@backblaze-labs/b2-sdk 0.1.0 → 0.3.0

package/README.md

@@ -4,13 +4,13 @@
 [![API Docs](https://github.com/backblaze-labs/b2-sdk-typescript/actions/workflows/docs.yml/badge.svg)](https://backblaze-labs.github.io/b2-sdk-typescript/)
 [![npm](https://img.shields.io/npm/v/@backblaze-labs/b2-sdk?color=cb3837)](https://www.npmjs.com/package/@backblaze-labs/b2-sdk)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
-[![Node.js](https://img.shields.io/badge/Node.js-%E2%89%A522-339933?logo=nodedotjs&logoColor=white)](https://nodejs.org/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-6.x-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
+[![Node.js](https://img.shields.io/badge/Node.js-%E2%89%A522.3-339933?logo=nodedotjs&logoColor=white)](https://nodejs.org/)
 [![Zero Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](package.json)
 
-The official Backblaze B2 Cloud Storage SDK for TypeScript and JavaScript.
+A Backblaze-maintained TypeScript and JavaScript SDK for Backblaze B2 Cloud Storage, currently incubating in [Backblaze Labs](https://github.com/backblaze-labs).
 
-**Isomorphic at the source level.** One source tree runs unmodified in Node.js 22+, Bun, Deno, browsers, Cloudflare Workers, and Vercel Edge. Internal imports use `.ts` extensions so Deno reads `src/` directly with no build step. See [Source isomorphism](#source-isomorphism).
+**Isomorphic at the source level.** One source tree runs unmodified in Node.js 22.3+, Bun, Deno, and browsers, and is designed around the same Web APIs used by Cloudflare Workers and Vercel Edge. Internal imports use `.ts` extensions so Deno reads `src/` directly with no build step. See [Source isomorphism](#source-isomorphism).
 
 **Async-first.** Built on Web Streams, `AbortSignal`, and `crypto.subtle`. No callbacks, no legacy APIs.
 
@@ -80,12 +80,23 @@ await bucket.delete()
 
 > The `BucketType`, `RetentionMode`, `LegalHoldValue`, `Capability`, `EventType`, and `EncryptionMode` `as const` objects exported from the main entry give you type-safe alternatives to the raw string literals — pick whichever style you prefer; both are accepted at the type level.
 
+### Partner and Computer Backup APIs
+
+Partner API and Computer Backup API helpers are exported from dedicated subpaths:
+
+```ts
+import { PartnerClient } from '@backblaze-labs/b2-sdk/partner'
+import { BackupClient } from '@backblaze-labs/b2-sdk/backup'
+```
+
+Both clients authorize with a Master Application Key through the Partner authorization flow. Account-creating Partner operations, including group member creation and trial reservation, require a valid SMS phone number on the administrator account. See [examples/README.md](examples/README.md#partner-and-computer-backup-examples) for current prerequisites and runnable examples.
+
 ### Uploads
 
 Small files (under the recommended part size, typically 100 MB) are uploaded in a single request. Larger files automatically use multipart upload with parallel part uploads.
 
 ```ts
-import { BufferSource, BlobSource } from '@backblaze-labs/b2-sdk'
+import { BufferSource, BlobSource, FileSource, toContentSource } from '@backblaze-labs/b2-sdk'
 
 // From a Uint8Array
 await bucket.upload({
@@ -100,10 +111,22 @@ await bucket.upload({
   contentType: 'image/jpeg',
 })
 
-// Large file with progress tracking
+// From a local file path (Node)
+await bucket.upload({
+  fileName: 'backups/db.dump',
+  source: await FileSource.fromPath('/var/backups/db.dump'),
+})
+
+// From a forward-only stream or async iterable (size required)
+await bucket.upload({
+  fileName: 'exports/report.ndjson',
+  source: toContentSource(nodeReadable, knownByteLength),
+})
+
+// Large file with progress tracking (Node)
 await bucket.upload({
   fileName: 'backup.tar.gz',
-  source: new BlobSource(largeBlob),
+  source: await FileSource.fromPath('/path/to/backup.tar.gz'),
   concurrency: 8,
   partSize: 64 * 1024 * 1024,
   onProgress: (event) => {
@@ -113,9 +136,44 @@ await bucket.upload({
 })
 ```
 
+`FileSource` rejects non-regular leaf paths, later leaf path swaps, and same-size rewrites that restore mtime on POSIX platforms. Parent directory symlinks are followed unless your application validates the containing root first. On Windows, `FileSource` skips unreliable dev/inode and ctime comparisons and validates size and mtime instead.
+
+Transient upload failures are retried with a fresh B2 upload URL, matching B2's documented flow. If the first upload POST succeeded but its response was lost, retrying can create a duplicate file version.
+
+Use `onUploadRetry` to log or count retry attempts, compare returned file IDs and SHA-1 values when reconciling uploads, and configure lifecycle or version-retention rules for buckets where duplicate versions must be cleaned up automatically. Retry diagnostics are event-only: the SDK does not log, count, or persist them unless this listener records them. Payload re-POSTs and fresh-URL fetches spend one upload retry budget and are bounded by `retry.maxRetries + 1` attempts per file or part; aggregate retries scale with multipart transfer concurrency. Upload 429 throttling backs off on the same upload URL instead of fetching a new one.
+
+Uploads do not retry lost success response bodies or upload POST network errors by default because re-posting `b2_upload_file` can create duplicate versions, especially in versioned or Object Lock buckets. If callers opt into this ambiguity with `retryResponseBodyFailures: true`, retryable upload POST network errors and unreadable response bodies can re-post the payload with a fresh URL, bounded by `retry.maxRetries`; any uploaded `fileRetention` or `legalHold` applies to each duplicate version and can prevent deletion until the retention policy expires or the hold is cleared. Multipart callers may also opt in when replaying the same `partNumber` is acceptable before `finishLargeFile`, including SSE-B2 encrypted parts.
+
+Large-file part retries are coordinated per part, not by a shared circuit breaker. During a B2 pod or main-API incident, concurrent parts can independently back off with jitter, fetch fresh part URLs, and retry in parallel; aggregate fresh-URL traffic scales with multipart concurrency and `retry.maxRetries`. Multipart workers abort sibling work promptly after a fatal part failure, and best-effort cleanup is bounded so aborting a stream does not hang indefinitely. Tune `concurrency`, `retry`, and `onUploadRetry` for operators that need outage counters or stricter load shedding. Each HTTP attempt has a 15 minute deadline by default; for streamed download bodies the timeout is idle/no-progress and resets after each chunk. Set `retry.requestTimeoutMs` higher for very slow upload links or to `0` to rely only on your own `AbortSignal`.
+
+`FileSource` is the Node.js-only content adapter. It is safe to import from the
+main package in browser builds, but `FileSource.fromPath()` and its read methods
+need local filesystem APIs at runtime. The source records the validated file
+identity and fails with `FileSource file changed after validation` if the path is
+replaced, truncated, content-modified, or has ctime-changing metadata updates
+while a multipart upload is reading it. On platforms without `O_NOFOLLOW`,
+leaf-symlink swaps are rejected by the post-open identity check rather than by
+the open flag. Retry after active writers stop changing the file.
+
 #### Resume a failed multipart upload
 
-Pass `resume: true` and the SDK looks up the matching unfinished large file via `b2_list_unfinished_large_files`, checks which parts are already on the server, and only re-uploads the missing ones. Parts whose locally-recomputed SHA-1 matches the server's are skipped.
+Resume has two paths. `resumeFileId` targets a known unfinished large-file ID returned by B2 when the multipart upload was started. `resume: true` without `resumeFileId` runs bounded same-name discovery and may continue uploading into the newest compatible unfinished upload; incompatible candidates are skipped and a fresh upload starts. Automatic discovery reuploads every planned part into the selected unfinished file instead of trusting pre-existing server parts by SHA-1 alone. With explicit `resumeFileId`, each local part is hashed again and matching server parts are skipped only when the locally recomputed SHA-1 equals B2's part SHA-1.
+
+Resume discovery is intentionally conservative. The SDK reuses only the newest unfinished large file whose file name, content type, caller-provided file info, encryption, Object Lock retention, legal hold, and uploaded part lengths match the current call. If those checks fail, a new large file is started instead. Caller-provided file info such as `large_file_sha1` or `src_last_modified_millis` is part of that identity, so keep it stable across retries. Discovery does not add SDK metadata to unfinished or finished file info.
+
+Automatic resume requires a stable content type. When the upload uses the SDK default `b2/x-auto`, same-name discovery starts a fresh large file unless B2 lists the unfinished file with the same `b2/x-auto` value. Provide an explicit `contentType` for automatic resume, or use `resumeFileId` when the caller deliberately trusts a specific unfinished file's listed content type. Explicit content types still require an exact match.
+
+Automatic resume discovery does not use B2's stored part SHA-1 to skip local bytes because B2 unfinished-large-file records do not identify the writer that started them. It may still finish a compatible same-name unfinished upload after overwriting planned parts with locally read bytes, so use exact file names and stable caller-owned file info when shared buckets have concurrent writers. Use `resumeFileId` only when the caller deliberately trusts the specific unfinished file ID.
+
+The discovery scan is bounded to avoid unbounded prefix-flood work in shared buckets, but it still runs before the first upload byte. By default the SDK inspects up to 10 unfinished-file pages, up to 25 metadata-compatible candidates, and up to 10 part pages per candidate, so a worst-case resume attempt can add many sequential B2 list calls before data transfer starts. Tune `resumeMaxListPages`, `resumeMaxPartCandidates`, and `resumeMaxPartPages` for buckets with many concurrent same-prefix uploads. The SDK does not install a default resume discovery timeout; set `resumeDiscoveryTimeoutMs` or pass an abort signal such as `AbortSignal.timeout(...)` when discovery needs a first-byte time budget. If the scan is truncated, the SDK reports `search-truncated`; when a compatible candidate was already scanned, that candidate may still be reused.
+
+Rejected candidates and failed attempts that reused an existing unfinished file are left unfinished. B2 stores uploaded parts for unfinished large files until they are finished, cancelled, or removed by a lifecycle rule, so stricter matching or repeated prefix-flood truncation can leave billable unfinished uploads behind. Applications with strict resume matching should configure lifecycle cleanup or periodically use `listUnfinishedLargeFiles` and `cancelLargeFile` to remove stale unfinished uploads.
+
+When the caller omits `serverSideEncryption`, high-level bucket and object uploads verify candidates against the bucket's current default encryption freshly fetched from B2, including default SSE-B2 or no encryption. Explicit `serverSideEncryption: { mode: 'none' }` still requires an unencrypted candidate. SSE-C uploads are not resumed automatically or with `resumeFileId` because B2 does not expose a non-secret customer-key identity for unfinished files. With `resume: true`, an SSE-C retry starts a new large file. With `resumeFileId`, SSE-C fails with `ResumeFileIdMismatchError` rather than risking a finish under an unverified key.
+
+Object Lock state must also be verified before reuse. When the caller omits `fileRetention`, high-level bucket and object uploads use the readable bucket default retention freshly fetched from B2; candidates without the exact required default retention window are skipped. Unreadable bucket default retention, candidate retention, or candidate legal-hold fields fail closed. Explicit retention or legal-hold values still require readable matching candidate metadata.
+
+Pass `onResumeCandidateRejected` to collect diagnostic events when a same-name unfinished large file is skipped, including reasons such as `file-info-mismatch`, `part-length-mismatch`, `search-truncated`, or `sse-c-unsupported`. Resume diagnostics are event-only: without this listener, a conservative resume decline falls back to a fresh upload without SDK logging or counters. Candidate-specific events include `requestedFileName` and `candidateFileName` so logging can distinguish the intended upload name from the rejected unfinished file. Pass `onResumePartReused` to observe each pre-existing server part accepted by explicit `resumeFileId` through the SHA-1 equality gate. If a supplied `resumeFileId` is incompatible or cannot be verified through B2's unfinished-large-file listing, `ResumeFileIdMismatchError` is thrown instead of silently starting a different large file.
 
 ```ts
 // Restart the upload that crashed at part 47 of 100
@@ -123,13 +181,6 @@ await bucket.upload({
   fileName: 'backup.tar.gz',
   source: new BlobSource(largeBlob),
   partSize: 64 * 1024 * 1024,
-  resume: true,
-})
-
-// Or target a specific in-progress large file explicitly
-await bucket.upload({
-  fileName: 'backup.tar.gz',
-  source: new BlobSource(largeBlob),
   resumeFileId: knownLargeFileId,
 })
 ```
@@ -150,7 +201,7 @@ const fileVersion = await done
 console.log(`Streamed upload finished: ${fileVersion.fileName} (${fileVersion.contentLength} bytes)`)
 ```
 
-> Streaming uploads do not support resume because the total size and per-part SHA-1s are not known in advance. Use the buffered `upload` path with `resume: true` when that matters.
+> Streaming uploads do not support resume because the total size and per-part SHA-1s are not known in advance. Use the buffered `upload` path with `resumeFileId` when that matters.
 
 ### Downloads
 
@@ -165,16 +216,23 @@ const partial = await bucket.download('large-file.bin', {
 })
 
 // Parallel ranged download (for large files).
-// Each range is retried independently with exponential backoff so a single
-// transient 503 does not kill the whole transfer.
+// Each range uses the client's configured RetryTransport budget, so transient
+// 503s are retried without adding a second default retry layer per chunk.
 const obj = bucket.file('big-dataset.parquet')
 const stream = obj.createReadStream(fileId, totalSize, {
   concurrency: 4,
   rangeSize: 10 * 1024 * 1024,
-  maxRetries: 5,
 })
 ```
 
+Full-body downloads are automatically verified when B2 returns a real `X-Bz-Content-Sha1` digest. If the downloaded bytes do not match, the body stream errors with `ChecksumMismatchError`; discard any partially written output when piping to disk. HEAD requests, range GETs, and files whose SHA-1 is unavailable are not verified because no matching whole-body digest exists.
+
+### Sync SHA-1 comparisons
+
+`compareMode: 'sha1'` hashes matching-size local files and compares them with verifiable B2 SHA-1 metadata. B2 multipart objects do not have an authoritative `contentSha1`; when only `fileInfo.large_file_sha1` or another untrusted hint is available, a real sync downloads that selected B2 version and hashes the full object before skipping a transfer. The SDK does not persist that verification result, so an unchanged 100 GB multipart object can cost 100 GB of B2 download reads on every SHA-1 sync run. `compare.bytesVerified` reports those B2 verification bytes for the run. Use `sha1VerificationMaxBytes` to skip objects above your per-file verification budget, raise `sha1VerificationTimeoutMillis` for large objects on slow links, or use `size`/`modtime` mode when recurring verification egress is not acceptable.
+
+B2-to-local sync streams downloads through a private managed staging directory under the destination root before renaming into place. The scanner ignores that managed directory and stale SDK-owned staging entries are reaped on later download setup. New files are published as 0600 by default, replacements keep the previous file mode, and download body stalls use `downloadIdleTimeoutMillis` (60 seconds by default) rather than `sha1ReadTimeoutMillis`. `B2Folder` prefixes are raw B2 key prefixes: use `photos/` for a slash-delimited folder, or `photos` to match every key beginning with those bytes.
+
 ### File operations
 
 ```ts
@@ -251,7 +309,7 @@ import { Capability } from '@backblaze-labs/b2-sdk'
 const key = await client.createKey({
   capabilities: [Capability.ReadFiles, Capability.WriteFiles],
   keyName: 'my-app-key',
-  bucketId: bucket.id,
+  bucketIds: [bucket.id],
   namePrefix: 'uploads/',
   validDurationInSeconds: 86400,
 })
@@ -386,7 +444,10 @@ const auth = await bucket.getDownloadAuthorization('photos/', 3600)
 import { B2Client } from '@backblaze-labs/b2-sdk'
 import { FileAccountInfo } from '@backblaze-labs/b2-sdk/auth/file'
 
-const accountInfo = new FileAccountInfo('/var/cache/my-app/b2-auth.json')
+const accountInfo = new FileAccountInfo('/var/cache/my-app/b2-auth.json', {
+  onDiscard: (event) => console.warn('ignored stale B2 auth cache', event.reason),
+  onWriteError: (event) => console.warn('could not persist B2 auth cache', event.error),
+})
 await accountInfo.load() // populate from disk if the file exists
 
 const client = new B2Client({
@@ -400,7 +461,7 @@ if (accountInfo.getAuth() === null) {
 }
 ```
 
-`load()` returns silently on missing or corrupt files (a fresh `authorize()` will populate fresh state). Call `await accountInfo.flushed()` before process exit if you need to guarantee the latest state has hit disk.
+`load()` returns silently on missing or corrupt files (a fresh `authorize()` will populate fresh state). `onDiscard` fires when a loaded cache entry is ignored because its realm, application key ID, or cached endpoints do not match the current client; `onWriteError` reports asynchronous write failures that would otherwise be best-effort. Call `await accountInfo.flushed()` before process exit if you need to guarantee the latest state has hit disk.
 
 ## Subpath exports
 
@@ -425,6 +486,10 @@ import {
 import { InMemoryAccountInfo } from '@backblaze-labs/b2-sdk/auth'
 import { FileAccountInfo } from '@backblaze-labs/b2-sdk/auth/file'
 
+// Partner and Computer Backup API surfaces
+import { PartnerClient, PartnerRawClient } from '@backblaze-labs/b2-sdk/partner'
+import { BackupClient, BackupRawClient } from '@backblaze-labs/b2-sdk/backup'
+
 // Streaming utilities + SSE-C key wrapper
 import {
   IncrementalSha1,
@@ -436,15 +501,60 @@ import {
 // Sync engine (local <-> B2)
 import { synchronize, LocalFolder, B2Folder } from '@backblaze-labs/b2-sdk/sync'
 
-// S3-compatible helpers (requires @aws-sdk/client-s3 peer dependency)
-import { createS3ClientConfig, presignGetObjectUrl } from '@backblaze-labs/b2-sdk/s3'
+// S3-compatible helpers
+import {
+  createS3ClientConfig,
+  presignS3GetObjectUrl,
+  presignS3PutObjectUrl,
+} from '@backblaze-labs/b2-sdk/s3'
+
+// Webhook signature verification for B2 event notifications
+import { verifyWebhookSignature, requireValidWebhook } from '@backblaze-labs/b2-sdk/notifications'
 
 // In-memory B2 server for tests (no network required)
 import { B2Simulator } from '@backblaze-labs/b2-sdk/simulator'
 ```
 
+`createS3ClientConfig()` is for `@aws-sdk/client-s3`; install that optional peer
+before constructing an AWS `S3Client`. The presign helpers sign internally and
+do not require AWS presigner packages.
+
+Raw methods use a trailing options bag for request controls such as cancellation
+and per-request retry overrides: pass `{ signal, retry }` to `getUploadUrl`,
+`getUploadPartUrl`, `uploadFile`, and `uploadPart`. The older positional
+`signal, retry` form remains available only for source compatibility.
+
 Every export is documented with full type signatures in the [API reference](https://backblaze-labs.github.io/b2-sdk-typescript/).
 
+## Sync filters
+
+`synchronize()` and the built-in `LocalFolder` / `B2Folder` scanners accept `include` and `exclude` filters for paths relative to each sync root:
+
+```ts
+for await (const event of synchronize({
+  source: new LocalFolder('./site'),
+  dest: new B2Folder(bucket, 'site/'),
+  bucket,
+  prefix: 'site/',
+  options: {
+    compareMode: 'modtime',
+    keepMode: 'no-delete',
+    include: ['assets/**', '*.html'],
+    exclude: ['*.tmp', 'node_modules', 'dist/cache/**'],
+  },
+})) {
+  console.log(event)
+}
+```
+
+Glob strings use the SDK dialect: `*` and `?` stay within one path segment, a whole `**` segment crosses directories, slash-less patterns match any basename or ancestor directory, and excludes win over includes. Use `dir/**` for directory-subtree patterns such as `dist/cache/**`; a slash-containing literal such as `dist/cache` matches only that exact path. RegExp filters are guarded by a best-effort synchronous safety heuristic whose exact subset may change as protections tighten. Paths beyond the RegExp input guard are skipped when any RegExp filter is present, including exclude-only RegExp deny-lists. B2 prefixes are raw object-name prefixes; backslashes are not rewritten to `/`.
+
+`SyncFolder.scan()` direct consumers should expect paths sorted with `compareSyncRelativePaths`, exported from `@backblaze-labs/b2-sdk/sync`. During `synchronize()`, custom folders are filtered before pairing even when they set `appliesScanFilters: true`; scanner-side filtering is an optimization, not the policy boundary. Custom scanner authors can call `filterSyncPaths(paths, options)` and forward `SyncScanOptions.onSkip` so RegExp input-limit diagnostics are preserved. Custom folders that do not set `appliesScanSorting: true` are sorted before pairing. The built-in local and B2 scanners set both flags. `SyncOptions.maxScanEntries` / `SyncScanOptions.maxScanEntries` default to the SDK scan ceiling and fail with a defined scan-limit error when exceeded; B2 scans count every listed file-version record, including versions later skipped by prefix, safety, or filter checks, while local and fallback scans count retained sync paths. Pass `Infinity` only when the process heap is sized for the full result set; raising the limit increases peak scanner memory because built-in scans sort or group results before yielding.
+
+Built-in scanner skip diagnostics use `SyncSkipReason` values such as `outside-prefix`, `unsafe-name`, `local-unsafe-name`, `relative-path-collision`, `local-path-collision`, `filesystem-error`, and `path-too-long-for-regexp`. The `onSkip` callback receives every diagnostic; the `SyncEvent` stream buffers the first 100 scanner diagnostics and then reports overflow with `scan-skip-overflow`.
+
+B2-to-local sync skips object names that are unsafe on local filesystems, including NTFS alternate data stream names, DOS device basenames, trailing dot/space names, the reserved `.b2sdk-download-staging` namespace, and case/Unicode-canonical collisions. Downloads stream into private per-download entries under the destination root's managed `.b2sdk-download-staging` directory and publish completed files into place; SDK-owned staging roots and entries carry `.b2sdk-staging-marker.partial` files. Local scans are read-only and exclude the managed staging directory when those markers are present so abandoned staging state is not uploaded as source content. Later download setup reaps stale SDK-owned staging entries only when marker and partial-file activity is old and unchanged immediately before removal. Download body reads have a 60 second idle timeout by default; set `downloadIdleTimeoutMillis` to tune it or `Infinity` to disable the watchdog. Downloads and local deletes reject symlinked local roots and symlinked path components under the root, then revalidate root, parent, and leaf identity immediately before filesystem operations. Uploads support symlinked source roots by binding the resolved root identity before scanning, then reopening scanned files with no-follow semantics and verifying the opened file remains inside that bound source root before reading. Per-action failures are emitted as `error` events; the terminal aggregate error includes `failureCount`, up to 100 `failedPaths`, and `failedPathOmittedCount` when more paths were omitted.
+
 ## Custom transport
 
 The SDK uses a pluggable transport layer. The default `FetchTransport` uses the native `fetch` API. You can provide your own:
@@ -470,7 +580,7 @@ const client = new B2Client({
 Every request the SDK issues carries a User-Agent header that Backblaze can grep server logs by:
 
 ```
-b2-sdk-typescript/0.1.0 (typescript; @backblaze-labs/b2-sdk; node/24.14.1; linux; x64)
+b2-sdk-typescript/<version> (typescript; @backblaze-labs/b2-sdk; node/<node-version>; linux; x64)
 ```
 
 Both `b2-sdk-typescript/` (stable product token) and `@backblaze-labs/b2-sdk` (npm package name) are part of the documented contract — log queries that match either one find every request issued by this SDK. The comment block also reports the runtime (`node/<version>`, `bun/<version>`, `deno/<version>`, or `browser`) plus the OS and architecture on non-browser runtimes.
@@ -485,7 +595,7 @@ const client = new B2Client({
   applicationKey,
   userAgent: 'my-app/1.0',
 })
-// → "my-app/1.0 b2-sdk-typescript/0.1.0 (typescript; @backblaze-labs/b2-sdk; node/24.14.1; linux; x64)"
+// → "my-app/1.0 b2-sdk-typescript/<version> (typescript; @backblaze-labs/b2-sdk; node/<node-version>; linux; x64)"
 ```
 
 ## SSRF guard
@@ -513,6 +623,10 @@ new B2Client({
 })
 ```
 
+Passing `allowedHostSuffixes: []` disables the guard entirely and should be reserved for trusted tests or controlled local harnesses. For custom realms, the SDK uses the hosts returned by `b2_authorize_account` as scoped suffixes, allowing those hosts and their subdomains without broadening unknown domains to public suffixes such as `co.uk`.
+
+The default transport follows same-origin `GET` / `HEAD` redirects after each target passes the SSRF guard. Cross-origin redirects and `POST` redirects are blocked with `B2RedirectError`. Pass `followSameOriginRedirects: false` to the `B2Client` constructor to block same-origin redirects as well.
+
 Passing a custom `transport` opts out of the guard (your transport, your threat model).
 
 ## Retry behavior
@@ -520,7 +634,7 @@ Passing a custom `transport` opts out of the guard (your transport, your threat
 The SDK automatically retries transient errors with exponential backoff:
 
 - **401 expired_auth_token**: re-authorizes and retries
-- **503, 408, 429**: exponential backoff with jitter, respects `Retry-After` header
+- **408, 429, transient 5xx (500, 502, 503, 504)**: exponential backoff with jitter, respects `Retry-After` header
 - **Network errors**: retried with backoff
 - **Permanent errors** (403 cap_exceeded, 404 not_found, etc.): thrown immediately
 
@@ -534,10 +648,21 @@ const client = new B2Client({
     maxRetries: 10,
     maxRetryDelayMs: 120_000,
     initialRetryDelayMs: 500,
+    requestTimeoutMs: 30 * 60_000,
   },
 })
 ```
 
+`requestTimeoutMs` covers request dispatch, upload POST bodies, and
+non-streaming response-body reads. For `response.body` download streams it is an
+idle/no-progress timeout that resets after each received chunk, so healthy large
+downloads are not aborted merely because the total transfer takes longer than
+the timeout. Slow large-part uploads may need a higher value or `0` to rely on
+your own `AbortSignal`. Worst-case terminal latency can be roughly
+`(retry.maxRetries + 1) * requestTimeoutMs` plus backoff when an endpoint hangs.
+
+When a multipart upload, streaming upload, or multipart copy fails, the SDK calls `b2_cancel_large_file` on a best-effort basis. Pass `onCleanupFailure` on those operations to observe failed cancellation or a skipped cancellation after an ambiguous `b2_finish_large_file` response, with the relevant `fileId` so operators can reconcile unfinished or possibly committed large files. Pair long-running resume workflows with lifecycle or version-retention cleanup so orphaned unfinished large files do not accumulate past the bounded resume discovery scan.
+
 ## Testing with the simulator
 
 The SDK ships an in-memory B2 simulator for unit testing without network access:
@@ -581,7 +706,7 @@ describe('my app', () => {
 
 ## Error handling
 
-All B2 API errors are thrown as typed `B2Error` subclasses (13 in total). Client-side capability checks throw `B2InsufficientCapabilityError`.
+All B2 API errors are thrown as typed `B2Error` subclasses. Client-side capability checks throw `B2InsufficientCapabilityError`.
 
 ```ts
 import { BucketType } from '@backblaze-labs/b2-sdk'
@@ -611,7 +736,7 @@ try {
 
 The high-level surface (`B2Client`, `Bucket`, `B2Object`) gives you direct access to features that live in B2's native API:
 
-- **Per-part and whole-file SHA-1 verification** on multipart uploads.
+- **Per-part and whole-file SHA-1 verification** on multipart uploads, plus automatic whole-file verification on downloads when B2 provides a digest.
 - **`b2_copy_part` server-side multipart copy** via `bucket.copyLargeFile()` — no client-side bytes touched.
 - **File retention + legal hold** (object lock) on `bucket.updateFileRetention()` and `bucket.updateFileLegalHold()`.
 - **Time-scoped download tokens** via `bucket.getDownloadAuthorization()` for sharing without exposing the application key.
@@ -619,7 +744,11 @@ The high-level surface (`B2Client`, `Bucket`, `B2Object`) gives you direct acces
 - **Event notification rules** via `bucket.getNotificationRules()` and `bucket.setNotificationRules()`.
 - **Application key restrictions** (per-bucket, per-prefix, per-capability) via `client.createKey()`.
 
-When you want S3 compatibility instead — for tooling that already speaks S3, or for the Bandwidth Alliance proxy pattern — `@backblaze-labs/b2-sdk/s3` exposes `createS3ClientConfig()` and `presignGetObjectUrl()` so the same SDK covers both surfaces.
+When you want S3 compatibility instead — for tooling that already speaks S3, browser direct uploads, or for the Bandwidth Alliance proxy pattern — `@backblaze-labs/b2-sdk/s3` exposes `createS3ClientConfig()`, `presignS3GetObjectUrl()`, and `presignS3PutObjectUrl()` so the same SDK covers both surfaces.
+
+S3 presigned URLs are bearer credentials. The helpers only emit `https:` URLs and require an explicit `region` for custom or proxied endpoints whose region cannot be derived from `s3.<region>.backblazeb2.com`; set `region` and call `createS3ClientConfig()` during startup or deployment health checks before serving traffic. Object keys with path segments exactly `.` or `..` cannot be S3-presigned safely because common URL parsers normalize them before sending; rename those objects, proxy the download through a trusted server, or use a B2-native download authorization URL when that fits the access model. URL validity depends on the signing host's clock, so URL-generating hosts should be NTP-synced, and downstream SigV4 403s should include a clock-skew check. For untrusted uploads, bind `contentType` and `contentLength` when you can; omitting `contentType` lets the uploader store any B2-accepted type, including browser-executable HTML, SVG, XML, or JavaScript. Bound active content types are rejected unless trusted server code passes `trustedUnsafeS3PresignOptIn` to `allowBrowserExecutableContentType`; booleans from request JSON are ignored. GET response overrides that force inline rendering or active content require the same token on their unsafe opt-in fields. The SDK's active-content checks are best-effort denylists, not a complete browser security policy; the SDK cannot set `X-Content-Type-Options: nosniff`, so callers accepting untrusted content should enforce their own content-type allow-list. Presigned PUT URLs are replayable until expiry; if a client retries after B2 stored the object but before the response was observed, the retry can create another file version. Use unique object keys or reconcile by listed file IDs/checksums, and configure lifecycle or version cleanup where duplicate versions must be removed automatically.
+
+The deprecated `presignGetObjectUrl()` helper returns a B2-native download-authorization URL, not an S3 presigned URL. It keeps the legacy slash-escaped URL shape and permissive string-building behavior for compatibility. Use `createNativeDownloadAuthorizationUrl()` for new B2-native download-token URLs; it uses B2 path-preserving file-name encoding, requires an `https:` Backblaze download origin without userinfo, path, query, or fragment, rejects unsafe bucket names, control characters, invalid compatibility durations, and path-normalizing file names, and constructs the bearer URL from the parsed origin rather than raw-concatenating caller input.
 
 ## Source isomorphism
 
@@ -644,14 +773,14 @@ So you get both: an `npm install`-ready `dist/` (ESM + CJS + DTS), *and* a `src/
 
 | Runtime | Version | Status |
 |---|---|---|
-| Node.js | 22+ | Primary target. CI runs the full suite on Node 22 and 24 across Linux, Windows, and macOS. |
+| Node.js | 22.3+ | Primary target. CI runs the fast suite on Linux, Windows, and macOS for Node 22.18 + 24; slow and coverage jobs run on Linux. `FileSource` uses weaker size/mtime validation on Windows because portable dev/inode and ctime fields are unreliable there. |
 | Bun | latest | Tested in CI via `bun test src/` + example typecheck. |
 | Deno | 2.x | Source isomorphism verified in CI via `deno check` against `src/`. |
 | Browsers | Chromium, Firefox, WebKit (last 2 evergreen) | Tested in CI via Playwright. |
-| Cloudflare Workers | - | Supported. |
-| Vercel Edge | - | Supported. |
+| Cloudflare Workers | - | Compatible target when the standard Web APIs above are available; not yet smoke-tested in CI with a Workers runtime. |
+| Vercel Edge | - | Compatible target when the standard Web APIs above are available; not yet smoke-tested in CI with Vercel Edge. |
 
-Requires: `fetch`, Web Streams, `crypto.subtle`, `AbortSignal`. Node < 22 is not supported (Node 20 reached EOL April 2026).
+Requires: `fetch`, Web Streams, `crypto.subtle`, `AbortSignal`. Node < 22.3 is not supported (Node 20 reached EOL April 2026). `FileSource(path)` throws on older Node 22.x runtimes that lack synchronous `process.getBuiltinModule()`; `FileSource.fromPath(path)` remains the async construction path for supported Node filesystem platforms. On Windows, `FileSource` is supported with weaker size/mtime validation because portable dev/inode and ctime fields are unreliable there.
 
 The browser test suite (`pnpm test:browser`) runs the same source against real Chromium, Firefox, and WebKit instances. Only Node-specific tests (filename pattern `*.node.test.ts`, covering `node:fs`, `node:os`, `node:util.inspect`) are skipped.
 

package/dist/_virtual/_b2-sdk-version-json.cjs

@@ -0,0 +1,4 @@
+//#region \0b2-sdk-version-json
+var _b2_sdk_version_json_default = { "version": "0.3.0" };
+//#endregion
+exports.default = _b2_sdk_version_json_default;

package/dist/_virtual/_b2-sdk-version-json.js

@@ -0,0 +1,4 @@
+//#region \0b2-sdk-version-json
+var _b2_sdk_version_json_default = { "version": "0.3.0" };
+//#endregion
+export { _b2_sdk_version_json_default as default };

package/dist/auth/account-info.d.cts

@@ -7,12 +7,42 @@ export interface UploadUrlEntry {
     /** Authorization token to include with the upload request. */
     readonly authorizationToken: string;
 }
+/**
+ * Optional extension for persistent auth stores that need to bind cached auth
+ * to the current client configuration. `B2Client` calls these hooks during
+ * construction before it reuses any loaded auth.
+ */
+export interface AuthContextAwareAccountInfo {
+    /**
+     * Bind persistent auth caches to the resolved realm URL. Implementations that
+     * persist auth should discard loaded state written for a different realm.
+     */
+    setRealmUrl(realmUrl: string): void;
+    /**
+     * Bind persistent auth caches to the configured application key ID.
+     * Implementations that persist auth should discard loaded state written for a
+     * different key ID.
+     */
+    setApplicationKeyId(applicationKeyId: string): void;
+}
 /**
  * Stores B2 authorization state between requests.
  * Implementations cache the authorize-account response and manage
  * pools of reusable upload URLs (checkout/checkin/evict pattern).
  */
 export interface AccountInfo {
+    /**
+     * @deprecated Persistent auth stores should implement
+     * {@link AuthContextAwareAccountInfo}. This optional hook remains for
+     * source compatibility with older integrations.
+     */
+    setRealmUrl?(realmUrl: string): void;
+    /**
+     * @deprecated Persistent auth stores should implement
+     * {@link AuthContextAwareAccountInfo}. This optional hook remains for
+     * source compatibility with older integrations.
+     */
+    setApplicationKeyId?(applicationKeyId: string): void;
     /** Store a fresh authorization response, replacing any previous state. */
     setAuth(auth: AuthorizeAccountResponse): void;
     /** Return the current authorization response, or null if not authorized. */
@@ -35,6 +65,8 @@ export interface AccountInfo {
     getS3ApiUrl(): string;
     /** Bucket ID the key is restricted to, or null if unrestricted. */
     getAllowedBucketId(): BucketId | null;
+    /** Bucket IDs the key is restricted to, or null if unrestricted. */
+    getAllowedBucketIds(): readonly BucketId[] | null;
     /** Take an upload URL from the pool for the given bucket, or null if none available. */
     checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null;
     /** Return a still-valid upload URL to the pool for reuse. */

package/dist/auth/account-info.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"account-info.d.ts","sourceRoot":"","sources":["../../src/auth/account-info.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC7C,4EAA4E;IAC5E,OAAO,IAAI,wBAAwB,GAAG,IAAI,CAAA;IAC1C,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAA;IAEb,iCAAiC;IACjC,SAAS,IAAI,MAAM,CAAA;IACnB,mCAAmC;IACnC,cAAc,IAAI,MAAM,CAAA;IACxB,mCAAmC;IACnC,YAAY,IAAI,MAAM,CAAA;IACtB,iCAAiC;IACjC,YAAY,IAAI,MAAM,CAAA;IACtB,qEAAqE;IACrE,sBAAsB,IAAI,MAAM,CAAA;IAChC,mEAAmE;IACnE,0BAA0B,IAAI,MAAM,CAAA;IACpC,0CAA0C;IAC1C,WAAW,IAAI,MAAM,CAAA;IACrB,mEAAmE;IACnE,kBAAkB,IAAI,QAAQ,GAAG,IAAI,CAAA;IAErC,wFAAwF;IACxF,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI,CAAA;IAC5D,6DAA6D;IAC7D,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAChE,uEAAuE;IACvE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAE/D,kFAAkF;IAClF,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAC5D,kEAAkE;IAClE,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAChE,6DAA6D;IAC7D,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAChE"}
+{"version":3,"file":"account-info.d.ts","sourceRoot":"","sources":["../../src/auth/account-info.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;;OAIG;IACH,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,WAAW,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC;;;;OAIG;IACH,mBAAmB,CAAC,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpD,0EAA0E;IAC1E,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC7C,4EAA4E;IAC5E,OAAO,IAAI,wBAAwB,GAAG,IAAI,CAAA;IAC1C,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAA;IAEb,iCAAiC;IACjC,SAAS,IAAI,MAAM,CAAA;IACnB,mCAAmC;IACnC,cAAc,IAAI,MAAM,CAAA;IACxB,mCAAmC;IACnC,YAAY,IAAI,MAAM,CAAA;IACtB,iCAAiC;IACjC,YAAY,IAAI,MAAM,CAAA;IACtB,qEAAqE;IACrE,sBAAsB,IAAI,MAAM,CAAA;IAChC,mEAAmE;IACnE,0BAA0B,IAAI,MAAM,CAAA;IACpC,0CAA0C;IAC1C,WAAW,IAAI,MAAM,CAAA;IACrB,mEAAmE;IACnE,kBAAkB,IAAI,QAAQ,GAAG,IAAI,CAAA;IACrC,oEAAoE;IACpE,mBAAmB,IAAI,SAAS,QAAQ,EAAE,GAAG,IAAI,CAAA;IAEjD,wFAAwF;IACxF,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI,CAAA;IAC5D,6DAA6D;IAC7D,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAChE,uEAAuE;IACvE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAE/D,kFAAkF;IAClF,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAC5D,kEAAkE;IAClE,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAChE,6DAA6D;IAC7D,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAChE"}

package/dist/auth/account-info.d.ts

@@ -7,12 +7,42 @@ export interface UploadUrlEntry {
     /** Authorization token to include with the upload request. */
     readonly authorizationToken: string;
 }
+/**
+ * Optional extension for persistent auth stores that need to bind cached auth
+ * to the current client configuration. `B2Client` calls these hooks during
+ * construction before it reuses any loaded auth.
+ */
+export interface AuthContextAwareAccountInfo {
+    /**
+     * Bind persistent auth caches to the resolved realm URL. Implementations that
+     * persist auth should discard loaded state written for a different realm.
+     */
+    setRealmUrl(realmUrl: string): void;
+    /**
+     * Bind persistent auth caches to the configured application key ID.
+     * Implementations that persist auth should discard loaded state written for a
+     * different key ID.
+     */
+    setApplicationKeyId(applicationKeyId: string): void;
+}
 /**
  * Stores B2 authorization state between requests.
  * Implementations cache the authorize-account response and manage
  * pools of reusable upload URLs (checkout/checkin/evict pattern).
  */
 export interface AccountInfo {
+    /**
+     * @deprecated Persistent auth stores should implement
+     * {@link AuthContextAwareAccountInfo}. This optional hook remains for
+     * source compatibility with older integrations.
+     */
+    setRealmUrl?(realmUrl: string): void;
+    /**
+     * @deprecated Persistent auth stores should implement
+     * {@link AuthContextAwareAccountInfo}. This optional hook remains for
+     * source compatibility with older integrations.
+     */
+    setApplicationKeyId?(applicationKeyId: string): void;
     /** Store a fresh authorization response, replacing any previous state. */
     setAuth(auth: AuthorizeAccountResponse): void;
     /** Return the current authorization response, or null if not authorized. */
@@ -35,6 +65,8 @@ export interface AccountInfo {
     getS3ApiUrl(): string;
     /** Bucket ID the key is restricted to, or null if unrestricted. */
     getAllowedBucketId(): BucketId | null;
+    /** Bucket IDs the key is restricted to, or null if unrestricted. */
+    getAllowedBucketIds(): readonly BucketId[] | null;
     /** Take an upload URL from the pool for the given bucket, or null if none available. */
     checkoutUploadUrl(bucketId: BucketId): UploadUrlEntry | null;
     /** Return a still-valid upload URL to the pool for reuse. */

package/dist/auth/account-info.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-info.d.ts","sourceRoot":"","sources":["../../src/auth/account-info.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC7C,4EAA4E;IAC5E,OAAO,IAAI,wBAAwB,GAAG,IAAI,CAAA;IAC1C,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAA;IAEb,iCAAiC;IACjC,SAAS,IAAI,MAAM,CAAA;IACnB,mCAAmC;IACnC,cAAc,IAAI,MAAM,CAAA;IACxB,mCAAmC;IACnC,YAAY,IAAI,MAAM,CAAA;IACtB,iCAAiC;IACjC,YAAY,IAAI,MAAM,CAAA;IACtB,qEAAqE;IACrE,sBAAsB,IAAI,MAAM,CAAA;IAChC,mEAAmE;IACnE,0BAA0B,IAAI,MAAM,CAAA;IACpC,0CAA0C;IAC1C,WAAW,IAAI,MAAM,CAAA;IACrB,mEAAmE;IACnE,kBAAkB,IAAI,QAAQ,GAAG,IAAI,CAAA;IAErC,wFAAwF;IACxF,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI,CAAA;IAC5D,6DAA6D;IAC7D,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAChE,uEAAuE;IACvE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAE/D,kFAAkF;IAClF,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAC5D,kEAAkE;IAClE,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAChE,6DAA6D;IAC7D,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAChE"}
+{"version":3,"file":"account-info.d.ts","sourceRoot":"","sources":["../../src/auth/account-info.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;;OAIG;IACH,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,WAAW,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC;;;;OAIG;IACH,mBAAmB,CAAC,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpD,0EAA0E;IAC1E,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC7C,4EAA4E;IAC5E,OAAO,IAAI,wBAAwB,GAAG,IAAI,CAAA;IAC1C,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAA;IAEb,iCAAiC;IACjC,SAAS,IAAI,MAAM,CAAA;IACnB,mCAAmC;IACnC,cAAc,IAAI,MAAM,CAAA;IACxB,mCAAmC;IACnC,YAAY,IAAI,MAAM,CAAA;IACtB,iCAAiC;IACjC,YAAY,IAAI,MAAM,CAAA;IACtB,qEAAqE;IACrE,sBAAsB,IAAI,MAAM,CAAA;IAChC,mEAAmE;IACnE,0BAA0B,IAAI,MAAM,CAAA;IACpC,0CAA0C;IAC1C,WAAW,IAAI,MAAM,CAAA;IACrB,mEAAmE;IACnE,kBAAkB,IAAI,QAAQ,GAAG,IAAI,CAAA;IACrC,oEAAoE;IACpE,mBAAmB,IAAI,SAAS,QAAQ,EAAE,GAAG,IAAI,CAAA;IAEjD,wFAAwF;IACxF,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI,CAAA;IAC5D,6DAA6D;IAC7D,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAChE,uEAAuE;IACvE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAE/D,kFAAkF;IAClF,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAC5D,kEAAkE;IAClE,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAChE,6DAA6D;IAC7D,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAChE"}