@backblaze-labs/b2-sdk 0.1.0 → 0.3.0

package/dist/simulator/validation.js

@@ -1,174 +1,762 @@
 import { utf8Encoder } from "../util/text-codec.js";
-const BUCKET_NAME_MIN = 6;
-const BUCKET_NAME_MAX = 63;
-const BUCKET_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]$/;
-const BUCKET_NAME_RESERVED_PREFIX = "b2-";
+import { BucketRetentionMode, BucketType, CorsOperation } from "../types/bucket.js";
+import { Capability } from "../types/auth.js";
+import { EventType } from "../types/notifications.js";
+import { BUCKET_NAME_MAX, BUCKET_NAME_MIN, FILE_NAME_MAX_BYTES, getB2FileNameByteLength, hasB2FileNameControlCharacter, hasValidB2BucketNameShape, isB2BucketNameIpv4Address } from "../internal/b2-naming.js";
+//#region src/simulator/validation.ts
+/**
+* B2 spec-compliance validation helpers for the simulator.
+*
+* Each function mirrors a documented B2 input limit (file name length,
+* bucket name regex, file-info byte budget, etc.). Validators return
+* `null` for valid input or a `{ code, message }` pair that the handler
+* converts into a synthetic `400`/`403` response with the right B2
+* error code.
+*
+* Keeping validation in one module makes the simulator's "what does B2
+* reject?" surface auditable in a single file. Doc references inline at
+* each rule so the spec source is immediate.
+*
+* @packageDocumentation
+*/
+/** Minimum length for application key names. */
+var KEY_NAME_MIN = 1;
+/** Maximum length for application key names. */
+var KEY_NAME_MAX = 100;
+var VALID_CAPABILITIES = new Set(Object.values(Capability));
+/**
+* Validates application-key capabilities against B2's supported capability set.
+*
+* @param capabilities - Caller-supplied capabilities array.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-create-key
+*/
+function validateCreateKeyCapabilities(capabilities) {
+	if (!Array.isArray(capabilities)) return {
+		code: "bad_request",
+		message: "capabilities must be an array"
+	};
+	if (capabilities.length === 0) return {
+		code: "bad_request",
+		message: "capabilities must not be empty"
+	};
+	const unknownCapabilities = capabilities.filter((capability) => typeof capability !== "string" || !VALID_CAPABILITIES.has(capability));
+	if (unknownCapabilities.length > 0) return {
+		code: "bad_request",
+		message: `unknown capabilities: ${unknownCapabilities.map(String).join(", ")}`
+	};
+	return null;
+}
+/**
+* Returns a frozen copy of a previously validated application-key capability list.
+*
+* @param capabilities - Validated caller-supplied capabilities.
+*
+* @returns An immutable capability list safe to store internally.
+*/
+function normalizeCreateKeyCapabilities(capabilities) {
+	return Object.freeze([...capabilities]);
+}
+/**
+* Validates application-key names against B2's documented length limits.
+*
+* @param keyName - Caller-supplied keyName.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-create-key
+*/
+function validateCreateKeyName(keyName) {
+	if (typeof keyName !== "string") return {
+		code: "bad_request",
+		message: "keyName must be a string"
+	};
+	if (keyName.length < 1 || keyName.length > 100) return {
+		code: "bad_request",
+		message: `keyName must be 1-100 characters`
+	};
+	return null;
+}
+/**
+* Validates a bucket name against B2's documented rules.
+*
+* @param name - Caller-supplied bucket name.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-create-bucket
+*/
 function validateBucketName(name) {
-  if (typeof name !== "string" || name.length < BUCKET_NAME_MIN || name.length > BUCKET_NAME_MAX) {
-    return {
-      code: "invalid_bucket_name",
-      message: `bucketName must be ${BUCKET_NAME_MIN}-${BUCKET_NAME_MAX} characters`
-    };
-  }
-  if (!BUCKET_NAME_REGEX.test(name)) {
-    return {
-      code: "invalid_bucket_name",
-      message: "bucketName must contain only letters, digits, and hyphens; cannot start or end with a hyphen"
-    };
-  }
-  if (name.startsWith(BUCKET_NAME_RESERVED_PREFIX)) {
-    return {
-      code: "invalid_bucket_name",
-      message: `bucketName cannot start with the reserved prefix "${BUCKET_NAME_RESERVED_PREFIX}"`
-    };
-  }
-  return null;
-}
-const FILE_NAME_MAX_BYTES = 1024;
-const FILE_NAME_DEL = 127;
+	if (typeof name !== "string" || name.length < 6 || name.length > 63) return {
+		code: "invalid_bucket_name",
+		message: `bucketName must be 6-63 characters`
+	};
+	if (isB2BucketNameIpv4Address(name)) return {
+		code: "invalid_bucket_name",
+		message: "bucketName must not be formatted as an IPv4 address"
+	};
+	if (!hasValidB2BucketNameShape(name)) return {
+		code: "invalid_bucket_name",
+		message: "bucketName must contain only letters, digits, hyphens, and periods; cannot start or end with punctuation or contain consecutive periods"
+	};
+	if (name.startsWith("b2-")) return {
+		code: "invalid_bucket_name",
+		message: `bucketName cannot start with the reserved prefix "b2-"`
+	};
+	return null;
+}
+/**
+* Validates a file name against B2's documented rules. Mirrors the
+* server-side checks B2 runs on `b2_upload_file` / `b2_hide_file` /
+* `b2_start_large_file` / `b2_copy_file` filename inputs.
+*
+* @param name - Caller-supplied file name (raw, unencoded).
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-upload-file
+*/
 function validateFileName(name) {
-  if (typeof name !== "string" || name.length === 0) {
-    return { code: "invalid_file_name", message: "fileName must be a non-empty string" };
-  }
-  const bytes = utf8Encoder.encode(name);
-  if (bytes.byteLength > FILE_NAME_MAX_BYTES) {
-    return {
-      code: "invalid_file_name",
-      message: `fileName exceeds the 1024-byte UTF-8 limit (got ${bytes.byteLength})`
-    };
-  }
-  for (let i = 0; i < name.length; i++) {
-    const code = name.charCodeAt(i);
-    if (code < 32 || code === FILE_NAME_DEL) {
-      return {
-        code: "invalid_file_name",
-        message: "fileName must not contain control characters (U+0000-U+001F or U+007F)"
-      };
-    }
-  }
-  if (name === "." || name === "..") {
-    return {
-      code: "invalid_file_name",
-      message: 'fileName cannot be exactly "." or ".."'
-    };
-  }
-  if (name.startsWith("/") || name.endsWith("/") || name.includes("//")) {
-    return {
-      code: "invalid_file_name",
-      message: 'fileName cannot start with "/", end with "/", or contain "//"'
-    };
-  }
-  return null;
-}
-const FILE_INFO_TOTAL_MAX = 2048;
-const FILE_INFO_VALUE_MAX = 2048;
-const FILE_INFO_KEY_REGEX = /^[a-zA-Z0-9_-]+$/;
+	if (typeof name !== "string" || name.length === 0) return {
+		code: "invalid_file_name",
+		message: "fileName must be a non-empty string"
+	};
+	if (getB2FileNameByteLength(name) === null) return {
+		code: "invalid_file_name",
+		message: "fileName exceeds the 1024-byte UTF-8 limit"
+	};
+	if (hasB2FileNameControlCharacter(name)) return {
+		code: "invalid_file_name",
+		message: "fileName must not contain control characters (U+0000-U+001F or U+007F)"
+	};
+	if (name === "." || name === "..") return {
+		code: "invalid_file_name",
+		message: "fileName cannot be exactly \".\" or \"..\""
+	};
+	if (name.startsWith("/") || name.endsWith("/") || name.includes("//")) return {
+		code: "invalid_file_name",
+		message: "fileName cannot start with \"/\", end with \"/\", or contain \"//\""
+	};
+	return null;
+}
+/** Per-file fileInfo total size cap (sum of key+value bytes). */
+var FILE_INFO_TOTAL_MAX = 2048;
+/** Per-key fileInfo value byte cap. */
+var FILE_INFO_VALUE_MAX = 2048;
+/** Allowed key character set (case-insensitive). */
+var FILE_INFO_KEY_REGEX = /^[a-zA-Z0-9_-]+$/;
+/**
+* Validates a `fileInfo` record against B2's byte-budget and
+* key-shape rules.
+*
+* @param info - Caller-supplied fileInfo record.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-upload-file
+*/
 function validateFileInfo(info) {
-  let total = 0;
-  for (const [key, value] of Object.entries(info)) {
-    if (!FILE_INFO_KEY_REGEX.test(key)) {
-      return {
-        code: "invalid_file_info",
-        message: `fileInfo key "${key}" must match ^[a-zA-Z0-9_-]+$`
-      };
-    }
-    if (typeof value !== "string") {
-      return { code: "invalid_file_info", message: `fileInfo value for "${key}" must be a string` };
-    }
-    const keyBytes = utf8Encoder.encode(key).byteLength;
-    const valueBytes = utf8Encoder.encode(value).byteLength;
-    if (valueBytes > FILE_INFO_VALUE_MAX) {
-      return {
-        code: "invalid_file_info",
-        message: `fileInfo value for "${key}" exceeds ${FILE_INFO_VALUE_MAX} bytes`
-      };
-    }
-    total += keyBytes + valueBytes;
-  }
-  if (total > FILE_INFO_TOTAL_MAX) {
-    return {
-      code: "invalid_file_info",
-      message: `fileInfo total size ${total} bytes exceeds the ${FILE_INFO_TOTAL_MAX}-byte limit`
-    };
-  }
-  return null;
-}
-const BUCKET_INFO_MAX_KEYS = 10;
-const BUCKET_INFO_VALUE_MAX = 2048;
-const BUCKET_INFO_KEY_REGEX = /^[a-zA-Z0-9_-]+$/;
+	let total = 0;
+	for (const [key, value] of Object.entries(info)) {
+		if (!FILE_INFO_KEY_REGEX.test(key)) return {
+			code: "invalid_file_info",
+			message: `fileInfo key "${key}" must match ^[a-zA-Z0-9_-]+$`
+		};
+		if (typeof value !== "string") return {
+			code: "invalid_file_info",
+			message: `fileInfo value for "${key}" must be a string`
+		};
+		const keyBytes = utf8Encoder.encode(key).byteLength;
+		const valueBytes = utf8Encoder.encode(value).byteLength;
+		if (valueBytes > 2048) return {
+			code: "invalid_file_info",
+			message: `fileInfo value for "${key}" exceeds ${FILE_INFO_VALUE_MAX} bytes`
+		};
+		total += keyBytes + valueBytes;
+	}
+	if (total > 2048) return {
+		code: "invalid_file_info",
+		message: `fileInfo total size ${total} bytes exceeds the ${FILE_INFO_TOTAL_MAX}-byte limit`
+	};
+	return null;
+}
+/** Per-bucket bucketInfo total max keys. */
+var BUCKET_INFO_MAX_KEYS = 10;
+/** Per-key bucketInfo value byte cap. */
+var BUCKET_INFO_VALUE_MAX = 2048;
+/** Allowed key character set for bucketInfo. */
+var BUCKET_INFO_KEY_REGEX = /^[a-zA-Z0-9_-]+$/;
+/**
+* Validates a `bucketInfo` record against B2's per-bucket metadata rules.
+*
+* @param info - Caller-supplied bucketInfo record.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-create-bucket
+*/
 function validateBucketInfo(info) {
-  const entries = Object.entries(info);
-  if (entries.length > BUCKET_INFO_MAX_KEYS) {
-    return {
-      code: "invalid_bucket_info",
-      message: `bucketInfo cannot have more than ${BUCKET_INFO_MAX_KEYS} keys (got ${entries.length})`
-    };
-  }
-  for (const [key, value] of entries) {
-    if (!BUCKET_INFO_KEY_REGEX.test(key)) {
-      return {
-        code: "invalid_bucket_info",
-        message: `bucketInfo key "${key}" must match ^[a-zA-Z0-9_-]+$`
-      };
-    }
-    if (typeof value !== "string") {
-      return {
-        code: "invalid_bucket_info",
-        message: `bucketInfo value for "${key}" must be a string`
-      };
-    }
-    const valueBytes = utf8Encoder.encode(value).byteLength;
-    if (valueBytes > BUCKET_INFO_VALUE_MAX) {
-      return {
-        code: "invalid_bucket_info",
-        message: `bucketInfo value for "${key}" exceeds ${BUCKET_INFO_VALUE_MAX} bytes`
-      };
-    }
-  }
-  return null;
-}
-const LIST_ENDPOINT_CAPS = {
-  /** `b2_list_file_names.maxFileCount` cap. */
-  b2_list_file_names: 1e4,
-  /** `b2_list_file_versions.maxFileCount` cap. */
-  b2_list_file_versions: 1e4,
-  /** `b2_list_unfinished_large_files.maxFileCount` cap. */
-  b2_list_unfinished_large_files: 100,
-  /** `b2_list_keys.maxKeyCount` cap. */
-  b2_list_keys: 1e4,
-  /** `b2_list_parts.maxPartCount` cap. */
-  b2_list_parts: 1e4
+	const entries = Object.entries(info);
+	if (entries.length > 10) return {
+		code: "invalid_bucket_info",
+		message: `bucketInfo cannot have more than 10 keys (got ${entries.length})`
+	};
+	for (const [key, value] of entries) {
+		if (!BUCKET_INFO_KEY_REGEX.test(key)) return {
+			code: "invalid_bucket_info",
+			message: `bucketInfo key "${key}" must match ^[a-zA-Z0-9_-]+$`
+		};
+		if (typeof value !== "string") return {
+			code: "invalid_bucket_info",
+			message: `bucketInfo value for "${key}" must be a string`
+		};
+		if (utf8Encoder.encode(value).byteLength > 2048) return {
+			code: "invalid_bucket_info",
+			message: `bucketInfo value for "${key}" exceeds ${BUCKET_INFO_VALUE_MAX} bytes`
+		};
+	}
+	return null;
+}
+/**
+* Per-endpoint upper bound on the `maxFileCount` (or `maxKeyCount` /
+* `maxPartCount`) request field. Sourced from the B2 endpoint docs.
+*/
+var LIST_ENDPOINT_CAPS = {
+	/** `b2_list_file_names.maxFileCount` cap. */
+	b2_list_file_names: 1e4,
+	/** `b2_list_file_versions.maxFileCount` cap. */
+	b2_list_file_versions: 1e4,
+	/** `b2_list_unfinished_large_files.maxFileCount` cap. */
+	b2_list_unfinished_large_files: 100,
+	/** `b2_list_keys.maxKeyCount` cap. */
+	b2_list_keys: 1e4,
+	/** `b2_list_parts.maxPartCount` cap. */
+	b2_list_parts: 1e4
 };
+/**
+* Validates a `maxFileCount` (or `maxKeyCount` / `maxPartCount`) value
+* against the per-endpoint cap documented by B2.
+*
+* @param requested - Caller-supplied count.
+* @param endpoint - Which list endpoint this applies to.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*/
 function validateMaxCount(requested, endpoint) {
-  if (requested === void 0) return null;
-  if (!Number.isInteger(requested) || requested < 1) {
-    return {
-      code: "bad_request",
-      message: `maxFileCount must be a positive integer (got ${requested})`
-    };
-  }
-  const cap = LIST_ENDPOINT_CAPS[endpoint];
-  if (requested > cap) {
-    return {
-      code: "bad_request",
-      message: `maxFileCount ${requested} exceeds the ${endpoint} cap of ${cap}`
-    };
-  }
-  return null;
-}
-export {
-  BUCKET_INFO_MAX_KEYS,
-  BUCKET_INFO_VALUE_MAX,
-  BUCKET_NAME_MAX,
-  BUCKET_NAME_MIN,
-  FILE_INFO_TOTAL_MAX,
-  FILE_INFO_VALUE_MAX,
-  FILE_NAME_MAX_BYTES,
-  LIST_ENDPOINT_CAPS,
-  validateBucketInfo,
-  validateBucketName,
-  validateFileInfo,
-  validateFileName,
-  validateMaxCount
-};
-//# sourceMappingURL=validation.js.map
+	if (requested === void 0) return null;
+	if (!Number.isInteger(requested) || requested < 1) return {
+		code: "bad_request",
+		message: `maxFileCount must be a positive integer (got ${requested})`
+	};
+	const cap = LIST_ENDPOINT_CAPS[endpoint];
+	if (requested > cap) return {
+		code: "bad_request",
+		message: `maxFileCount ${requested} exceeds the ${endpoint} cap of ${cap}`
+	};
+	return null;
+}
+/** Minimum `b2_get_download_authorization.validDurationInSeconds`. */
+var DOWNLOAD_AUTH_DURATION_MIN_SECONDS = 1;
+/** Maximum `b2_get_download_authorization.validDurationInSeconds`. */
+var DOWNLOAD_AUTH_DURATION_MAX_SECONDS = 604800;
+/**
+* Validates a `b2_get_download_authorization` duration against B2's
+* documented inclusive 1-second to 7-day range.
+*
+* @param requested - Caller-supplied duration in seconds.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*/
+function validateDownloadAuthorizationDuration(requested) {
+	if (typeof requested !== "number" || !Number.isInteger(requested) || requested < 1 || requested > 604800) return {
+		code: "bad_request",
+		message: `validDurationInSeconds must be an integer from 1 through ${DOWNLOAD_AUTH_DURATION_MAX_SECONDS}`
+	};
+	return null;
+}
+/**
+* Validates a `b2_get_download_authorization` file name prefix.
+*
+* B2 allows an empty prefix, but the field must still be present as a
+* string so later prefix checks cannot crash on malformed request bodies.
+*
+* @param requested - Caller-supplied file name prefix.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*/
+function validateDownloadAuthorizationPrefix(requested) {
+	if (typeof requested !== "string") return {
+		code: "bad_request",
+		message: "fileNamePrefix must be a string"
+	};
+	return null;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateKnownFields(value, allowedFields, path) {
+	for (const field of Object.keys(value)) if (!allowedFields.has(field)) return {
+		code: "bad_request",
+		message: `${path}.${field} is not a supported field`
+	};
+	return null;
+}
+function validateStringArray(value, path, options = {}) {
+	if (value === null && options.allowNull === true) return null;
+	if (!Array.isArray(value)) return {
+		code: "bad_request",
+		message: `${path} must be an array of strings`
+	};
+	if (options.requireNonEmpty === true && value.length === 0) return {
+		code: "bad_request",
+		message: `${path} must be a non-empty array`
+	};
+	for (const [index, item] of value.entries()) if (typeof item !== "string") return {
+		code: "bad_request",
+		message: `${path}[${index}] must be a string`
+	};
+	return null;
+}
+function validateNonEmptyString(value, path) {
+	if (typeof value !== "string" || value.length === 0) return {
+		code: "bad_request",
+		message: `${path} must be a non-empty string`
+	};
+	return null;
+}
+function validateNonNegativeInteger(value, path) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) return {
+		code: "bad_request",
+		message: `${path} must be a non-negative integer`
+	};
+	return null;
+}
+function validateIntegerAtMost(value, max, path) {
+	if (value > max) return {
+		code: "bad_request",
+		message: `${path} must not exceed ${max}`
+	};
+	return null;
+}
+function validatePositiveInteger(value, path) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) return {
+		code: "bad_request",
+		message: `${path} must be a positive integer`
+	};
+	return null;
+}
+function validateNullablePositiveInteger(value, path) {
+	if (value === void 0 || value === null) return null;
+	return validatePositiveInteger(value, path);
+}
+function validateUniqueName(names, name, path) {
+	if (names.has(name)) return {
+		code: "bad_request",
+		message: `${path} must be unique`
+	};
+	names.add(name);
+	return null;
+}
+var KNOWN_BUCKET_TYPES = new Set(Object.values(BucketType));
+/**
+* Validates a `b2_list_buckets.bucketTypes` filter.
+*
+* @param bucketTypes - Caller-supplied bucket type filter.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-list-buckets
+*/
+function validateBucketTypes(bucketTypes) {
+	if (bucketTypes === void 0) return null;
+	if (!Array.isArray(bucketTypes)) return {
+		code: "bad_request",
+		message: "bucketTypes must be an array"
+	};
+	for (const [index, bucketType] of bucketTypes.entries()) if (typeof bucketType !== "string" || !KNOWN_BUCKET_TYPES.has(bucketType)) return {
+		code: "bad_request",
+		message: `bucketTypes[${index}] must be a known bucket type`
+	};
+	return null;
+}
+var CORS_RULE_FIELDS = /* @__PURE__ */ new Set([
+	"allowedHeaders",
+	"allowedOperations",
+	"allowedOrigins",
+	"corsRuleName",
+	"exposeHeaders",
+	"maxAgeSeconds"
+]);
+var CORS_MAX_AGE_SECONDS_MAX = 86400;
+var KNOWN_CORS_OPERATIONS = new Set(Object.values(CorsOperation));
+/**
+* Validates B2 CORS rule structure for bucket create/update requests.
+*
+* @param rules - Caller-supplied CORS rules.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/docs/cloud-storage-cross-origin-resource-sharing-rules
+*/
+function validateCorsRules(rules) {
+	if (!Array.isArray(rules)) return {
+		code: "bad_request",
+		message: "corsRules must be an array"
+	};
+	const names = /* @__PURE__ */ new Set();
+	for (const [index, rule] of rules.entries()) {
+		const rulePath = `corsRules[${index}]`;
+		if (!isRecord(rule)) return {
+			code: "bad_request",
+			message: `${rulePath} must be an object`
+		};
+		const fieldError = validateKnownFields(rule, CORS_RULE_FIELDS, rulePath);
+		if (fieldError) return fieldError;
+		const nameError = validateNonEmptyString(rule["corsRuleName"], `${rulePath}.corsRuleName`);
+		if (nameError) return nameError;
+		const ruleName = rule["corsRuleName"];
+		const uniqueNameError = validateUniqueName(names, ruleName, `${rulePath}.corsRuleName`);
+		if (uniqueNameError) return uniqueNameError;
+		const originsError = validateStringArray(rule["allowedOrigins"], `${rulePath}.allowedOrigins`, { requireNonEmpty: true });
+		if (originsError) return originsError;
+		const operationsError = validateStringArray(rule["allowedOperations"], `${rulePath}.allowedOperations`, { requireNonEmpty: true });
+		if (operationsError) return operationsError;
+		for (const operation of rule["allowedOperations"]) if (!KNOWN_CORS_OPERATIONS.has(operation)) return {
+			code: "bad_request",
+			message: `${rulePath}.allowedOperations contains an unknown operation`
+		};
+		const headersError = validateStringArray(rule["allowedHeaders"], `${rulePath}.allowedHeaders`, { allowNull: true });
+		if (headersError) return headersError;
+		const exposeError = validateStringArray(rule["exposeHeaders"], `${rulePath}.exposeHeaders`, { allowNull: true });
+		if (exposeError) return exposeError;
+		const ageError = validateNonNegativeInteger(rule["maxAgeSeconds"], `${rulePath}.maxAgeSeconds`);
+		if (ageError) return ageError;
+		const maxAgeError = validateIntegerAtMost(rule["maxAgeSeconds"], CORS_MAX_AGE_SECONDS_MAX, `${rulePath}.maxAgeSeconds`);
+		if (maxAgeError) return maxAgeError;
+	}
+	return null;
+}
+var LIFECYCLE_RULE_FIELDS = /* @__PURE__ */ new Set([
+	"daysFromHidingToDeleting",
+	"daysFromStartingToCancelingUnfinishedLargeFiles",
+	"daysFromUploadingToHiding",
+	"fileNamePrefix"
+]);
+/**
+* Validates B2 lifecycle rule structure for bucket create/update requests.
+*
+* @param rules - Caller-supplied lifecycle rules.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/docs/cloud-storage-lifecycle-rules
+*/
+function validateLifecycleRules(rules) {
+	if (!Array.isArray(rules)) return {
+		code: "bad_request",
+		message: "lifecycleRules must be an array"
+	};
+	for (const [index, rule] of rules.entries()) {
+		const rulePath = `lifecycleRules[${index}]`;
+		if (!isRecord(rule)) return {
+			code: "bad_request",
+			message: `${rulePath} must be an object`
+		};
+		const fieldError = validateKnownFields(rule, LIFECYCLE_RULE_FIELDS, rulePath);
+		if (fieldError) return fieldError;
+		const deletingError = validateNullablePositiveInteger(rule["daysFromHidingToDeleting"], `${rulePath}.daysFromHidingToDeleting`);
+		if (deletingError) return deletingError;
+		const hidingError = validateNullablePositiveInteger(rule["daysFromUploadingToHiding"], `${rulePath}.daysFromUploadingToHiding`);
+		if (hidingError) return hidingError;
+		const cancelError = validateNullablePositiveInteger(rule["daysFromStartingToCancelingUnfinishedLargeFiles"], `${rulePath}.daysFromStartingToCancelingUnfinishedLargeFiles`);
+		if (cancelError) return cancelError;
+		if (rule["daysFromHidingToDeleting"] == null && rule["daysFromUploadingToHiding"] == null && rule["daysFromStartingToCancelingUnfinishedLargeFiles"] == null) return {
+			code: "bad_request",
+			message: `${rulePath} must set at least one lifecycle action`
+		};
+		if (typeof rule["fileNamePrefix"] !== "string") return {
+			code: "bad_request",
+			message: `${rulePath}.fileNamePrefix must be a string`
+		};
+	}
+	return null;
+}
+var DEFAULT_RETENTION_FIELDS = /* @__PURE__ */ new Set(["mode", "period"]);
+var RETENTION_PERIOD_FIELDS = /* @__PURE__ */ new Set(["duration", "unit"]);
+var DEFAULT_RETENTION_MODES = new Set(Object.values(BucketRetentionMode));
+var OBJECT_LOCK_RETENTION_MAX_DAYS = 3e3;
+/**
+* Validates default Object Lock retention policy structure for bucket requests.
+*
+* @param policy - Caller-supplied default retention policy.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/docs/cloud-storage-object-lock
+*/
+function validateDefaultRetention(policy) {
+	if (!isRecord(policy)) return {
+		code: "bad_request",
+		message: "defaultRetention must be an object"
+	};
+	const fieldError = validateKnownFields(policy, DEFAULT_RETENTION_FIELDS, "defaultRetention");
+	if (fieldError) return fieldError;
+	const mode = policy["mode"];
+	if (typeof mode !== "string" || !DEFAULT_RETENTION_MODES.has(mode)) return {
+		code: "bad_request",
+		message: "defaultRetention.mode must be \"compliance\", \"governance\", or \"none\""
+	};
+	const period = policy["period"];
+	if (mode === BucketRetentionMode.None) {
+		if (period !== null) return {
+			code: "bad_request",
+			message: "defaultRetention.period must be null when mode is \"none\""
+		};
+		return null;
+	}
+	if (!isRecord(period)) return {
+		code: "bad_request",
+		message: "defaultRetention.period must be an object for retention modes"
+	};
+	const periodFieldError = validateKnownFields(period, RETENTION_PERIOD_FIELDS, "defaultRetention.period");
+	if (periodFieldError) return periodFieldError;
+	const durationError = validatePositiveInteger(period["duration"], "defaultRetention.period.duration");
+	if (durationError) return durationError;
+	if (!Number.isSafeInteger(period["duration"])) return {
+		code: "bad_request",
+		message: "defaultRetention.period.duration must be a safe integer"
+	};
+	if (period["unit"] !== "days" && period["unit"] !== "years") return {
+		code: "bad_request",
+		message: "defaultRetention.period.unit must be \"days\" or \"years\""
+	};
+	const durationDays = period["unit"] === "days" ? period["duration"] : period["duration"] * 365;
+	if (!Number.isFinite(durationDays) || durationDays > OBJECT_LOCK_RETENTION_MAX_DAYS) return {
+		code: "bad_request",
+		message: `defaultRetention.period must not exceed ${OBJECT_LOCK_RETENTION_MAX_DAYS} days`
+	};
+	return null;
+}
+var REPLICATION_CONFIG_FIELDS = /* @__PURE__ */ new Set(["asReplicationSource", "asReplicationDestination"]);
+var REPLICATION_SOURCE_FIELDS = /* @__PURE__ */ new Set(["replicationRules", "sourceApplicationKeyId"]);
+var REPLICATION_DESTINATION_FIELDS = /* @__PURE__ */ new Set(["sourceToDestinationKeyMapping"]);
+var REPLICATION_RULE_FIELDS = /* @__PURE__ */ new Set([
+	"destinationBucketId",
+	"fileNamePrefix",
+	"includeExistingFiles",
+	"isEnabled",
+	"priority",
+	"replicationRuleName"
+]);
+function validateReplicationRule(rule, rulePath) {
+	if (!isRecord(rule)) return {
+		code: "bad_request",
+		message: `${rulePath} must be an object`
+	};
+	const fieldError = validateKnownFields(rule, REPLICATION_RULE_FIELDS, rulePath);
+	if (fieldError) return fieldError;
+	const destinationError = validateNonEmptyString(rule["destinationBucketId"], `${rulePath}.destinationBucketId`);
+	if (destinationError) return destinationError;
+	if (typeof rule["fileNamePrefix"] !== "string") return {
+		code: "bad_request",
+		message: `${rulePath}.fileNamePrefix must be a string`
+	};
+	if (typeof rule["includeExistingFiles"] !== "boolean") return {
+		code: "bad_request",
+		message: `${rulePath}.includeExistingFiles must be a boolean`
+	};
+	if (typeof rule["isEnabled"] !== "boolean") return {
+		code: "bad_request",
+		message: `${rulePath}.isEnabled must be a boolean`
+	};
+	const priorityError = validatePositiveInteger(rule["priority"], `${rulePath}.priority`);
+	if (priorityError) return priorityError;
+	const nameError = validateNonEmptyString(rule["replicationRuleName"], `${rulePath}.replicationRuleName`);
+	if (nameError) return nameError;
+	return null;
+}
+function validateReplicationSource(source) {
+	if (!isRecord(source)) return {
+		code: "bad_request",
+		message: "replicationConfiguration.asReplicationSource must be an object"
+	};
+	const fieldError = validateKnownFields(source, REPLICATION_SOURCE_FIELDS, "replicationConfiguration.asReplicationSource");
+	if (fieldError) return fieldError;
+	const sourceKeyError = validateNonEmptyString(source["sourceApplicationKeyId"], "replicationConfiguration.asReplicationSource.sourceApplicationKeyId");
+	if (sourceKeyError) return sourceKeyError;
+	const rules = source["replicationRules"];
+	if (!Array.isArray(rules)) return {
+		code: "bad_request",
+		message: "replicationConfiguration.asReplicationSource.replicationRules must be an array"
+	};
+	const names = /* @__PURE__ */ new Set();
+	for (const [index, rule] of rules.entries()) {
+		const rulePath = `replicationConfiguration.asReplicationSource.replicationRules[${index}]`;
+		const ruleError = validateReplicationRule(rule, rulePath);
+		if (ruleError) return ruleError;
+		const ruleName = rule["replicationRuleName"];
+		const uniqueNameError = validateUniqueName(names, ruleName, `${rulePath}.replicationRuleName`);
+		if (uniqueNameError) return uniqueNameError;
+	}
+	return null;
+}
+function validateReplicationDestination(destination) {
+	if (!isRecord(destination)) return {
+		code: "bad_request",
+		message: "replicationConfiguration.asReplicationDestination must be an object"
+	};
+	const fieldError = validateKnownFields(destination, REPLICATION_DESTINATION_FIELDS, "replicationConfiguration.asReplicationDestination");
+	if (fieldError) return fieldError;
+	const mapping = destination["sourceToDestinationKeyMapping"];
+	if (!isRecord(mapping)) return {
+		code: "bad_request",
+		message: "replicationConfiguration.asReplicationDestination.sourceToDestinationKeyMapping must be an object"
+	};
+	for (const [sourceKey, destinationKey] of Object.entries(mapping)) {
+		if (sourceKey.length === 0) return {
+			code: "bad_request",
+			message: "replicationConfiguration.asReplicationDestination.sourceToDestinationKeyMapping keys must be non-empty"
+		};
+		if (typeof destinationKey !== "string" || destinationKey.length === 0) return {
+			code: "bad_request",
+			message: "replicationConfiguration.asReplicationDestination.sourceToDestinationKeyMapping values must be non-empty strings"
+		};
+	}
+	return null;
+}
+/**
+* Validates B2 replication configuration structure for bucket requests.
+*
+* @param config - Caller-supplied replication configuration.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-update-bucket
+*/
+function validateReplicationConfiguration(config) {
+	if (!isRecord(config)) return {
+		code: "bad_request",
+		message: "replicationConfiguration must be an object"
+	};
+	const fieldError = validateKnownFields(config, REPLICATION_CONFIG_FIELDS, "replicationConfiguration");
+	if (fieldError) return fieldError;
+	if (!("asReplicationSource" in config) && !("asReplicationDestination" in config)) return {
+		code: "bad_request",
+		message: "replicationConfiguration must include asReplicationSource or asReplicationDestination"
+	};
+	const source = config["asReplicationSource"];
+	if (source !== void 0 && source !== null) {
+		const sourceError = validateReplicationSource(source);
+		if (sourceError) return sourceError;
+	}
+	const destination = config["asReplicationDestination"];
+	if (destination !== void 0 && destination !== null) {
+		const destinationError = validateReplicationDestination(destination);
+		if (destinationError) return destinationError;
+	}
+	return null;
+}
+var NOTIFICATION_RULE_FIELDS = /* @__PURE__ */ new Set([
+	"eventTypes",
+	"isEnabled",
+	"isSuspended",
+	"maxEventsPerBatch",
+	"name",
+	"objectNamePrefix",
+	"suspensionReason",
+	"targetConfiguration"
+]);
+var NOTIFICATION_TARGET_FIELDS = /* @__PURE__ */ new Set([
+	"customHeaders",
+	"hmacSha256SigningSecret",
+	"targetType",
+	"url"
+]);
+var KNOWN_NOTIFICATION_EVENT_TYPES = new Set(Object.values(EventType));
+/**
+* Validates event notification rules for `b2_set_bucket_notification_rules`.
+*
+* @param rules - Caller-supplied event notification rules.
+*
+* @returns A `{ code, message }` pair on failure, or `null` when valid.
+*
+* @see https://www.backblaze.com/apidocs/b2-set-bucket-notification-rules
+*/
+function validateNotificationRules(rules) {
+	if (!Array.isArray(rules)) return {
+		code: "bad_request",
+		message: "eventNotificationRules must be an array"
+	};
+	const names = /* @__PURE__ */ new Set();
+	for (const [index, ruleValue] of rules.entries()) {
+		const rulePath = `eventNotificationRules[${index}]`;
+		if (!isRecord(ruleValue)) return {
+			code: "bad_request",
+			message: `${rulePath} must be an object`
+		};
+		const fieldError = validateKnownFields(ruleValue, NOTIFICATION_RULE_FIELDS, rulePath);
+		if (fieldError) return fieldError;
+		if (typeof ruleValue["isEnabled"] !== "boolean") return {
+			code: "bad_request",
+			message: `${rulePath}.isEnabled must be a boolean`
+		};
+		const maxEventsPerBatch = ruleValue["maxEventsPerBatch"];
+		if (maxEventsPerBatch !== void 0 && (typeof maxEventsPerBatch !== "number" || !Number.isInteger(maxEventsPerBatch) || maxEventsPerBatch < 1)) return {
+			code: "bad_request",
+			message: `${rulePath}.maxEventsPerBatch must be a positive integer`
+		};
+		const name = ruleValue["name"];
+		if (typeof name !== "string" || name.length === 0) return {
+			code: "bad_request",
+			message: `${rulePath}.name must be a non-empty string`
+		};
+		if (names.has(name)) return {
+			code: "bad_request",
+			message: `${rulePath}.name must be unique within eventNotificationRules`
+		};
+		names.add(name);
+		const eventTypes = ruleValue["eventTypes"];
+		if (!Array.isArray(eventTypes) || eventTypes.length === 0) return {
+			code: "bad_request",
+			message: `${rulePath}.eventTypes must be a non-empty array`
+		};
+		for (const eventType of eventTypes) if (typeof eventType !== "string" || !KNOWN_NOTIFICATION_EVENT_TYPES.has(eventType)) return {
+			code: "bad_request",
+			message: `${rulePath}.eventTypes contains an unknown event type`
+		};
+		const targetConfiguration = ruleValue["targetConfiguration"];
+		if (!isRecord(targetConfiguration)) return {
+			code: "bad_request",
+			message: `${rulePath}.targetConfiguration must be an object`
+		};
+		const targetFieldError = validateKnownFields(targetConfiguration, NOTIFICATION_TARGET_FIELDS, `${rulePath}.targetConfiguration`);
+		if (targetFieldError) return targetFieldError;
+		if (targetConfiguration["targetType"] !== "webhook") return {
+			code: "bad_request",
+			message: `${rulePath}.targetConfiguration.targetType must be "webhook"`
+		};
+		const url = targetConfiguration["url"];
+		if (typeof url !== "string") return {
+			code: "bad_request",
+			message: `${rulePath}.targetConfiguration.url must be a valid https URL`
+		};
+		try {
+			if (new URL(url).protocol !== "https:") return {
+				code: "bad_request",
+				message: `${rulePath}.targetConfiguration.url must be a valid https URL`
+			};
+		} catch {
+			return {
+				code: "bad_request",
+				message: `${rulePath}.targetConfiguration.url must be a valid https URL`
+			};
+		}
+	}
+	return null;
+}
+//#endregion
+export { BUCKET_INFO_MAX_KEYS, BUCKET_INFO_VALUE_MAX, BUCKET_NAME_MAX, BUCKET_NAME_MIN, DOWNLOAD_AUTH_DURATION_MAX_SECONDS, DOWNLOAD_AUTH_DURATION_MIN_SECONDS, FILE_INFO_TOTAL_MAX, FILE_INFO_VALUE_MAX, FILE_NAME_MAX_BYTES, KEY_NAME_MAX, KEY_NAME_MIN, LIST_ENDPOINT_CAPS, normalizeCreateKeyCapabilities, validateBucketInfo, validateBucketName, validateBucketTypes, validateCorsRules, validateCreateKeyCapabilities, validateCreateKeyName, validateDefaultRetention, validateDownloadAuthorizationDuration, validateDownloadAuthorizationPrefix, validateFileInfo, validateFileName, validateLifecycleRules, validateMaxCount, validateNotificationRules, validateReplicationConfiguration };
+
+//# sourceMappingURL=validation.js.map