAuB;CACjD,OAAO,YAAY,KAAK,IAAI,oBAAoB,SAAS;AAC3D"}