@backblaze-labs/b2-sdk 0.1.0 → 0.2.0

package/dist/sync/types.d.ts

@@ -1,11 +1,97 @@
 import { EncryptionSetting } from '../types/encryption.js';
 import { FileVersion } from '../types/file.js';
-/** Strategy for comparing source and destination files: by modification time, size, or skip comparison. */
-export type CompareMode = 'modtime' | 'size' | 'none';
+import { SyncSha1State } from './sha1-metadata.js';
+/**
+ * Strategy for comparing source and destination files.
+ *
+ * The `sha1` mode compares 40-character hexadecimal SHA-1 digests as a practical drift
+ * detector. Digest case is normalized before comparison. Missing, null, unavailable, or
+ * non-verifiable metadata cannot prove equality: the high-level synchronizer either transfers
+ * conservatively for untrusted metadata or skips action generation with a surfaced event when a
+ * B2 file has no comparable digest. Untrusted B2 metadata may require downloading the selected
+ * B2 version to hash its bytes before equality can be trusted. This is not a cryptographic
+ * integrity or tamper-proofing guarantee, because SHA-1 collisions are possible.
+ */
+export type CompareMode = 'modtime' | 'size' | 'sha1' | 'none';
 /** Strategy for handling destination files not present in the source. */
 export type KeepMode = 'no-delete' | 'delete' | 'keep-days';
 /** Direction of a sync operation. */
 export type SyncDirection = 'local-to-b2' | 'b2-to-local' | 'b2-to-b2';
+/**
+ * Glob string or regular expression used to include or exclude sync paths.
+ *
+ * Glob strings use a small SDK-defined dialect against folder-relative paths with forward
+ * slashes: `*` and `?` match within one path segment, and a path segment that is exactly `**`
+ * matches across directory boundaries. Character classes, brace expansion, extglobs, and
+ * backslash escaping are not supported. Slash-less globs use basename-style matching at any
+ * directory depth, so `*.tmp` matches `nested/file.tmp` and `readme.md` matches both `readme.md`
+ * and `docs/readme.md`. They also match ancestor directory names, so `node_modules` matches every
+ * file under a `node_modules` directory. Exclude filters win over include filters.
+ *
+ * Regular expressions are matched against the full relative path. Global and sticky flags are
+ * ignored so matching does not mutate `lastIndex`. RegExp acceptance is a best-effort safety
+ * heuristic for synchronous matching, and the exact accepted subset may change as the SDK tightens
+ * protection. Current guards reject overly long sources, backreferences, multiple unbounded
+ * quantifiers, large or excessive bounded quantifiers, and quantified groups whose subtree
+ * contains a quantifier or alternation.
+ * When any RegExp filter is configured, paths longer than the SDK's RegExp input guard are skipped
+ * instead of being fed to the JavaScript RegExp engine. This is fail-closed for deny-lists: an
+ * untestable long path is not allowed through an exclude RegExp filter.
+ */
+export type SyncFilterPattern = string | RegExp;
+/**
+ * Include/exclude filters applied to sync paths relative to each folder root.
+ *
+ * `SyncOptions.include` and `SyncOptions.exclude` are the canonical filters for
+ * {@link synchronize}; they are passed down into folder scans and then enforced again during
+ * pairing as the SDK policy boundary. Calling
+ * {@link SyncFolder.scan} directly can pass the same filter object for standalone scans.
+ */
+export interface SyncFilterOptions {
+    /**
+     * Optional allow-list. When present, only paths matching at least one pattern are scanned.
+     * B2 scans can push down only the safe literal prefix from slash-containing glob includes;
+     * other include filtering is client-side.
+     */
+    readonly include?: readonly SyncFilterPattern[];
+    /**
+     * Optional deny-list. Paths matching any exclude pattern are skipped even when they also match
+     * an include pattern. Excludes are client-side filters; they do not reduce B2 list API calls or
+     * the B2 scanner's version grouping and sort memory.
+     */
+    readonly exclude?: readonly SyncFilterPattern[];
+}
+/**
+ * Options accepted by {@link SyncFolder.scan}. Includes filters plus an optional scan-level
+ * callback for paths the scanner cannot safely represent or test.
+ */
+export interface SyncScanOptions extends SyncFilterOptions {
+    /**
+     * Optional signal checked by built-in scanners while enumerating. Aborting stops local traversal
+     * promptly and stops B2 scans before requesting the next page.
+     */
+    readonly signal?: AbortSignal;
+    /**
+     * Receives scan diagnostics. Built-in scanners may continue after recoverable per-path
+     * diagnostics, such as unreadable local children, but fatal scan failures still abort.
+     */
+    readonly onError?: (event: SyncErrorEvent) => void;
+    /**
+     * Receives scanner skip diagnostics. Built-in scans isolate callback errors so diagnostics
+     * handlers cannot abort the scan.
+     */
+    readonly onSkip?: (event: SyncSkipEvent) => void;
+    /**
+     * When true, B2 scanners skip names that cannot be written safely to a local filesystem
+     * destination and reject case/Unicode-canonical local path collisions.
+     */
+    readonly requireLocalSafePaths?: boolean;
+    /**
+     * Maximum number of entries a scanner may retain before failing with a defined error instead of
+     * continuing toward unbounded heap growth. Defaults to the SDK scan limit.
+     */
+    readonly maxScanEntries?: number;
+}
 /** Common metadata for a file discovered during a folder scan. */
 export interface SyncPath {
     /** Path relative to the sync folder root, using forward slashes. */
@@ -14,11 +100,51 @@ export interface SyncPath {
     readonly modTimeMillis: number;
     /** File size in bytes. */
     readonly size: number;
+    /**
+     * SHA-1 checksum state for compare modes that need content hashes.
+     *
+     * - `undefined`: not computed yet; the synchronizer may hash local files before comparing.
+     * - `null`: known to be unavailable; `sha1` sync skips the pair with a surfaced event.
+     * - 40-character hex string: known verifiable digest.
+     * - other string: untrusted provider metadata such as B2's `unverified:<hex>` sentinel;
+     *   consumers must not treat it as proof that bytes match. The `sha1` synchronizer must
+     *   verify untrusted B2 bytes before using them for equality, or transfer conservatively.
+     *
+     * Use `parseSyncContentSha1`, `selectB2ComparableSha1`, and `untrustedSha1` from the sync
+     * entrypoint to construct or inspect this field without depending on sentinel strings.
+     */
+    readonly contentSha1?: string | null;
+    /**
+     * Explicit SHA-1 trust and availability state. Prefer this field for custom
+     * scanners that can distinguish verified digests from untrusted provider
+     * metadata without relying on `contentSha1` sentinel strings. When omitted,
+     * the synchronizer derives the state from `contentSha1` for compatibility.
+     */
+    readonly contentSha1State?: SyncSha1State;
+}
+/** Filesystem identity captured while scanning a local file. */
+export interface LocalFileIdentity {
+    /** Device ID from the local filesystem. */
+    readonly deviceId: number;
+    /** Inode number from the local filesystem. */
+    readonly inode: number;
+    /** Size observed during the scan. */
+    readonly size: number;
+    /** Modification time observed during the scan, floored to milliseconds. */
+    readonly modTimeMillis: number;
+    /**
+     * Node `Stats.ctimeMs` observed during the scan, floored to milliseconds.
+     * This is inode-change time on POSIX and may be creation time on Windows.
+     * Built-in local scans populate this; custom scanners may omit it.
+     */
+    readonly changeTimeMillis?: number;
 }
 /** A file on the local filesystem discovered during a scan. */
 export interface LocalSyncPath extends SyncPath {
     /** Absolute filesystem path to the file. */
     readonly absolutePath: string;
+    /** Optional filesystem identity used to reject scan-to-read races. */
+    readonly fileIdentity?: LocalFileIdentity;
 }
 /** A file in a B2 bucket discovered during a scan. */
 export interface B2SyncPath extends SyncPath {
@@ -30,13 +156,15 @@ export interface B2SyncPath extends SyncPath {
 /** Discriminated event types emitted during synchronization. */
 export type SyncEventType = 'upload-start' | 'upload-done' | 'download-start' | 'download-done' | 'copy-start' | 'copy-done' | 'hide' | 'delete-remote' | 'delete-local' | 'skip' | 'error' | 'compare';
 /**
- * Action event types: per-file outcomes (transfer / metadata change /
- * skip) that always carry a `path` and a `size`. These never carry a
- * `message` because the type tag already says what happened.
+ * Action event types: per-file transfer or metadata-change outcomes that
+ * always carry a `path` and a `size`. Skips are reported separately as
+ * {@link SyncSkipEvent} because they carry a diagnostic `message`.
  */
-export type SyncActionEventType = 'upload-start' | 'upload-done' | 'download-start' | 'download-done' | 'copy-start' | 'copy-done' | 'hide' | 'delete-remote' | 'delete-local' | 'compare';
+export type SyncActionEventType = 'upload-start' | 'upload-done' | 'download-start' | 'download-done' | 'copy-start' | 'copy-done' | 'hide' | 'delete-remote' | 'delete-local';
+/** Machine-readable reasons emitted with scanner and diagnostic skip events. */
+export type SyncSkipReason = 'outside-prefix' | 'unsafe-name' | 'local-unsafe-name' | 'relative-path-collision' | 'local-path-collision' | 'filesystem-error' | 'path-too-long-for-regexp' | 'scan-skip-overflow' | 'stale-download-partial';
 /**
- * Per-action progress event (transfer, metadata change, comparison). All
+ * Per-action progress event (transfer or metadata change). All
  * action-event variants share the same shape; the `type` tag distinguishes
  * them.
  */
@@ -45,9 +173,22 @@ export interface SyncActionEvent {
     readonly type: SyncActionEventType;
     /** Relative path of the file this event concerns. */
     readonly path: string;
-    /** Size in bytes of the file involved, or 0 for metadata-only events. */
+    /** Size in bytes of the file involved, or `0` for metadata-only actions. */
     readonly size: number;
 }
+/** Per-file comparison progress event. */
+export interface SyncCompareEvent {
+    /** Discriminant tag (always the literal string `'compare'`). */
+    readonly type: 'compare';
+    /** Relative path of the compared file. */
+    readonly path: string;
+    /** Reserved for compatibility with earlier metadata-only compare events. */
+    readonly size: 0;
+    /** Local file bytes hashed while preparing this comparison, if any. */
+    readonly bytesHashed?: number;
+    /** B2 bytes downloaded and hashed while verifying untrusted SHA-1 metadata, if any. */
+    readonly bytesVerified?: number;
+}
 /**
  * `skip` event — a destination-only file that policy decided to keep, or
  * a same-on-both file that didn't need transfer. Always carries a
@@ -56,12 +197,16 @@ export interface SyncActionEvent {
 export interface SyncSkipEvent {
     /** Discriminant tag (always the literal string `'skip'`). */
     readonly type: 'skip';
-    /** Relative path of the skipped file. */
+    /** Relative path of the skipped file, or the raw B2 key when no safe relative path exists. */
     readonly path: string;
     /** Size in bytes of the file involved, always 0 for skip events. */
     readonly size: number;
     /** Human-readable reason for skipping this file. */
     readonly message: string;
+    /** Machine-readable skip reason when emitted by a scanner or diagnostic buffer. */
+    readonly reason?: SyncSkipReason;
+    /** Original B2 key when the skip came from a B2 scan. */
+    readonly b2FileName?: string;
 }
 /**
  * `error` event — an action threw or the engine encountered a fatal
@@ -77,6 +222,12 @@ export interface SyncErrorEvent {
     readonly size: number;
     /** Human-readable error message; never empty. */
     readonly message: string;
+    /** Number of failed actions represented by an aggregate run-level error event. */
+    readonly failureCount?: number;
+    /** Bounded distinct relative paths of failed actions represented by an aggregate error event. */
+    readonly failedPaths?: readonly string[];
+    /** Number of failed action paths omitted from a bounded aggregate error event. */
+    readonly failedPathOmittedCount?: number;
 }
 /**
  * An event emitted by the sync engine to report progress, skip
@@ -84,23 +235,45 @@ export interface SyncErrorEvent {
  * `case 'error':` (or `'skip':`) to narrow into a variant with `message`
  * guaranteed non-optional.
  */
-export type SyncEvent = SyncActionEvent | SyncSkipEvent | SyncErrorEvent;
+export type SyncEvent = SyncActionEvent | SyncCompareEvent | SyncSkipEvent | SyncErrorEvent;
 /** Configuration options for a sync operation. */
-export interface SyncOptions {
+export interface SyncOptions extends SyncFilterOptions {
     /** How to decide whether two files differ. */
     readonly compareMode: CompareMode;
     /** What to do with destination files absent from the source. */
     readonly keepMode: KeepMode;
     /** Number of days to retain orphaned destination files when keepMode is 'keep-days'. */
     readonly keepDays?: number;
-    /** Maximum number of concurrent transfer actions. Defaults to 4. */
+    /** Maximum number of concurrent transfer actions. Must be a positive integer. Defaults to 4. */
     readonly concurrency?: number;
     /** When true, actions are generated but not executed. */
     readonly dryRun?: boolean;
     /** Tolerance for comparison (bytes for size, milliseconds for modtime). */
     readonly compareThreshold?: number;
-    /** Signal to abort the sync operation. */
+    /** Signal to abort the sync operation, including scans and in-progress SHA-1 reads. */
     readonly signal?: AbortSignal;
+    /** Optional idle/no-progress timeout in milliseconds for SHA-1 reads in `sha1` mode. */
+    readonly sha1ReadTimeoutMillis?: number;
+    /**
+     * Optional absolute deadline in milliseconds for untrusted B2 SHA-1 verification reads.
+     * Objects that cannot be fully verified before this deadline are skipped for that run.
+     */
+    readonly sha1VerificationTimeoutMillis?: number;
+    /**
+     * Optional per-file byte ceiling for untrusted B2 SHA-1 verification reads.
+     *
+     * By default, verifying untrusted B2 metadata may download the selected version's full
+     * `contentLength` each run. Set this to a lower value to skip objects above the per-file
+     * budget before they can be treated as equal.
+     */
+    readonly sha1VerificationMaxBytes?: number;
+    /**
+     * Idle timeout in milliseconds for B2-to-local download body reads. Must be positive, or
+     * `Infinity` to disable the timeout. Defaults to 60 seconds.
+     */
+    readonly downloadIdleTimeoutMillis?: number;
+    /** Maximum scanner entries retained before failing with a defined scan-limit error. */
+    readonly maxScanEntries?: number;
     /** Optional provider for per-file encryption settings. */
     readonly encryptionProvider?: SyncEncryptionProvider;
 }
@@ -111,11 +284,30 @@ export interface SyncEncryptionProvider {
     /** Returns the encryption setting to use when downloading a file, or undefined for default. */
     getSettingForDownload(fileVersion: FileVersion): EncryptionSetting | undefined;
 }
-/** A scannable folder (local or B2) that yields files in sorted order. */
+/**
+ * A scannable folder (local or B2) that yields files relative to its sync root.
+ *
+ * Built-in scanners currently sort before yielding. Large local trees or B2 prefixes may therefore
+ * require memory proportional to the scanned entries; B2 scans also group listed versions before
+ * yielding. For B2, `maxScanEntries` counts every listed file version before prefix, safety, and
+ * filter checks, and exclude filters or non-literal includes do not bound B2 listing calls.
+ */
 export interface SyncFolder {
     /** Whether this folder is local or in B2. */
     readonly type: 'local' | 'b2';
-    /** Scans the folder and yields files sorted by relative path. */
-    scan(): AsyncIterable<SyncPath>;
+    /**
+     * True when `scan(filters)` already enforces include/exclude filters itself as an optimization.
+     * The synchronizer still reapplies filters after custom scanner output as the SDK policy
+     * boundary. Custom folders that set this should use the exported filter helpers from
+     * `@backblaze-labs/b2-sdk/sync` to stay aligned with the SDK glob and RegExp dialect.
+     */
+    readonly appliesScanFilters?: true;
+    /**
+     * True when `scan(filters)` already yields entries in `compareSyncRelativePaths` order.
+     * Custom folders that omit this are sorted by `synchronize()` before pairing.
+     */
+    readonly appliesScanSorting?: true;
+    /** Scans the folder and yields files relative to the folder root. */
+    scan(options?: SyncScanOptions): AsyncIterable<SyncPath>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/sync/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEnD,2GAA2G;AAC3G,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAA;AAErD,yEAAyE;AACzE,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE3D,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,UAAU,CAAA;AAEtE,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,4CAA4C;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,sDAAsD;AACtD,MAAM,WAAW,UAAW,SAAQ,QAAQ;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAA;IACrC,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,CAAA;CACpC;AAED,gEAAgE;AAChE,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,YAAY,GACZ,WAAW,GACX,MAAM,GACN,eAAe,GACf,cAAc,GACd,MAAM,GACN,OAAO,GACP,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,YAAY,GACZ,WAAW,GACX,MAAM,GACN,eAAe,GACf,cAAc,GACd,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,aAAa,GAAG,cAAc,CAAA;AAExE,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAA;CACrD;AAED,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,6FAA6F;IAC7F,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAA;IAClF,+FAA+F;IAC/F,qBAAqB,CAAC,WAAW,EAAE,WAAW,GAAG,iBAAiB,GAAG,SAAS,CAAA;CAC/E;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,iEAAiE;IACjE,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;AAE9D,yEAAyE;AACzE,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE3D,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,UAAU,CAAA;AAEtE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,CAAA;AAE/C;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAA;IAClD;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IACxC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAA;CAC1C;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,4CAA4C;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAA;CAC1C;AAED,sDAAsD;AACtD,MAAM,WAAW,UAAW,SAAQ,QAAQ;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAA;IACrC,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,CAAA;CACpC;AAED,gEAAgE;AAChE,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,YAAY,GACZ,WAAW,GACX,MAAM,GACN,eAAe,GACf,cAAc,GACd,MAAM,GACN,OAAO,GACP,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,YAAY,GACZ,WAAW,GACX,MAAM,GACN,eAAe,GACf,cAAc,CAAA;AAElB,gFAAgF;AAChF,MAAM,MAAM,cAAc,GACtB,gBAAgB,GAChB,aAAa,GACb,mBAAmB,GACnB,yBAAyB,GACzB,sBAAsB,GACtB,kBAAkB,GAClB,0BAA0B,GAC1B,oBAAoB,GACpB,wBAAwB,CAAA;AAE5B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAChB,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,yDAAyD;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,kFAAkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,iGAAiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,kFAAkF;IAClF,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;CACzC;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,gBAAgB,GAAG,aAAa,GAAG,cAAc,CAAA;AAE3F,kDAAkD;AAClD,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,8CAA8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IACvC;;;OAGG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IAC1C;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAA;CACrD;AAED,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,6FAA6F;IAC7F,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAA;IAClF,+FAA+F;IAC/F,qBAAqB,CAAC,WAAW,EAAE,WAAW,GAAG,iBAAiB,GAAG,SAAS,CAAA;CAC/E;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAA;IAClC,qEAAqE;IACrE,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;CACzD"}

package/dist/types/auth.cjs

@@ -1,58 +1,78 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const Capability = {
-  /** List application keys. */
-  ListKeys: "listKeys",
-  /** Create new application keys. */
-  WriteKeys: "writeKeys",
-  /** Delete application keys. */
-  DeleteKeys: "deleteKeys",
-  /** List buckets (subject to key restrictions). */
-  ListBuckets: "listBuckets",
-  /** List bucket names without other metadata. */
-  ListAllBucketNames: "listAllBucketNames",
-  /** Read bucket settings. */
-  ReadBuckets: "readBuckets",
-  /** Create and update buckets. */
-  WriteBuckets: "writeBuckets",
-  /** Remove existing buckets from the account. */
-  DeleteBuckets: "deleteBuckets",
-  /** Read bucket-level Object Lock retention settings. */
-  ReadBucketRetentions: "readBucketRetentions",
-  /** Modify bucket-level Object Lock retention settings. */
-  WriteBucketRetentions: "writeBucketRetentions",
-  /** Read default bucket encryption settings. */
-  ReadBucketEncryption: "readBucketEncryption",
-  /** Modify default bucket encryption settings. */
-  WriteBucketEncryption: "writeBucketEncryption",
-  /** Read bucket replication configuration. */
-  ReadBucketReplications: "readBucketReplications",
-  /** Modify bucket replication configuration. */
-  WriteBucketReplications: "writeBucketReplications",
-  /** Read bucket event-notification rules. */
-  ReadBucketNotifications: "readBucketNotifications",
-  /** Modify bucket event-notification rules. */
-  WriteBucketNotifications: "writeBucketNotifications",
-  /** List file names and versions. */
-  ListFiles: "listFiles",
-  /** Download files. */
-  ReadFiles: "readFiles",
-  /** Mint download authorisation tokens. */
-  ShareFiles: "shareFiles",
-  /** Upload files. */
-  WriteFiles: "writeFiles",
-  /** Delete file versions. */
-  DeleteFiles: "deleteFiles",
-  /** Read per-file legal hold flags. */
-  ReadFileLegalHolds: "readFileLegalHolds",
-  /** Modify per-file legal hold flags. */
-  WriteFileLegalHolds: "writeFileLegalHolds",
-  /** Read per-file Object Lock retention settings. */
-  ReadFileRetentions: "readFileRetentions",
-  /** Modify per-file Object Lock retention settings. */
-  WriteFileRetentions: "writeFileRetentions",
-  /** Shorten governance-mode retention. */
-  BypassGovernance: "bypassGovernance"
+//#region src/types/auth.ts
+/**
+* Named constants for the B2 API capabilities that can be granted to an
+* application key. Each capability controls access to a specific set of
+* API operations.
+*
+* Use these when constructing the `capabilities` array for an application
+* key request, or when checking required capabilities via
+* `B2Client.hasCapabilities`.
+*
+* @example
+* ```ts
+* const check = client.hasCapabilities([Capability.WriteFiles, Capability.ReadFiles])
+* if (!check.ok) throw new Error(`missing: ${check.missing.join(', ')}`)
+* ```
+*/
+var Capability = {
+	/** List application keys. */
+	ListKeys: "listKeys",
+	/** Create new application keys. */
+	WriteKeys: "writeKeys",
+	/** Delete application keys. */
+	DeleteKeys: "deleteKeys",
+	/** List buckets (subject to key restrictions). */
+	ListBuckets: "listBuckets",
+	/** List bucket names without other metadata. */
+	ListAllBucketNames: "listAllBucketNames",
+	/** Read bucket settings. */
+	ReadBuckets: "readBuckets",
+	/** Create and update buckets. */
+	WriteBuckets: "writeBuckets",
+	/** Remove existing buckets from the account. */
+	DeleteBuckets: "deleteBuckets",
+	/** Read bucket-level Object Lock retention settings. */
+	ReadBucketRetentions: "readBucketRetentions",
+	/** Modify bucket-level Object Lock retention settings. */
+	WriteBucketRetentions: "writeBucketRetentions",
+	/** Read default bucket encryption settings. */
+	ReadBucketEncryption: "readBucketEncryption",
+	/** Modify default bucket encryption settings. */
+	WriteBucketEncryption: "writeBucketEncryption",
+	/** Read bucket replication configuration. */
+	ReadBucketReplications: "readBucketReplications",
+	/** Modify bucket replication configuration. */
+	WriteBucketReplications: "writeBucketReplications",
+	/** Read bucket event-notification rules. */
+	ReadBucketNotifications: "readBucketNotifications",
+	/** Modify bucket event-notification rules. */
+	WriteBucketNotifications: "writeBucketNotifications",
+	/** Read bucket logging settings. */
+	ReadBucketLogging: "readBucketLogging",
+	/** Modify bucket logging settings. */
+	WriteBucketLogging: "writeBucketLogging",
+	/** List file names and versions. */
+	ListFiles: "listFiles",
+	/** Download files. */
+	ReadFiles: "readFiles",
+	/** Mint download authorisation tokens. */
+	ShareFiles: "shareFiles",
+	/** Upload files. */
+	WriteFiles: "writeFiles",
+	/** Delete file versions. */
+	DeleteFiles: "deleteFiles",
+	/** Read per-file legal hold flags. */
+	ReadFileLegalHolds: "readFileLegalHolds",
+	/** Modify per-file legal hold flags. */
+	WriteFileLegalHolds: "writeFileLegalHolds",
+	/** Read per-file Object Lock retention settings. */
+	ReadFileRetentions: "readFileRetentions",
+	/** Modify per-file Object Lock retention settings. */
+	WriteFileRetentions: "writeFileRetentions",
+	/** Shorten governance-mode retention. */
+	BypassGovernance: "bypassGovernance"
 };
+//#endregion
 exports.Capability = Capability;
-//# sourceMappingURL=auth.cjs.map
+
+//# sourceMappingURL=auth.cjs.map

package/dist/types/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.cjs","sources":["../../src/types/auth.ts"],"sourcesContent":["import type { AccountId, AuthToken, BucketId } from './ids.ts'\n\n/**\n * Named constants for the B2 API capabilities that can be granted to an\n * application key. Each capability controls access to a specific set of\n * API operations.\n *\n * Use these when constructing the `capabilities` array for an application\n * key request, or when checking required capabilities via\n * `B2Client.hasCapabilities`.\n *\n * @example\n * ```ts\n * const check = client.hasCapabilities([Capability.WriteFiles, Capability.ReadFiles])\n * if (!check.ok) throw new Error(`missing: ${check.missing.join(', ')}`)\n * ```\n */\nexport const Capability = {\n  /** List application keys. */\n  ListKeys: 'listKeys',\n  /** Create new application keys. */\n  WriteKeys: 'writeKeys',\n  /** Delete application keys. */\n  DeleteKeys: 'deleteKeys',\n  /** List buckets (subject to key restrictions). */\n  ListBuckets: 'listBuckets',\n  /** List bucket names without other metadata. */\n  ListAllBucketNames: 'listAllBucketNames',\n  /** Read bucket settings. */\n  ReadBuckets: 'readBuckets',\n  /** Create and update buckets. */\n  WriteBuckets: 'writeBuckets',\n  /** Remove existing buckets from the account. */\n  DeleteBuckets: 'deleteBuckets',\n  /** Read bucket-level Object Lock retention settings. */\n  ReadBucketRetentions: 'readBucketRetentions',\n  /** Modify bucket-level Object Lock retention settings. */\n  WriteBucketRetentions: 'writeBucketRetentions',\n  /** Read default bucket encryption settings. */\n  ReadBucketEncryption: 'readBucketEncryption',\n  /** Modify default bucket encryption settings. */\n  WriteBucketEncryption: 'writeBucketEncryption',\n  /** Read bucket replication configuration. */\n  ReadBucketReplications: 'readBucketReplications',\n  /** Modify bucket replication configuration. */\n  WriteBucketReplications: 'writeBucketReplications',\n  /** Read bucket event-notification rules. */\n  ReadBucketNotifications: 'readBucketNotifications',\n  /** Modify bucket event-notification rules. */\n  WriteBucketNotifications: 'writeBucketNotifications',\n  /** List file names and versions. */\n  ListFiles: 'listFiles',\n  /** Download files. */\n  ReadFiles: 'readFiles',\n  /** Mint download authorisation tokens. */\n  ShareFiles: 'shareFiles',\n  /** Upload files. */\n  WriteFiles: 'writeFiles',\n  /** Delete file versions. */\n  DeleteFiles: 'deleteFiles',\n  /** Read per-file legal hold flags. */\n  ReadFileLegalHolds: 'readFileLegalHolds',\n  /** Modify per-file legal hold flags. */\n  WriteFileLegalHolds: 'writeFileLegalHolds',\n  /** Read per-file Object Lock retention settings. */\n  ReadFileRetentions: 'readFileRetentions',\n  /** Modify per-file Object Lock retention settings. */\n  WriteFileRetentions: 'writeFileRetentions',\n  /** Shorten governance-mode retention. */\n  BypassGovernance: 'bypassGovernance',\n} as const\n\n/**\n * A B2 API capability that can be granted to an application key. Derived\n * from {@link Capability}.\n */\nexport type Capability = (typeof Capability)[keyof typeof Capability]\n\n/** Describes the capabilities and scope restrictions of an authorized application key. */\nexport interface AllowedInfo {\n  /** List of capabilities granted to this key. */\n  readonly capabilities: readonly Capability[]\n  /** Bucket ID this key is restricted to, or null if unrestricted. */\n  readonly bucketId: BucketId | null\n  /** Bucket name this key is restricted to, or null if unrestricted. */\n  readonly bucketName: string | null\n  /** File name prefix this key is restricted to, or null if unrestricted. */\n  readonly namePrefix: string | null\n}\n\n/** Configuration for the B2 Cloud Storage API returned during authorization. */\nexport interface StorageApiInfo {\n  /** Minimum allowed part size for large file uploads, in bytes. */\n  readonly absoluteMinimumPartSize: number\n  /** Base URL for B2 API calls. */\n  readonly apiUrl: string\n  /** Bucket ID this key is restricted to, or null if unrestricted. */\n  readonly bucketId: BucketId | null\n  /** Bucket name this key is restricted to, or null if unrestricted. */\n  readonly bucketName: string | null\n  /** Base URL for file downloads. */\n  readonly downloadUrl: string\n  /** Discriminator indicating this is storage API info. Always `'storageApi'`. */\n  readonly infoType: 'storageApi'\n  /** File name prefix this key is restricted to, or null if unrestricted. */\n  readonly namePrefix: string | null\n  /** Recommended part size for large file uploads, in bytes. */\n  readonly recommendedPartSize: number\n  /** Base URL for the S3-compatible API. */\n  readonly s3ApiUrl: string\n  /** Capabilities and scope of the authorized key. */\n  readonly allowed: AllowedInfo\n}\n\n/** Configuration for the B2 Groups API returned during authorization. */\nexport interface GroupsApiInfo {\n  /** Base URL for Groups API calls. */\n  readonly groupsApiUrl: string\n  /** Discriminator indicating this is groups API info. Always `'groupsApi'`. */\n  readonly infoType: 'groupsApi'\n}\n\n/** Container for all API-specific configuration returned by `b2_authorize_account`. */\nexport interface ApiInfo {\n  /** Storage API configuration (always present). */\n  readonly storageApi: StorageApiInfo\n  /** Groups API configuration (present only when the account has groups enabled). */\n  readonly groupsApi?: GroupsApiInfo\n}\n\n/**\n * Response from the `b2_authorize_account` API call.\n * Contains the authorization token and API endpoint URLs needed for subsequent requests.\n */\nexport interface AuthorizeAccountResponse {\n  /** The account ID for the authorized account. */\n  readonly accountId: AccountId\n  /** Authorization token to use in subsequent API calls. */\n  readonly authorizationToken: AuthToken\n  /** API-specific configuration including endpoint URLs and key scope. */\n  readonly apiInfo: ApiInfo\n  /** Expiration timestamp of the application key in milliseconds, or null if the key does not expire. */\n  readonly applicationKeyExpirationTimestamp: number | null\n}\n\n/**\n * Request parameters for the `b2_authorize_account` API call.\n * Credentials are sent via HTTP Basic auth in the raw API, but represented here as fields.\n */\nexport interface AuthorizeAccountRequest {\n  /** The application key ID (account ID or app key ID). */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /** Optional realm override (e.g., `'production'`, `'staging'`). Defaults to production. */\n  readonly realm?: string\n}\n"],"names":[],"mappings":";;AAiBO,MAAM,aAAa;AAAA;AAAA,EAExB,UAAU;AAAA;AAAA,EAEV,WAAW;AAAA;AAAA,EAEX,YAAY;AAAA;AAAA,EAEZ,aAAa;AAAA;AAAA,EAEb,oBAAoB;AAAA;AAAA,EAEpB,aAAa;AAAA;AAAA,EAEb,cAAc;AAAA;AAAA,EAEd,eAAe;AAAA;AAAA,EAEf,sBAAsB;AAAA;AAAA,EAEtB,uBAAuB;AAAA;AAAA,EAEvB,sBAAsB;AAAA;AAAA,EAEtB,uBAAuB;AAAA;AAAA,EAEvB,wBAAwB;AAAA;AAAA,EAExB,yBAAyB;AAAA;AAAA,EAEzB,yBAAyB;AAAA;AAAA,EAEzB,0BAA0B;AAAA;AAAA,EAE1B,WAAW;AAAA;AAAA,EAEX,WAAW;AAAA;AAAA,EAEX,YAAY;AAAA;AAAA,EAEZ,YAAY;AAAA;AAAA,EAEZ,aAAa;AAAA;AAAA,EAEb,oBAAoB;AAAA;AAAA,EAEpB,qBAAqB;AAAA;AAAA,EAErB,oBAAoB;AAAA;AAAA,EAEpB,qBAAqB;AAAA;AAAA,EAErB,kBAAkB;AACpB;;"}
+{"version":3,"file":"auth.cjs","names":[],"sources":["../../src/types/auth.ts"],"sourcesContent":["import type { AccountId, AuthToken, BucketId } from './ids.ts'\n\n/**\n * Named constants for the B2 API capabilities that can be granted to an\n * application key. Each capability controls access to a specific set of\n * API operations.\n *\n * Use these when constructing the `capabilities` array for an application\n * key request, or when checking required capabilities via\n * `B2Client.hasCapabilities`.\n *\n * @example\n * ```ts\n * const check = client.hasCapabilities([Capability.WriteFiles, Capability.ReadFiles])\n * if (!check.ok) throw new Error(`missing: ${check.missing.join(', ')}`)\n * ```\n */\nexport const Capability = {\n  /** List application keys. */\n  ListKeys: 'listKeys',\n  /** Create new application keys. */\n  WriteKeys: 'writeKeys',\n  /** Delete application keys. */\n  DeleteKeys: 'deleteKeys',\n  /** List buckets (subject to key restrictions). */\n  ListBuckets: 'listBuckets',\n  /** List bucket names without other metadata. */\n  ListAllBucketNames: 'listAllBucketNames',\n  /** Read bucket settings. */\n  ReadBuckets: 'readBuckets',\n  /** Create and update buckets. */\n  WriteBuckets: 'writeBuckets',\n  /** Remove existing buckets from the account. */\n  DeleteBuckets: 'deleteBuckets',\n  /** Read bucket-level Object Lock retention settings. */\n  ReadBucketRetentions: 'readBucketRetentions',\n  /** Modify bucket-level Object Lock retention settings. */\n  WriteBucketRetentions: 'writeBucketRetentions',\n  /** Read default bucket encryption settings. */\n  ReadBucketEncryption: 'readBucketEncryption',\n  /** Modify default bucket encryption settings. */\n  WriteBucketEncryption: 'writeBucketEncryption',\n  /** Read bucket replication configuration. */\n  ReadBucketReplications: 'readBucketReplications',\n  /** Modify bucket replication configuration. */\n  WriteBucketReplications: 'writeBucketReplications',\n  /** Read bucket event-notification rules. */\n  ReadBucketNotifications: 'readBucketNotifications',\n  /** Modify bucket event-notification rules. */\n  WriteBucketNotifications: 'writeBucketNotifications',\n  /** Read bucket logging settings. */\n  ReadBucketLogging: 'readBucketLogging',\n  /** Modify bucket logging settings. */\n  WriteBucketLogging: 'writeBucketLogging',\n  /** List file names and versions. */\n  ListFiles: 'listFiles',\n  /** Download files. */\n  ReadFiles: 'readFiles',\n  /** Mint download authorisation tokens. */\n  ShareFiles: 'shareFiles',\n  /** Upload files. */\n  WriteFiles: 'writeFiles',\n  /** Delete file versions. */\n  DeleteFiles: 'deleteFiles',\n  /** Read per-file legal hold flags. */\n  ReadFileLegalHolds: 'readFileLegalHolds',\n  /** Modify per-file legal hold flags. */\n  WriteFileLegalHolds: 'writeFileLegalHolds',\n  /** Read per-file Object Lock retention settings. */\n  ReadFileRetentions: 'readFileRetentions',\n  /** Modify per-file Object Lock retention settings. */\n  WriteFileRetentions: 'writeFileRetentions',\n  /** Shorten governance-mode retention. */\n  BypassGovernance: 'bypassGovernance',\n} as const\n\n/**\n * A B2 API capability that can be granted to an application key. Derived\n * from {@link Capability}.\n */\nexport type Capability = (typeof Capability)[keyof typeof Capability]\n\n/** Bucket restriction entry returned by v4 `b2_authorize_account`. */\nexport interface AllowedBucket {\n  /** Bucket ID the key can access. */\n  readonly id: BucketId\n  /** Bucket name when available, or null when B2 does not include it. */\n  readonly name: string | null\n}\n\n/** Describes the capabilities and scope restrictions of an authorized application key. */\nexport interface AllowedInfo {\n  /** List of capabilities granted to this key. */\n  readonly capabilities: readonly Capability[]\n  /** Bucket restrictions for v4 authorization, or null if unrestricted. */\n  readonly buckets: readonly AllowedBucket[] | null\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** File name prefix this key is restricted to, or null if unrestricted. */\n  readonly namePrefix: string | null\n}\n\n/** Configuration for the B2 Cloud Storage API returned during authorization. */\nexport interface StorageApiInfo {\n  /** Minimum allowed part size for large file uploads, in bytes. */\n  readonly absoluteMinimumPartSize: number\n  /** Base URL for B2 API calls. */\n  readonly apiUrl: string\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** Base URL for file downloads. */\n  readonly downloadUrl: string\n  /**\n   * Discriminator indicating this is storage API info. Always `'storageApi'`.\n   *\n   * @deprecated Removed from the v4 wire shape but normalized by the SDK for\n   * compatibility.\n   */\n  readonly infoType: 'storageApi'\n  /**\n   * File name prefix this key is restricted to, or null if unrestricted.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.namePrefix`; use `allowed.namePrefix` instead.\n   */\n  readonly namePrefix: string | null\n  /** Recommended part size for large file uploads, in bytes. */\n  readonly recommendedPartSize: number\n  /** Base URL for the S3-compatible API. */\n  readonly s3ApiUrl: string\n  /** Capabilities and scope of the authorized key. */\n  readonly allowed: AllowedInfo\n}\n\n/** Configuration for the B2 Groups API returned during authorization. */\nexport interface GroupsApiInfo {\n  /** Base URL for Groups API calls. */\n  readonly groupsApiUrl: string\n  /** Discriminator indicating this is groups API info. Always `'groupsApi'`. */\n  readonly infoType: 'groupsApi'\n}\n\n/** Container for all API-specific configuration returned by `b2_authorize_account`. */\nexport interface ApiInfo {\n  /** Storage API configuration (always present). */\n  readonly storageApi: StorageApiInfo\n  /** Groups API configuration (present only when the account has groups enabled). */\n  readonly groupsApi?: GroupsApiInfo\n}\n\n/**\n * Normalized SDK-facing response from the `b2_authorize_account` API call.\n * The SDK uses the v4 endpoint and preserves deprecated v3 compatibility\n * aliases such as `storageApi.bucketId` and `allowed.bucketId`.\n */\nexport interface AuthorizeAccountResponse {\n  /** The account ID for the authorized account. */\n  readonly accountId: AccountId\n  /** Authorization token to use in subsequent API calls. */\n  readonly authorizationToken: AuthToken\n  /** API-specific configuration including endpoint URLs and key scope. */\n  readonly apiInfo: ApiInfo\n  /** Expiration timestamp of the application key in milliseconds, or null if the key does not expire. */\n  readonly applicationKeyExpirationTimestamp: number | null\n}\n\n/**\n * Request parameters for the `b2_authorize_account` API call.\n * Credentials are sent via HTTP Basic auth in the raw API, but represented here as fields.\n */\nexport interface AuthorizeAccountRequest {\n  /** The application key ID (account ID or app key ID). */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /**\n   * Optional realm override. Accepts a known realm-map key (`\"production\"` or\n   * `\"staging\"`) or a direct base URL. Custom HTTPS hosts are trusted with the\n   * application key during authorize, so never derive this value from untrusted\n   * input. URL values must use HTTPS, or loopback IP literal HTTP for local\n   * testing only; application-key credentials are sent unencrypted over\n   * loopback HTTP. Unsupported schemes, malformed URLs, non-URL strings,\n   * plaintext HTTP hostnames such as `localhost`, and non-loopback plaintext\n   * HTTP are rejected before credentials are sent. URL values must not include\n   * userinfo, query strings, or fragments. Defaults to production.\n   */\n  readonly realm?: string\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,IAAa,aAAa;;CAExB,UAAU;;CAEV,WAAW;;CAEX,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,aAAa;;CAEb,cAAc;;CAEd,eAAe;;CAEf,sBAAsB;;CAEtB,uBAAuB;;CAEvB,sBAAsB;;CAEtB,uBAAuB;;CAEvB,wBAAwB;;CAExB,yBAAyB;;CAEzB,yBAAyB;;CAEzB,0BAA0B;;CAE1B,mBAAmB;;CAEnB,oBAAoB;;CAEpB,WAAW;;CAEX,WAAW;;CAEX,YAAY;;CAEZ,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,qBAAqB;;CAErB,oBAAoB;;CAEpB,qBAAqB;;CAErB,kBAAkB;AACpB"}

package/dist/types/auth.d.cts

@@ -47,6 +47,10 @@ export declare const Capability: {
     readonly ReadBucketNotifications: "readBucketNotifications";
     /** Modify bucket event-notification rules. */
     readonly WriteBucketNotifications: "writeBucketNotifications";
+    /** Read bucket logging settings. */
+    readonly ReadBucketLogging: "readBucketLogging";
+    /** Modify bucket logging settings. */
+    readonly WriteBucketLogging: "writeBucketLogging";
     /** List file names and versions. */
     readonly ListFiles: "listFiles";
     /** Download files. */
@@ -73,13 +77,34 @@ export declare const Capability: {
  * from {@link Capability}.
  */
 export type Capability = (typeof Capability)[keyof typeof Capability];
+/** Bucket restriction entry returned by v4 `b2_authorize_account`. */
+export interface AllowedBucket {
+    /** Bucket ID the key can access. */
+    readonly id: BucketId;
+    /** Bucket name when available, or null when B2 does not include it. */
+    readonly name: string | null;
+}
 /** Describes the capabilities and scope restrictions of an authorized application key. */
 export interface AllowedInfo {
     /** List of capabilities granted to this key. */
     readonly capabilities: readonly Capability[];
-    /** Bucket ID this key is restricted to, or null if unrestricted. */
+    /** Bucket restrictions for v4 authorization, or null if unrestricted. */
+    readonly buckets: readonly AllowedBucket[] | null;
+    /**
+     * Bucket ID this key is restricted to when it has exactly one bucket, or null
+     * if unrestricted or multi-bucket.
+     *
+     * @deprecated The SDK normalizes this compatibility alias from v4
+     * `buckets`; use `buckets` instead.
+     */
     readonly bucketId: BucketId | null;
-    /** Bucket name this key is restricted to, or null if unrestricted. */
+    /**
+     * Bucket name this key is restricted to when it has exactly one bucket, or
+     * null if unrestricted, multi-bucket, or unknown.
+     *
+     * @deprecated The SDK normalizes this compatibility alias from v4
+     * `buckets`; use `buckets` instead.
+     */
     readonly bucketName: string | null;
     /** File name prefix this key is restricted to, or null if unrestricted. */
     readonly namePrefix: string | null;
@@ -90,15 +115,37 @@ export interface StorageApiInfo {
     readonly absoluteMinimumPartSize: number;
     /** Base URL for B2 API calls. */
     readonly apiUrl: string;
-    /** Bucket ID this key is restricted to, or null if unrestricted. */
+    /**
+     * Bucket ID this key is restricted to when it has exactly one bucket, or null
+     * if unrestricted or multi-bucket.
+     *
+     * @deprecated The SDK normalizes this compatibility alias from v4
+     * `allowed.buckets`; use `allowed.buckets` instead.
+     */
     readonly bucketId: BucketId | null;
-    /** Bucket name this key is restricted to, or null if unrestricted. */
+    /**
+     * Bucket name this key is restricted to when it has exactly one bucket, or
+     * null if unrestricted, multi-bucket, or unknown.
+     *
+     * @deprecated The SDK normalizes this compatibility alias from v4
+     * `allowed.buckets`; use `allowed.buckets` instead.
+     */
     readonly bucketName: string | null;
     /** Base URL for file downloads. */
     readonly downloadUrl: string;
-    /** Discriminator indicating this is storage API info. Always `'storageApi'`. */
+    /**
+     * Discriminator indicating this is storage API info. Always `'storageApi'`.
+     *
+     * @deprecated Removed from the v4 wire shape but normalized by the SDK for
+     * compatibility.
+     */
     readonly infoType: 'storageApi';
-    /** File name prefix this key is restricted to, or null if unrestricted. */
+    /**
+     * File name prefix this key is restricted to, or null if unrestricted.
+     *
+     * @deprecated The SDK normalizes this compatibility alias from v4
+     * `allowed.namePrefix`; use `allowed.namePrefix` instead.
+     */
     readonly namePrefix: string | null;
     /** Recommended part size for large file uploads, in bytes. */
     readonly recommendedPartSize: number;
@@ -122,8 +169,9 @@ export interface ApiInfo {
     readonly groupsApi?: GroupsApiInfo;
 }
 /**
- * Response from the `b2_authorize_account` API call.
- * Contains the authorization token and API endpoint URLs needed for subsequent requests.
+ * Normalized SDK-facing response from the `b2_authorize_account` API call.
+ * The SDK uses the v4 endpoint and preserves deprecated v3 compatibility
+ * aliases such as `storageApi.bucketId` and `allowed.bucketId`.
  */
 export interface AuthorizeAccountResponse {
     /** The account ID for the authorized account. */
@@ -144,7 +192,17 @@ export interface AuthorizeAccountRequest {
     readonly applicationKeyId: string;
     /** The application key secret. */
     readonly applicationKey: string;
-    /** Optional realm override (e.g., `'production'`, `'staging'`). Defaults to production. */
+    /**
+     * Optional realm override. Accepts a known realm-map key (`"production"` or
+     * `"staging"`) or a direct base URL. Custom HTTPS hosts are trusted with the
+     * application key during authorize, so never derive this value from untrusted
+     * input. URL values must use HTTPS, or loopback IP literal HTTP for local
+     * testing only; application-key credentials are sent unencrypted over
+     * loopback HTTP. Unsupported schemes, malformed URLs, non-URL strings,
+     * plaintext HTTP hostnames such as `localhost`, and non-loopback plaintext
+     * HTTP are rejected before credentials are sent. URL values must not include
+     * userinfo, query strings, or fragments. Defaults to production.
+     */
     readonly realm?: string;
 }
 //# sourceMappingURL=auth.d.ts.map