@backblaze-labs/b2-sdk 0.1.0

package/dist/raw/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../src/raw/index.ts"],"sourcesContent":["/**\n * Low-level 1:1 bindings for every B2 native API endpoint.\n *\n * Each method on {@link RawClient} maps directly to a single `b2_*` HTTP call\n * with fully typed request and response objects. No retry logic, no URL pooling,\n * no automatic reauthorization. Use this when you need precise control over\n * individual API calls; for most use cases prefer the high-level `B2Client`.\n *\n * @packageDocumentation\n */\n\nimport type { HttpTransport } from '../http/transport.ts'\nimport type {\n  ApplicationKey,\n  AuthorizeAccountResponse,\n  BucketInfo,\n  CancelLargeFileRequest,\n  CancelLargeFileResponse,\n  CopyFileRequest,\n  CopyPartRequest,\n  CopyPartResponse,\n  CreateBucketRequest,\n  CreateKeyRequest,\n  DeleteBucketRequest,\n  DeleteFileVersionRequest,\n  DeleteFileVersionResponse,\n  DeleteKeyRequest,\n  DownloadAuthorizationRequest,\n  DownloadAuthorizationResponse,\n  FileVersion,\n  FinishLargeFileRequest,\n  FullApplicationKey,\n  GetBucketNotificationRulesRequest,\n  GetBucketNotificationRulesResponse,\n  GetFileInfoRequest,\n  GetUploadPartUrlRequest,\n  GetUploadPartUrlResponse,\n  GetUploadUrlRequest,\n  GetUploadUrlResponse,\n  HideFileRequest,\n  ListBucketsRequest,\n  ListBucketsResponse,\n  ListFileNamesRequest,\n  ListFileNamesResponse,\n  ListFileVersionsRequest,\n  ListFileVersionsResponse,\n  ListKeysRequest,\n  ListKeysResponse,\n  ListPartsRequest,\n  ListPartsResponse,\n  ListUnfinishedLargeFilesRequest,\n  ListUnfinishedLargeFilesResponse,\n  SetBucketNotificationRulesRequest,\n  SetBucketNotificationRulesResponse,\n  StartLargeFileRequest,\n  StartLargeFileResponse,\n  UpdateBucketRequest,\n  UpdateFileLegalHoldRequest,\n  UpdateFileLegalHoldResponse,\n  UpdateFileRetentionRequest,\n  UpdateFileRetentionResponse,\n} from '../types/index.ts'\nimport type { UploadFileHeaders, UploadPartHeaders, UploadPartResponse } from '../types/upload.ts'\nimport { normalizeFileVersionListSha1, normalizeFileVersionSha1 } from '../util/normalize.ts'\nimport { buildFileInfoHeaders, encodeFileName } from './encoding.ts'\n\n/** Configuration for constructing a {@link RawClient}. */\nexport interface RawClientOptions {\n  /** The HTTP transport used to send requests (e.g., FetchTransport or RetryTransport). */\n  readonly transport: HttpTransport\n}\n\n/**\n * Low-level client providing 1:1 bindings to all B2 native API endpoints.\n *\n * Each method maps directly to a single B2 API call. Most methods accept\n * `(apiUrl, authToken, request)` and return the JSON response. Upload and\n * download methods accept endpoint-specific parameters instead.\n */\nexport class RawClient {\n  /** @internal */\n  private readonly transport: HttpTransport\n\n  /**\n   * Creates a new RawClient with the given transport.\n   * @param options - The constructor configuration.\n   */\n  constructor(options: RawClientOptions) {\n    this.transport = options.transport\n  }\n\n  // --- Auth ---\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-authorize-account | b2_authorize_account}.\n   * @param applicationKeyId - The application key ID for authentication.\n   * @param applicationKey - The application key secret.\n   * @param realmUrl - The B2 realm URL to authenticate against.\n   *\n   * @returns The authorization response with API URLs and credentials.\n   */\n  async authorizeAccount(\n    applicationKeyId: string,\n    applicationKey: string,\n    realmUrl = 'https://api.backblazeb2.com',\n  ): Promise<AuthorizeAccountResponse> {\n    const response = await this.transport.send({\n      url: `${realmUrl}/b2api/v3/b2_authorize_account`,\n      method: 'GET',\n      headers: {\n        Authorization: `Basic ${btoa(`${applicationKeyId}:${applicationKey}`)}`,\n      },\n    })\n    return response.json<AuthorizeAccountResponse>()\n  }\n\n  // --- Buckets ---\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-create-bucket | b2_create_bucket}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The created bucket metadata.\n   */\n  async createBucket(\n    apiUrl: string,\n    authToken: string,\n    request: CreateBucketRequest,\n  ): Promise<BucketInfo> {\n    return this.postJson<BucketInfo>(apiUrl, authToken, 'b2_create_bucket', request)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-delete-bucket | b2_delete_bucket}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The deleted bucket metadata.\n   */\n  async deleteBucket(\n    apiUrl: string,\n    authToken: string,\n    request: DeleteBucketRequest,\n  ): Promise<BucketInfo> {\n    return this.postJson<BucketInfo>(apiUrl, authToken, 'b2_delete_bucket', request)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-list-buckets | b2_list_buckets}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The list of matching buckets.\n   */\n  async listBuckets(\n    apiUrl: string,\n    authToken: string,\n    request: ListBucketsRequest,\n  ): Promise<ListBucketsResponse> {\n    return this.postJson<ListBucketsResponse>(apiUrl, authToken, 'b2_list_buckets', request)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-update-bucket | b2_update_bucket}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The updated bucket metadata.\n   */\n  async updateBucket(\n    apiUrl: string,\n    authToken: string,\n    request: UpdateBucketRequest,\n  ): Promise<BucketInfo> {\n    return this.postJson<BucketInfo>(apiUrl, authToken, 'b2_update_bucket', request)\n  }\n\n  // --- Files ---\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-get-upload-url | b2_get_upload_url}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The upload URL and authorization token.\n   */\n  async getUploadUrl(\n    apiUrl: string,\n    authToken: string,\n    request: GetUploadUrlRequest,\n  ): Promise<GetUploadUrlResponse> {\n    return this.postJson<GetUploadUrlResponse>(apiUrl, authToken, 'b2_get_upload_url', request)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-upload-file | b2_upload_file}.\n   *\n   * Unlike most methods, this posts directly to the `uploadUrl` obtained\n   * from {@link getUploadUrl} rather than the API URL.\n   * @param uploadUrl - The upload endpoint URL.\n   * @param headers - The request headers including authorization and content metadata.\n   * @param body - The file data to upload.\n   * @param signal - An optional abort signal for cancellation.\n   *\n   * @returns The uploaded file version metadata.\n   */\n  async uploadFile(\n    uploadUrl: string,\n    headers: UploadFileHeaders,\n    body: BodyInit,\n    signal?: AbortSignal,\n  ): Promise<FileVersion> {\n    const reqHeaders: Record<string, string> = {\n      Authorization: headers.authorization,\n      'X-Bz-File-Name': encodeFileName(headers.fileName),\n      'Content-Type': headers.contentType,\n      'Content-Length': String(headers.contentLength),\n      'X-Bz-Content-Sha1': headers.contentSha1,\n      ...buildFileInfoHeaders(headers.fileInfo),\n    }\n\n    if (headers.lastModifiedMillis !== undefined) {\n      reqHeaders['X-Bz-Info-src_last_modified_millis'] = String(headers.lastModifiedMillis)\n    }\n    if (headers.contentDisposition) {\n      reqHeaders['X-Bz-Info-b2-content-disposition'] = headers.contentDisposition\n    }\n    if (headers.contentLanguage) {\n      reqHeaders['X-Bz-Info-b2-content-language'] = headers.contentLanguage\n    }\n    if (headers.expires) {\n      reqHeaders['X-Bz-Info-b2-expires'] = headers.expires\n    }\n    if (headers.cacheControl) {\n      reqHeaders['X-Bz-Info-b2-cache-control'] = headers.cacheControl\n    }\n    if (headers.contentEncoding) {\n      reqHeaders['X-Bz-Info-b2-content-encoding'] = headers.contentEncoding\n    }\n\n    applyEncryptionHeaders(reqHeaders, headers.serverSideEncryption)\n    applyRetentionHeaders(reqHeaders, headers.fileRetention)\n    applyLegalHoldHeader(reqHeaders, headers.legalHold)\n\n    const response = await this.transport.send({\n      url: uploadUrl,\n      method: 'POST',\n      headers: reqHeaders,\n      body,\n      ...(signal !== undefined ? { signal } : {}),\n    })\n    return normalizeFileVersionSha1(await response.json<FileVersion>())\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-list-file-names | b2_list_file_names}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The list of file names and optional continuation token.\n   */\n  async listFileNames(\n    apiUrl: string,\n    authToken: string,\n    request: ListFileNamesRequest,\n  ): Promise<ListFileNamesResponse> {\n    return normalizeFileVersionListSha1(\n      await this.postJson<ListFileNamesResponse>(apiUrl, authToken, 'b2_list_file_names', request),\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-list-file-versions | b2_list_file_versions}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The list of file versions and optional continuation token.\n   */\n  async listFileVersions(\n    apiUrl: string,\n    authToken: string,\n    request: ListFileVersionsRequest,\n  ): Promise<ListFileVersionsResponse> {\n    return normalizeFileVersionListSha1(\n      await this.postJson<ListFileVersionsResponse>(\n        apiUrl,\n        authToken,\n        'b2_list_file_versions',\n        request,\n      ),\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-get-file-info | b2_get_file_info}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The file version metadata.\n   */\n  async getFileInfo(\n    apiUrl: string,\n    authToken: string,\n    request: GetFileInfoRequest,\n  ): Promise<FileVersion> {\n    return normalizeFileVersionSha1(\n      await this.postJson<FileVersion>(apiUrl, authToken, 'b2_get_file_info', request),\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-hide-file | b2_hide_file}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The hidden file version metadata.\n   */\n  async hideFile(\n    apiUrl: string,\n    authToken: string,\n    request: HideFileRequest,\n  ): Promise<FileVersion> {\n    return normalizeFileVersionSha1(\n      await this.postJson<FileVersion>(apiUrl, authToken, 'b2_hide_file', request),\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-delete-file-version | b2_delete_file_version}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The deleted file version identifier.\n   */\n  async deleteFileVersion(\n    apiUrl: string,\n    authToken: string,\n    request: DeleteFileVersionRequest,\n  ): Promise<DeleteFileVersionResponse> {\n    return this.postJson<DeleteFileVersionResponse>(\n      apiUrl,\n      authToken,\n      'b2_delete_file_version',\n      request,\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-copy-file | b2_copy_file}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The copied file version metadata.\n   */\n  async copyFile(\n    apiUrl: string,\n    authToken: string,\n    request: CopyFileRequest,\n  ): Promise<FileVersion> {\n    return normalizeFileVersionSha1(\n      await this.postJson<FileVersion>(apiUrl, authToken, 'b2_copy_file', request),\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-copy-part | b2_copy_part}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The copied part metadata.\n   */\n  async copyPart(\n    apiUrl: string,\n    authToken: string,\n    request: CopyPartRequest,\n  ): Promise<CopyPartResponse> {\n    return this.postJson<CopyPartResponse>(apiUrl, authToken, 'b2_copy_part', request)\n  }\n\n  // --- Large Files ---\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-start-large-file | b2_start_large_file}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The started large file metadata with file ID.\n   */\n  async startLargeFile(\n    apiUrl: string,\n    authToken: string,\n    request: StartLargeFileRequest,\n  ): Promise<StartLargeFileResponse> {\n    return this.postJson<StartLargeFileResponse>(apiUrl, authToken, 'b2_start_large_file', request)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-get-upload-part-url | b2_get_upload_part_url}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The upload part URL and authorization token.\n   */\n  async getUploadPartUrl(\n    apiUrl: string,\n    authToken: string,\n    request: GetUploadPartUrlRequest,\n  ): Promise<GetUploadPartUrlResponse> {\n    return this.postJson<GetUploadPartUrlResponse>(\n      apiUrl,\n      authToken,\n      'b2_get_upload_part_url',\n      request,\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-upload-part | b2_upload_part}.\n   *\n   * Posts directly to the `uploadUrl` obtained from {@link getUploadPartUrl}\n   * rather than the API URL.\n   * @param uploadUrl - The upload endpoint URL.\n   * @param headers - The request headers including authorization and content metadata.\n   * @param body - The file data to upload.\n   * @param signal - An optional abort signal for cancellation.\n   *\n   * @returns The uploaded part metadata.\n   */\n  async uploadPart(\n    uploadUrl: string,\n    headers: UploadPartHeaders,\n    body: BodyInit,\n    signal?: AbortSignal,\n  ): Promise<UploadPartResponse> {\n    const reqHeaders: Record<string, string> = {\n      Authorization: headers.authorization,\n      'X-Bz-Part-Number': String(headers.partNumber),\n      'Content-Length': String(headers.contentLength),\n      'X-Bz-Content-Sha1': headers.contentSha1,\n    }\n\n    applyEncryptionHeaders(reqHeaders, headers.serverSideEncryption)\n\n    const response = await this.transport.send({\n      url: uploadUrl,\n      method: 'POST',\n      headers: reqHeaders,\n      body,\n      ...(signal !== undefined ? { signal } : {}),\n    })\n    return response.json<UploadPartResponse>()\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-finish-large-file | b2_finish_large_file}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The completed file version metadata.\n   */\n  async finishLargeFile(\n    apiUrl: string,\n    authToken: string,\n    request: FinishLargeFileRequest,\n  ): Promise<FileVersion> {\n    return normalizeFileVersionSha1(\n      await this.postJson<FileVersion>(apiUrl, authToken, 'b2_finish_large_file', request),\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-cancel-large-file | b2_cancel_large_file}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The cancelled large file metadata.\n   */\n  async cancelLargeFile(\n    apiUrl: string,\n    authToken: string,\n    request: CancelLargeFileRequest,\n  ): Promise<CancelLargeFileResponse> {\n    return this.postJson<CancelLargeFileResponse>(\n      apiUrl,\n      authToken,\n      'b2_cancel_large_file',\n      request,\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-list-unfinished-large-files | b2_list_unfinished_large_files}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The list of unfinished large files and optional continuation token.\n   */\n  async listUnfinishedLargeFiles(\n    apiUrl: string,\n    authToken: string,\n    request: ListUnfinishedLargeFilesRequest,\n  ): Promise<ListUnfinishedLargeFilesResponse> {\n    return this.postJson<ListUnfinishedLargeFilesResponse>(\n      apiUrl,\n      authToken,\n      'b2_list_unfinished_large_files',\n      request,\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-list-parts | b2_list_parts}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The list of uploaded parts and optional continuation token.\n   */\n  async listParts(\n    apiUrl: string,\n    authToken: string,\n    request: ListPartsRequest,\n  ): Promise<ListPartsResponse> {\n    return this.postJson<ListPartsResponse>(apiUrl, authToken, 'b2_list_parts', request)\n  }\n\n  // --- Downloads ---\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-download-file-by-id | b2_download_file_by_id}.\n   * @param downloadUrl - The B2 download base URL.\n   * @param authToken - The authorization token.\n   * @param fileId - The unique identifier of the file to download.\n   * @param options - Optional download parameters for range requests and cancellation.\n   *\n   * @returns The response headers, streaming body, and HTTP status code.\n   */\n  async downloadFileById(\n    downloadUrl: string,\n    authToken: string,\n    fileId: string,\n    options?: DownloadFileOptions,\n  ): Promise<{\n    /** Response headers containing file metadata and B2 info headers. */\n    headers: Headers\n    /** Streaming response body, or `null` for HEAD-like responses. */\n    body: ReadableStream<Uint8Array> | null\n    /** HTTP status code (200 for full content, 206 for partial content). */\n    status: number\n  }> {\n    const headers = buildDownloadRequestHeaders(authToken, options)\n    const url = appendDownloadOverrides(\n      `${downloadUrl}/b2api/v3/b2_download_file_by_id?fileId=${encodeURIComponent(fileId)}`,\n      options,\n    )\n\n    const response = await this.transport.send({\n      url,\n      method: options?.method ?? 'GET',\n      headers,\n      ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n    })\n\n    return { headers: response.headers, body: response.body, status: response.status }\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-download-file-by-name | b2_download_file_by_name}.\n   * @param downloadUrl - The B2 download base URL.\n   * @param authToken - The authorization token.\n   * @param bucketName - The name of the bucket containing the file.\n   * @param fileName - The name of the file to download.\n   * @param options - Optional download parameters for range requests and cancellation.\n   *\n   * @returns The response headers, streaming body, and HTTP status code.\n   */\n  async downloadFileByName(\n    downloadUrl: string,\n    authToken: string,\n    bucketName: string,\n    fileName: string,\n    options?: DownloadFileOptions,\n  ): Promise<{\n    /** Response headers containing file metadata and B2 info headers. */\n    headers: Headers\n    /** Streaming response body, or `null` for HEAD-like responses. */\n    body: ReadableStream<Uint8Array> | null\n    /** HTTP status code (200 for full content, 206 for partial content). */\n    status: number\n  }> {\n    const headers = buildDownloadRequestHeaders(authToken, options)\n    const url = appendDownloadOverrides(\n      `${downloadUrl}/file/${encodeURIComponent(bucketName)}/${encodeFileName(fileName)}`,\n      options,\n    )\n\n    const response = await this.transport.send({\n      url,\n      method: options?.method ?? 'GET',\n      headers,\n      ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n    })\n\n    return { headers: response.headers, body: response.body, status: response.status }\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-get-download-authorization | b2_get_download_authorization}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The current session authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The download authorization token for the specified file prefix.\n   */\n  async getDownloadAuthorization(\n    apiUrl: string,\n    authToken: string,\n    request: DownloadAuthorizationRequest,\n  ): Promise<DownloadAuthorizationResponse> {\n    return this.postJson<DownloadAuthorizationResponse>(\n      apiUrl,\n      authToken,\n      'b2_get_download_authorization',\n      request,\n    )\n  }\n\n  // --- Keys ---\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-create-key | b2_create_key}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The newly created application key with secret.\n   */\n  async createKey(\n    apiUrl: string,\n    authToken: string,\n    request: CreateKeyRequest,\n  ): Promise<FullApplicationKey> {\n    return this.postJson<FullApplicationKey>(apiUrl, authToken, 'b2_create_key', request)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-list-keys | b2_list_keys}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The list of application keys and optional continuation token.\n   */\n  async listKeys(\n    apiUrl: string,\n    authToken: string,\n    request: ListKeysRequest,\n  ): Promise<ListKeysResponse> {\n    return this.postJson<ListKeysResponse>(apiUrl, authToken, 'b2_list_keys', request)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-delete-key | b2_delete_key}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The deleted application key metadata.\n   */\n  async deleteKey(\n    apiUrl: string,\n    authToken: string,\n    request: DeleteKeyRequest,\n  ): Promise<ApplicationKey> {\n    return this.postJson<ApplicationKey>(apiUrl, authToken, 'b2_delete_key', request)\n  }\n\n  // --- Retention / Legal Hold ---\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-update-file-retention | b2_update_file_retention}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The updated file retention settings.\n   */\n  async updateFileRetention(\n    apiUrl: string,\n    authToken: string,\n    request: UpdateFileRetentionRequest,\n  ): Promise<UpdateFileRetentionResponse> {\n    return this.postJson<UpdateFileRetentionResponse>(\n      apiUrl,\n      authToken,\n      'b2_update_file_retention',\n      request,\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-update-file-legal-hold | b2_update_file_legal_hold}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The updated file legal hold status.\n   */\n  async updateFileLegalHold(\n    apiUrl: string,\n    authToken: string,\n    request: UpdateFileLegalHoldRequest,\n  ): Promise<UpdateFileLegalHoldResponse> {\n    return this.postJson<UpdateFileLegalHoldResponse>(\n      apiUrl,\n      authToken,\n      'b2_update_file_legal_hold',\n      request,\n    )\n  }\n\n  // --- Notifications ---\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-get-bucket-notification-rules | b2_get_bucket_notification_rules}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The configured event notification rules for the specified bucket.\n   */\n  async getBucketNotificationRules(\n    apiUrl: string,\n    authToken: string,\n    request: GetBucketNotificationRulesRequest,\n  ): Promise<GetBucketNotificationRulesResponse> {\n    return this.postJson<GetBucketNotificationRulesResponse>(\n      apiUrl,\n      authToken,\n      'b2_get_bucket_notification_rules',\n      request,\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-set-bucket-notification-rules | b2_set_bucket_notification_rules}.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param request - The API request parameters.\n   *\n   * @returns The updated bucket notification rules.\n   */\n  async setBucketNotificationRules(\n    apiUrl: string,\n    authToken: string,\n    request: SetBucketNotificationRulesRequest,\n  ): Promise<SetBucketNotificationRulesResponse> {\n    return this.postJson<SetBucketNotificationRulesResponse>(\n      apiUrl,\n      authToken,\n      'b2_set_bucket_notification_rules',\n      request,\n    )\n  }\n\n  // --- Internal ---\n\n  /**\n   * Sends a JSON POST request to the specified B2 API endpoint.\n   * @param apiUrl - The B2 API base URL.\n   * @param authToken - The authorization token.\n   * @param endpoint - The B2 API endpoint name.\n   * @param body - The JSON request body.\n   *\n   * @returns The parsed JSON response.\n   */\n  private async postJson<T>(\n    apiUrl: string,\n    authToken: string,\n    endpoint: string,\n    body: unknown,\n  ): Promise<T> {\n    const response = await this.transport.send({\n      url: `${apiUrl}/b2api/v3/${endpoint}`,\n      method: 'POST',\n      headers: {\n        Authorization: authToken,\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(body),\n    })\n    return response.json<T>()\n  }\n}\n\n// --- Header helpers ---\n\nimport { EncryptionAlgorithm, EncryptionMode, type EncryptionSetting } from '../types/encryption.ts'\nimport type { FileRetentionValue, LegalHoldValue } from '../types/lock.ts'\n\n/**\n * Applies server-side encryption headers to the request.\n * @param headers - The mutable headers object to populate.\n * @param encryption - The encryption settings, or undefined to skip.\n */\nfunction applyEncryptionHeaders(\n  headers: Record<string, string>,\n  encryption: EncryptionSetting | undefined,\n): void {\n  if (!encryption || encryption.mode === EncryptionMode.None) return\n  if (encryption.mode === EncryptionMode.SseB2) {\n    headers['X-Bz-Server-Side-Encryption'] = EncryptionAlgorithm.Aes256\n  } else if (encryption.mode === EncryptionMode.SseC) {\n    headers['X-Bz-Server-Side-Encryption-Customer-Algorithm'] = EncryptionAlgorithm.Aes256\n    headers['X-Bz-Server-Side-Encryption-Customer-Key'] = encryption.customerKey\n    headers['X-Bz-Server-Side-Encryption-Customer-Key-Md5'] = encryption.customerKeyMd5\n  }\n}\n\n/**\n * SSE-C decryption parameters supplied to downloads of files that were\n * uploaded with customer-managed keys.\n */\nexport interface SseCDownloadKey {\n  /** Encryption algorithm. Always `EncryptionAlgorithm.Aes256` (`'AES256'`). */\n  readonly algorithm: EncryptionAlgorithm\n  /** Base64-encoded customer-provided decryption key. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the decryption key. */\n  readonly customerKeyMd5: string\n}\n\n/**\n * Options accepted by {@link RawClient.downloadFileById} and\n * {@link RawClient.downloadFileByName}. Mirrors the B2 native API: range +\n * SSE-C decryption headers + the documented `b2Content*` response-header\n * overrides (query-string parameters on the request URL).\n */\nexport interface DownloadFileOptions {\n  /** HTTP method. Defaults to `'GET'`. Use `'HEAD'` to fetch headers without the body. */\n  readonly method?: 'GET' | 'HEAD'\n  /** HTTP Range header value for partial content requests. */\n  readonly range?: string\n  /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */\n  readonly serverSideEncryption?: SseCDownloadKey\n  /** Override the `Content-Disposition` header in the download response. */\n  readonly b2ContentDisposition?: string\n  /** Override the `Content-Language` header in the download response. */\n  readonly b2ContentLanguage?: string\n  /** Override the `Content-Encoding` header in the download response. */\n  readonly b2ContentEncoding?: string\n  /** Override the `Content-Type` header in the download response. */\n  readonly b2ContentType?: string\n  /** Override the `Cache-Control` header in the download response. */\n  readonly b2CacheControl?: string\n  /** Override the `Expires` header in the download response. */\n  readonly b2Expires?: string\n  /** Signal to abort the download. */\n  readonly signal?: AbortSignal\n}\n\nconst DOWNLOAD_OVERRIDE_PARAMS = [\n  'b2ContentDisposition',\n  'b2ContentLanguage',\n  'b2ContentEncoding',\n  'b2ContentType',\n  'b2CacheControl',\n  'b2Expires',\n] as const\n\n/**\n * Builds the HTTP request headers for a download: Authorization, optional\n * Range, and optional SSE-C decryption headers.\n *\n * @param authToken - The B2 session authorization token.\n * @param options - Caller-supplied download options.\n *\n * @returns The header map to send with the request.\n */\nfunction buildDownloadRequestHeaders(\n  authToken: string,\n  options: DownloadFileOptions | undefined,\n): Record<string, string> {\n  const headers: Record<string, string> = { Authorization: authToken }\n  if (options?.range) headers['Range'] = options.range\n  if (options?.serverSideEncryption) {\n    applyEncryptionHeaders(headers, {\n      mode: EncryptionMode.SseC,\n      ...options.serverSideEncryption,\n    })\n  }\n  return headers\n}\n\n/**\n * Appends the documented `b2Content*` response-header overrides to a download\n * URL as query-string parameters. B2 echoes the values into the response\n * headers so callers can control content type, disposition, and caching.\n *\n * @param url - The base download URL.\n * @param options - Caller-supplied download options.\n *\n * @returns The URL with any override parameters appended.\n */\nfunction appendDownloadOverrides(url: string, options: DownloadFileOptions | undefined): string {\n  if (!options) return url\n  const params: string[] = []\n  for (const key of DOWNLOAD_OVERRIDE_PARAMS) {\n    const value = options[key]\n    if (value !== undefined) {\n      params.push(`${key}=${encodeURIComponent(value)}`)\n    }\n  }\n  if (params.length === 0) return url\n  const separator = url.includes('?') ? '&' : '?'\n  return `${url}${separator}${params.join('&')}`\n}\n\n/**\n * Applies file retention headers to the request.\n * @param headers - The mutable headers object to populate.\n * @param retention - The retention settings, or undefined to skip.\n */\nfunction applyRetentionHeaders(\n  headers: Record<string, string>,\n  retention: FileRetentionValue | undefined,\n): void {\n  if (!retention) return\n  if (retention.mode) {\n    headers['X-Bz-File-Retention-Mode'] = retention.mode\n  }\n  if (retention.retainUntilTimestamp) {\n    headers['X-Bz-File-Retention-Retain-Until-Timestamp'] = String(retention.retainUntilTimestamp)\n  }\n}\n\n/**\n * Applies the legal hold header to the request.\n * @param headers - The mutable headers object to populate.\n * @param legalHold - The legal hold value, or undefined to skip.\n */\nfunction applyLegalHoldHeader(\n  headers: Record<string, string>,\n  legalHold: LegalHoldValue | undefined,\n): void {\n  if (!legalHold) return\n  headers['X-Bz-File-Legal-Hold'] = legalHold\n}\n\nexport {\n  encodeFileName,\n  decodeFileName,\n  buildFileInfoHeaders,\n  parseFileInfoHeaders,\n} from './encoding.ts'\n"],"names":[],"mappings":";;;;AA+EO,MAAM,UAAU;AAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjB,YAAY,SAA2B;AACrC,SAAK,YAAY,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,iBACJ,kBACA,gBACA,WAAW,+BACwB;AACnC,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK;AAAA,MACzC,KAAK,GAAG,QAAQ;AAAA,MAChB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,SAAS,KAAK,GAAG,gBAAgB,IAAI,cAAc,EAAE,CAAC;AAAA,MAAA;AAAA,IACvE,CACD;AACD,WAAO,SAAS,KAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aACJ,QACA,WACA,SACqB;AACrB,WAAO,KAAK,SAAqB,QAAQ,WAAW,oBAAoB,OAAO;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aACJ,QACA,WACA,SACqB;AACrB,WAAO,KAAK,SAAqB,QAAQ,WAAW,oBAAoB,OAAO;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YACJ,QACA,WACA,SAC8B;AAC9B,WAAO,KAAK,SAA8B,QAAQ,WAAW,mBAAmB,OAAO;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aACJ,QACA,WACA,SACqB;AACrB,WAAO,KAAK,SAAqB,QAAQ,WAAW,oBAAoB,OAAO;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aACJ,QACA,WACA,SAC+B;AAC/B,WAAO,KAAK,SAA+B,QAAQ,WAAW,qBAAqB,OAAO;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,WACJ,WACA,SACA,MACA,QACsB;AACtB,UAAM,aAAqC;AAAA,MACzC,eAAe,QAAQ;AAAA,MACvB,kBAAkB,eAAe,QAAQ,QAAQ;AAAA,MACjD,gBAAgB,QAAQ;AAAA,MACxB,kBAAkB,OAAO,QAAQ,aAAa;AAAA,MAC9C,qBAAqB,QAAQ;AAAA,MAC7B,GAAG,qBAAqB,QAAQ,QAAQ;AAAA,IAAA;AAG1C,QAAI,QAAQ,uBAAuB,QAAW;AAC5C,iBAAW,oCAAoC,IAAI,OAAO,QAAQ,kBAAkB;AAAA,IACtF;AACA,QAAI,QAAQ,oBAAoB;AAC9B,iBAAW,kCAAkC,IAAI,QAAQ;AAAA,IAC3D;AACA,QAAI,QAAQ,iBAAiB;AAC3B,iBAAW,+BAA+B,IAAI,QAAQ;AAAA,IACxD;AACA,QAAI,QAAQ,SAAS;AACnB,iBAAW,sBAAsB,IAAI,QAAQ;AAAA,IAC/C;AACA,QAAI,QAAQ,cAAc;AACxB,iBAAW,4BAA4B,IAAI,QAAQ;AAAA,IACrD;AACA,QAAI,QAAQ,iBAAiB;AAC3B,iBAAW,+BAA+B,IAAI,QAAQ;AAAA,IACxD;AAEA,2BAAuB,YAAY,QAAQ,oBAAoB;AAC/D,0BAAsB,YAAY,QAAQ,aAAa;AACvD,yBAAqB,YAAY,QAAQ,SAAS;AAElD,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK;AAAA,MACzC,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT;AAAA,MACA,GAAI,WAAW,SAAY,EAAE,WAAW,CAAA;AAAA,IAAC,CAC1C;AACD,WAAO,yBAAyB,MAAM,SAAS,MAAmB;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cACJ,QACA,WACA,SACgC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK,SAAgC,QAAQ,WAAW,sBAAsB,OAAO;AAAA,IAAA;AAAA,EAE/F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,iBACJ,QACA,WACA,SACmC;AACnC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IACF;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YACJ,QACA,WACA,SACsB;AACtB,WAAO;AAAA,MACL,MAAM,KAAK,SAAsB,QAAQ,WAAW,oBAAoB,OAAO;AAAA,IAAA;AAAA,EAEnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,SACJ,QACA,WACA,SACsB;AACtB,WAAO;AAAA,MACL,MAAM,KAAK,SAAsB,QAAQ,WAAW,gBAAgB,OAAO;AAAA,IAAA;AAAA,EAE/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,kBACJ,QACA,WACA,SACoC;AACpC,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,SACJ,QACA,WACA,SACsB;AACtB,WAAO;AAAA,MACL,MAAM,KAAK,SAAsB,QAAQ,WAAW,gBAAgB,OAAO;AAAA,IAAA;AAAA,EAE/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,SACJ,QACA,WACA,SAC2B;AAC3B,WAAO,KAAK,SAA2B,QAAQ,WAAW,gBAAgB,OAAO;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eACJ,QACA,WACA,SACiC;AACjC,WAAO,KAAK,SAAiC,QAAQ,WAAW,uBAAuB,OAAO;AAAA,EAChG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,iBACJ,QACA,WACA,SACmC;AACnC,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,WACJ,WACA,SACA,MACA,QAC6B;AAC7B,UAAM,aAAqC;AAAA,MACzC,eAAe,QAAQ;AAAA,MACvB,oBAAoB,OAAO,QAAQ,UAAU;AAAA,MAC7C,kBAAkB,OAAO,QAAQ,aAAa;AAAA,MAC9C,qBAAqB,QAAQ;AAAA,IAAA;AAG/B,2BAAuB,YAAY,QAAQ,oBAAoB;AAE/D,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK;AAAA,MACzC,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT;AAAA,MACA,GAAI,WAAW,SAAY,EAAE,WAAW,CAAA;AAAA,IAAC,CAC1C;AACD,WAAO,SAAS,KAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBACJ,QACA,WACA,SACsB;AACtB,WAAO;AAAA,MACL,MAAM,KAAK,SAAsB,QAAQ,WAAW,wBAAwB,OAAO;AAAA,IAAA;AAAA,EAEvF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBACJ,QACA,WACA,SACkC;AAClC,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,yBACJ,QACA,WACA,SAC2C;AAC3C,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,UACJ,QACA,WACA,SAC4B;AAC5B,WAAO,KAAK,SAA4B,QAAQ,WAAW,iBAAiB,OAAO;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBACJ,aACA,WACA,QACA,SAQC;AACD,UAAM,UAAU,4BAA4B,WAAW,OAAO;AAC9D,UAAM,MAAM;AAAA,MACV,GAAG,WAAW,2CAA2C,mBAAmB,MAAM,CAAC;AAAA,MACnF;AAAA,IAAA;AAGF,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK;AAAA,MACzC;AAAA,MACA,QAAQ,SAAS,UAAU;AAAA,MAC3B;AAAA,MACA,GAAI,SAAS,WAAW,SAAY,EAAE,QAAQ,QAAQ,WAAW,CAAA;AAAA,IAAC,CACnE;AAED,WAAO,EAAE,SAAS,SAAS,SAAS,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAA;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,mBACJ,aACA,WACA,YACA,UACA,SAQC;AACD,UAAM,UAAU,4BAA4B,WAAW,OAAO;AAC9D,UAAM,MAAM;AAAA,MACV,GAAG,WAAW,SAAS,mBAAmB,UAAU,CAAC,IAAI,eAAe,QAAQ,CAAC;AAAA,MACjF;AAAA,IAAA;AAGF,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK;AAAA,MACzC;AAAA,MACA,QAAQ,SAAS,UAAU;AAAA,MAC3B;AAAA,MACA,GAAI,SAAS,WAAW,SAAY,EAAE,QAAQ,QAAQ,WAAW,CAAA;AAAA,IAAC,CACnE;AAED,WAAO,EAAE,SAAS,SAAS,SAAS,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAA;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,yBACJ,QACA,WACA,SACwC;AACxC,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,UACJ,QACA,WACA,SAC6B;AAC7B,WAAO,KAAK,SAA6B,QAAQ,WAAW,iBAAiB,OAAO;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,SACJ,QACA,WACA,SAC2B;AAC3B,WAAO,KAAK,SAA2B,QAAQ,WAAW,gBAAgB,OAAO;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,UACJ,QACA,WACA,SACyB;AACzB,WAAO,KAAK,SAAyB,QAAQ,WAAW,iBAAiB,OAAO;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,oBACJ,QACA,WACA,SACsC;AACtC,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,oBACJ,QACA,WACA,SACsC;AACtC,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,2BACJ,QACA,WACA,SAC6C;AAC7C,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,2BACJ,QACA,WACA,SAC6C;AAC7C,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAc,SACZ,QACA,WACA,UACA,MACY;AACZ,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK;AAAA,MACzC,KAAK,GAAG,MAAM,aAAa,QAAQ;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe;AAAA,QACf,gBAAgB;AAAA,MAAA;AAAA,MAElB,MAAM,KAAK,UAAU,IAAI;AAAA,IAAA,CAC1B;AACD,WAAO,SAAS,KAAA;AAAA,EAClB;AACF;AAYA,SAAS,uBACP,SACA,YACM;AACN,MAAI,CAAC,cAAc,WAAW,SAAS,eAAe,KAAM;AAC5D,MAAI,WAAW,SAAS,eAAe,OAAO;AAC5C,YAAQ,6BAA6B,IAAI,oBAAoB;AAAA,EAC/D,WAAW,WAAW,SAAS,eAAe,MAAM;AAClD,YAAQ,gDAAgD,IAAI,oBAAoB;AAChF,YAAQ,0CAA0C,IAAI,WAAW;AACjE,YAAQ,8CAA8C,IAAI,WAAW;AAAA,EACvE;AACF;AA4CA,MAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWA,SAAS,4BACP,WACA,SACwB;AACxB,QAAM,UAAkC,EAAE,eAAe,UAAA;AACzD,MAAI,SAAS,MAAO,SAAQ,OAAO,IAAI,QAAQ;AAC/C,MAAI,SAAS,sBAAsB;AACjC,2BAAuB,SAAS;AAAA,MAC9B,MAAM,eAAe;AAAA,MACrB,GAAG,QAAQ;AAAA,IAAA,CACZ;AAAA,EACH;AACA,SAAO;AACT;AAYA,SAAS,wBAAwB,KAAa,SAAkD;AAC9F,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAmB,CAAA;AACzB,aAAW,OAAO,0BAA0B;AAC1C,UAAM,QAAQ,QAAQ,GAAG;AACzB,QAAI,UAAU,QAAW;AACvB,aAAO,KAAK,GAAG,GAAG,IAAI,mBAAmB,KAAK,CAAC,EAAE;AAAA,IACnD;AAAA,EACF;AACA,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,YAAY,IAAI,SAAS,GAAG,IAAI,MAAM;AAC5C,SAAO,GAAG,GAAG,GAAG,SAAS,GAAG,OAAO,KAAK,GAAG,CAAC;AAC9C;AAOA,SAAS,sBACP,SACA,WACM;AACN,MAAI,CAAC,UAAW;AAChB,MAAI,UAAU,MAAM;AAClB,YAAQ,0BAA0B,IAAI,UAAU;AAAA,EAClD;AACA,MAAI,UAAU,sBAAsB;AAClC,YAAQ,4CAA4C,IAAI,OAAO,UAAU,oBAAoB;AAAA,EAC/F;AACF;AAOA,SAAS,qBACP,SACA,WACM;AACN,MAAI,CAAC,UAAW;AAChB,UAAQ,sBAAsB,IAAI;AACpC;"}

package/dist/s3/index.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+function createS3ClientConfig(config) {
+  const s3Url = config.accountInfo.getS3ApiUrl();
+  const regionMatch = s3Url.match(/s3\.([^.]+)\.backblazeb2\.com/);
+  const region = config.region ?? regionMatch?.[1] ?? "us-west-004";
+  return {
+    endpoint: s3Url,
+    region,
+    credentials: {
+      accessKeyId: config.applicationKeyId,
+      secretAccessKey: config.applicationKey
+    },
+    forcePathStyle: true
+  };
+}
+function presignGetObjectUrl(downloadUrl, bucketName, fileName, authorizationToken, validDurationInSeconds = 3600) {
+  const expires = Math.floor(Date.now() / 1e3) + validDurationInSeconds;
+  return `${downloadUrl}/file/${encodeURIComponent(bucketName)}/${encodeURIComponent(fileName)}?Authorization=${encodeURIComponent(authorizationToken)}&expires=${expires}`;
+}
+exports.createS3ClientConfig = createS3ClientConfig;
+exports.presignGetObjectUrl = presignGetObjectUrl;
+//# sourceMappingURL=index.cjs.map

package/dist/s3/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../../src/s3/index.ts"],"sourcesContent":["/**\n * S3-compatible helpers for using B2 with the AWS SDK.\n *\n * Provides {@link createS3ClientConfig} to derive endpoint, region, and\n * credentials from B2 authorization state, plus {@link presignGetObjectUrl}\n * for generating download URLs using B2 native download authorization.\n *\n * @packageDocumentation\n */\n\nimport type { AccountInfo } from '../auth/account-info.ts'\n\n/**\n * Configuration for deriving S3-compatible client settings from B2 auth state.\n *\n * Per B2's S3-compatible API contract, the S3 `accessKeyId` is the\n * `applicationKeyId` and the S3 `secretAccessKey` is the\n * `applicationKey`. These are NOT the native `accountId` /\n * `authorizationToken` returned by `b2_authorize_account` — those won't\n * authenticate against the S3 endpoint. Both must be supplied here\n * because `AccountInfo` doesn't retain the application key after\n * authorization for security reasons.\n *\n * @see https://www.backblaze.com/apidocs/s3-compatible-api\n */\nexport interface B2S3Config {\n  /** The authorized AccountInfo containing the S3 endpoint URL. */\n  readonly accountInfo: AccountInfo\n  /** B2 application key ID. Used as the S3 `accessKeyId`. */\n  readonly applicationKeyId: string\n  /** B2 application key (secret). Used as the S3 `secretAccessKey`. */\n  readonly applicationKey: string\n  /** Override the S3 region. If omitted, extracted from the S3 API URL. */\n  readonly region?: string\n}\n\n/** Configuration object compatible with `@aws-sdk/client-s3`'s S3Client constructor. */\nexport interface S3ClientConfig {\n  /** The S3-compatible endpoint URL (e.g., `https://s3.us-west-004.backblazeb2.com`). */\n  readonly endpoint: string\n  /** The S3 region identifier (e.g., `us-west-004`). */\n  readonly region: string\n  /** AWS-style credentials — the B2 application key pair. */\n  readonly credentials: {\n    /** The B2 application key ID, used as the S3 access key ID. */\n    readonly accessKeyId: string\n    /** The B2 application key (secret), used as the S3 secret access key. */\n    readonly secretAccessKey: string\n  }\n  /** Always `true` for B2, which requires path-style bucket addressing. */\n  readonly forcePathStyle: boolean\n}\n\n/**\n * Derives an S3-compatible client configuration from B2 authorization state.\n * Pass the result to `new S3Client(config)` from `@aws-sdk/client-s3`.\n *\n * @param config - B2 auth state, application key credentials, and optional region override.\n *\n * @returns Configuration ready for the AWS S3 SDK.\n *\n * @example\n * ```ts\n * const { B2_APPLICATION_KEY_ID, B2_APPLICATION_KEY } = process.env\n * if (!B2_APPLICATION_KEY_ID || !B2_APPLICATION_KEY) throw new Error('Missing B2 credentials')\n * const s3 = new S3Client(createS3ClientConfig({\n *   accountInfo: client.accountInfo,\n *   applicationKeyId: B2_APPLICATION_KEY_ID,\n *   applicationKey: B2_APPLICATION_KEY,\n * }))\n * ```\n */\nexport function createS3ClientConfig(config: B2S3Config): S3ClientConfig {\n  const s3Url = config.accountInfo.getS3ApiUrl()\n  const regionMatch = s3Url.match(/s3\\.([^.]+)\\.backblazeb2\\.com/)\n  const region = config.region ?? regionMatch?.[1] ?? 'us-west-004'\n\n  return {\n    endpoint: s3Url,\n    region,\n    credentials: {\n      accessKeyId: config.applicationKeyId,\n      secretAccessKey: config.applicationKey,\n    },\n    forcePathStyle: true,\n  }\n}\n\n/**\n * Constructs a presigned download URL using B2's native download authorization.\n * This is not a standard S3 presigned URL but works for B2 download endpoints.\n *\n * @param downloadUrl - The B2 download URL from authorization (e.g., `https://f004.backblazeb2.com`).\n * @param bucketName - The bucket containing the file.\n * @param fileName - The file name (path) to download.\n * @param authorizationToken - A download authorization token from `b2_get_download_authorization`.\n * @param validDurationInSeconds - URL validity duration in seconds. Defaults to 3600 (1 hour).\n *\n * @returns The presigned download URL string.\n */\nexport function presignGetObjectUrl(\n  downloadUrl: string,\n  bucketName: string,\n  fileName: string,\n  authorizationToken: string,\n  validDurationInSeconds = 3600,\n): string {\n  const expires = Math.floor(Date.now() / 1000) + validDurationInSeconds\n  return `${downloadUrl}/file/${encodeURIComponent(bucketName)}/${encodeURIComponent(fileName)}?Authorization=${encodeURIComponent(authorizationToken)}&expires=${expires}`\n}\n"],"names":[],"mappings":";;AAwEO,SAAS,qBAAqB,QAAoC;AACvE,QAAM,QAAQ,OAAO,YAAY,YAAA;AACjC,QAAM,cAAc,MAAM,MAAM,+BAA+B;AAC/D,QAAM,SAAS,OAAO,UAAU,cAAc,CAAC,KAAK;AAEpD,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,MACX,aAAa,OAAO;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAAA;AAAA,IAE1B,gBAAgB;AAAA,EAAA;AAEpB;AAcO,SAAS,oBACd,aACA,YACA,UACA,oBACA,yBAAyB,MACjB;AACR,QAAM,UAAU,KAAK,MAAM,KAAK,IAAA,IAAQ,GAAI,IAAI;AAChD,SAAO,GAAG,WAAW,SAAS,mBAAmB,UAAU,CAAC,IAAI,mBAAmB,QAAQ,CAAC,kBAAkB,mBAAmB,kBAAkB,CAAC,YAAY,OAAO;AACzK;;;"}

package/dist/s3/index.d.cts

@@ -0,0 +1,74 @@
+import { AccountInfo } from '../auth/account-info.js';
+/**
+ * Configuration for deriving S3-compatible client settings from B2 auth state.
+ *
+ * Per B2's S3-compatible API contract, the S3 `accessKeyId` is the
+ * `applicationKeyId` and the S3 `secretAccessKey` is the
+ * `applicationKey`. These are NOT the native `accountId` /
+ * `authorizationToken` returned by `b2_authorize_account` — those won't
+ * authenticate against the S3 endpoint. Both must be supplied here
+ * because `AccountInfo` doesn't retain the application key after
+ * authorization for security reasons.
+ *
+ * @see https://www.backblaze.com/apidocs/s3-compatible-api
+ */
+export interface B2S3Config {
+    /** The authorized AccountInfo containing the S3 endpoint URL. */
+    readonly accountInfo: AccountInfo;
+    /** B2 application key ID. Used as the S3 `accessKeyId`. */
+    readonly applicationKeyId: string;
+    /** B2 application key (secret). Used as the S3 `secretAccessKey`. */
+    readonly applicationKey: string;
+    /** Override the S3 region. If omitted, extracted from the S3 API URL. */
+    readonly region?: string;
+}
+/** Configuration object compatible with `@aws-sdk/client-s3`'s S3Client constructor. */
+export interface S3ClientConfig {
+    /** The S3-compatible endpoint URL (e.g., `https://s3.us-west-004.backblazeb2.com`). */
+    readonly endpoint: string;
+    /** The S3 region identifier (e.g., `us-west-004`). */
+    readonly region: string;
+    /** AWS-style credentials — the B2 application key pair. */
+    readonly credentials: {
+        /** The B2 application key ID, used as the S3 access key ID. */
+        readonly accessKeyId: string;
+        /** The B2 application key (secret), used as the S3 secret access key. */
+        readonly secretAccessKey: string;
+    };
+    /** Always `true` for B2, which requires path-style bucket addressing. */
+    readonly forcePathStyle: boolean;
+}
+/**
+ * Derives an S3-compatible client configuration from B2 authorization state.
+ * Pass the result to `new S3Client(config)` from `@aws-sdk/client-s3`.
+ *
+ * @param config - B2 auth state, application key credentials, and optional region override.
+ *
+ * @returns Configuration ready for the AWS S3 SDK.
+ *
+ * @example
+ * ```ts
+ * const { B2_APPLICATION_KEY_ID, B2_APPLICATION_KEY } = process.env
+ * if (!B2_APPLICATION_KEY_ID || !B2_APPLICATION_KEY) throw new Error('Missing B2 credentials')
+ * const s3 = new S3Client(createS3ClientConfig({
+ *   accountInfo: client.accountInfo,
+ *   applicationKeyId: B2_APPLICATION_KEY_ID,
+ *   applicationKey: B2_APPLICATION_KEY,
+ * }))
+ * ```
+ */
+export declare function createS3ClientConfig(config: B2S3Config): S3ClientConfig;
+/**
+ * Constructs a presigned download URL using B2's native download authorization.
+ * This is not a standard S3 presigned URL but works for B2 download endpoints.
+ *
+ * @param downloadUrl - The B2 download URL from authorization (e.g., `https://f004.backblazeb2.com`).
+ * @param bucketName - The bucket containing the file.
+ * @param fileName - The file name (path) to download.
+ * @param authorizationToken - A download authorization token from `b2_get_download_authorization`.
+ * @param validDurationInSeconds - URL validity duration in seconds. Defaults to 3600 (1 hour).
+ *
+ * @returns The presigned download URL string.
+ */
+export declare function presignGetObjectUrl(downloadUrl: string, bucketName: string, fileName: string, authorizationToken: string, validDurationInSeconds?: number): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/s3/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/s3/index.js"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE;QACpB,+DAA+D;QAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,yEAAyE;QACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;KACjC,CAAA;IACD,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CACjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,CAcvE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,MAAM,EAC1B,sBAAsB,SAAO,GAC5B,MAAM,CAGR"}

package/dist/s3/index.d.ts

@@ -0,0 +1,74 @@
+import { AccountInfo } from '../auth/account-info.js';
+/**
+ * Configuration for deriving S3-compatible client settings from B2 auth state.
+ *
+ * Per B2's S3-compatible API contract, the S3 `accessKeyId` is the
+ * `applicationKeyId` and the S3 `secretAccessKey` is the
+ * `applicationKey`. These are NOT the native `accountId` /
+ * `authorizationToken` returned by `b2_authorize_account` — those won't
+ * authenticate against the S3 endpoint. Both must be supplied here
+ * because `AccountInfo` doesn't retain the application key after
+ * authorization for security reasons.
+ *
+ * @see https://www.backblaze.com/apidocs/s3-compatible-api
+ */
+export interface B2S3Config {
+    /** The authorized AccountInfo containing the S3 endpoint URL. */
+    readonly accountInfo: AccountInfo;
+    /** B2 application key ID. Used as the S3 `accessKeyId`. */
+    readonly applicationKeyId: string;
+    /** B2 application key (secret). Used as the S3 `secretAccessKey`. */
+    readonly applicationKey: string;
+    /** Override the S3 region. If omitted, extracted from the S3 API URL. */
+    readonly region?: string;
+}
+/** Configuration object compatible with `@aws-sdk/client-s3`'s S3Client constructor. */
+export interface S3ClientConfig {
+    /** The S3-compatible endpoint URL (e.g., `https://s3.us-west-004.backblazeb2.com`). */
+    readonly endpoint: string;
+    /** The S3 region identifier (e.g., `us-west-004`). */
+    readonly region: string;
+    /** AWS-style credentials — the B2 application key pair. */
+    readonly credentials: {
+        /** The B2 application key ID, used as the S3 access key ID. */
+        readonly accessKeyId: string;
+        /** The B2 application key (secret), used as the S3 secret access key. */
+        readonly secretAccessKey: string;
+    };
+    /** Always `true` for B2, which requires path-style bucket addressing. */
+    readonly forcePathStyle: boolean;
+}
+/**
+ * Derives an S3-compatible client configuration from B2 authorization state.
+ * Pass the result to `new S3Client(config)` from `@aws-sdk/client-s3`.
+ *
+ * @param config - B2 auth state, application key credentials, and optional region override.
+ *
+ * @returns Configuration ready for the AWS S3 SDK.
+ *
+ * @example
+ * ```ts
+ * const { B2_APPLICATION_KEY_ID, B2_APPLICATION_KEY } = process.env
+ * if (!B2_APPLICATION_KEY_ID || !B2_APPLICATION_KEY) throw new Error('Missing B2 credentials')
+ * const s3 = new S3Client(createS3ClientConfig({
+ *   accountInfo: client.accountInfo,
+ *   applicationKeyId: B2_APPLICATION_KEY_ID,
+ *   applicationKey: B2_APPLICATION_KEY,
+ * }))
+ * ```
+ */
+export declare function createS3ClientConfig(config: B2S3Config): S3ClientConfig;
+/**
+ * Constructs a presigned download URL using B2's native download authorization.
+ * This is not a standard S3 presigned URL but works for B2 download endpoints.
+ *
+ * @param downloadUrl - The B2 download URL from authorization (e.g., `https://f004.backblazeb2.com`).
+ * @param bucketName - The bucket containing the file.
+ * @param fileName - The file name (path) to download.
+ * @param authorizationToken - A download authorization token from `b2_get_download_authorization`.
+ * @param validDurationInSeconds - URL validity duration in seconds. Defaults to 3600 (1 hour).
+ *
+ * @returns The presigned download URL string.
+ */
+export declare function presignGetObjectUrl(downloadUrl: string, bucketName: string, fileName: string, authorizationToken: string, validDurationInSeconds?: number): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/s3/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/s3/index.js"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE;QACpB,+DAA+D;QAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,yEAAyE;QACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;KACjC,CAAA;IACD,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CACjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,CAcvE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,MAAM,EAC1B,sBAAsB,SAAO,GAC5B,MAAM,CAGR"}

package/dist/s3/index.js

@@ -0,0 +1,23 @@
+function createS3ClientConfig(config) {
+  const s3Url = config.accountInfo.getS3ApiUrl();
+  const regionMatch = s3Url.match(/s3\.([^.]+)\.backblazeb2\.com/);
+  const region = config.region ?? regionMatch?.[1] ?? "us-west-004";
+  return {
+    endpoint: s3Url,
+    region,
+    credentials: {
+      accessKeyId: config.applicationKeyId,
+      secretAccessKey: config.applicationKey
+    },
+    forcePathStyle: true
+  };
+}
+function presignGetObjectUrl(downloadUrl, bucketName, fileName, authorizationToken, validDurationInSeconds = 3600) {
+  const expires = Math.floor(Date.now() / 1e3) + validDurationInSeconds;
+  return `${downloadUrl}/file/${encodeURIComponent(bucketName)}/${encodeURIComponent(fileName)}?Authorization=${encodeURIComponent(authorizationToken)}&expires=${expires}`;
+}
+export {
+  createS3ClientConfig,
+  presignGetObjectUrl
+};
+//# sourceMappingURL=index.js.map

package/dist/s3/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../src/s3/index.ts"],"sourcesContent":["/**\n * S3-compatible helpers for using B2 with the AWS SDK.\n *\n * Provides {@link createS3ClientConfig} to derive endpoint, region, and\n * credentials from B2 authorization state, plus {@link presignGetObjectUrl}\n * for generating download URLs using B2 native download authorization.\n *\n * @packageDocumentation\n */\n\nimport type { AccountInfo } from '../auth/account-info.ts'\n\n/**\n * Configuration for deriving S3-compatible client settings from B2 auth state.\n *\n * Per B2's S3-compatible API contract, the S3 `accessKeyId` is the\n * `applicationKeyId` and the S3 `secretAccessKey` is the\n * `applicationKey`. These are NOT the native `accountId` /\n * `authorizationToken` returned by `b2_authorize_account` — those won't\n * authenticate against the S3 endpoint. Both must be supplied here\n * because `AccountInfo` doesn't retain the application key after\n * authorization for security reasons.\n *\n * @see https://www.backblaze.com/apidocs/s3-compatible-api\n */\nexport interface B2S3Config {\n  /** The authorized AccountInfo containing the S3 endpoint URL. */\n  readonly accountInfo: AccountInfo\n  /** B2 application key ID. Used as the S3 `accessKeyId`. */\n  readonly applicationKeyId: string\n  /** B2 application key (secret). Used as the S3 `secretAccessKey`. */\n  readonly applicationKey: string\n  /** Override the S3 region. If omitted, extracted from the S3 API URL. */\n  readonly region?: string\n}\n\n/** Configuration object compatible with `@aws-sdk/client-s3`'s S3Client constructor. */\nexport interface S3ClientConfig {\n  /** The S3-compatible endpoint URL (e.g., `https://s3.us-west-004.backblazeb2.com`). */\n  readonly endpoint: string\n  /** The S3 region identifier (e.g., `us-west-004`). */\n  readonly region: string\n  /** AWS-style credentials — the B2 application key pair. */\n  readonly credentials: {\n    /** The B2 application key ID, used as the S3 access key ID. */\n    readonly accessKeyId: string\n    /** The B2 application key (secret), used as the S3 secret access key. */\n    readonly secretAccessKey: string\n  }\n  /** Always `true` for B2, which requires path-style bucket addressing. */\n  readonly forcePathStyle: boolean\n}\n\n/**\n * Derives an S3-compatible client configuration from B2 authorization state.\n * Pass the result to `new S3Client(config)` from `@aws-sdk/client-s3`.\n *\n * @param config - B2 auth state, application key credentials, and optional region override.\n *\n * @returns Configuration ready for the AWS S3 SDK.\n *\n * @example\n * ```ts\n * const { B2_APPLICATION_KEY_ID, B2_APPLICATION_KEY } = process.env\n * if (!B2_APPLICATION_KEY_ID || !B2_APPLICATION_KEY) throw new Error('Missing B2 credentials')\n * const s3 = new S3Client(createS3ClientConfig({\n *   accountInfo: client.accountInfo,\n *   applicationKeyId: B2_APPLICATION_KEY_ID,\n *   applicationKey: B2_APPLICATION_KEY,\n * }))\n * ```\n */\nexport function createS3ClientConfig(config: B2S3Config): S3ClientConfig {\n  const s3Url = config.accountInfo.getS3ApiUrl()\n  const regionMatch = s3Url.match(/s3\\.([^.]+)\\.backblazeb2\\.com/)\n  const region = config.region ?? regionMatch?.[1] ?? 'us-west-004'\n\n  return {\n    endpoint: s3Url,\n    region,\n    credentials: {\n      accessKeyId: config.applicationKeyId,\n      secretAccessKey: config.applicationKey,\n    },\n    forcePathStyle: true,\n  }\n}\n\n/**\n * Constructs a presigned download URL using B2's native download authorization.\n * This is not a standard S3 presigned URL but works for B2 download endpoints.\n *\n * @param downloadUrl - The B2 download URL from authorization (e.g., `https://f004.backblazeb2.com`).\n * @param bucketName - The bucket containing the file.\n * @param fileName - The file name (path) to download.\n * @param authorizationToken - A download authorization token from `b2_get_download_authorization`.\n * @param validDurationInSeconds - URL validity duration in seconds. Defaults to 3600 (1 hour).\n *\n * @returns The presigned download URL string.\n */\nexport function presignGetObjectUrl(\n  downloadUrl: string,\n  bucketName: string,\n  fileName: string,\n  authorizationToken: string,\n  validDurationInSeconds = 3600,\n): string {\n  const expires = Math.floor(Date.now() / 1000) + validDurationInSeconds\n  return `${downloadUrl}/file/${encodeURIComponent(bucketName)}/${encodeURIComponent(fileName)}?Authorization=${encodeURIComponent(authorizationToken)}&expires=${expires}`\n}\n"],"names":[],"mappings":"AAwEO,SAAS,qBAAqB,QAAoC;AACvE,QAAM,QAAQ,OAAO,YAAY,YAAA;AACjC,QAAM,cAAc,MAAM,MAAM,+BAA+B;AAC/D,QAAM,SAAS,OAAO,UAAU,cAAc,CAAC,KAAK;AAEpD,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,MACX,aAAa,OAAO;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAAA;AAAA,IAE1B,gBAAgB;AAAA,EAAA;AAEpB;AAcO,SAAS,oBACd,aACA,YACA,UACA,oBACA,yBAAyB,MACjB;AACR,QAAM,UAAU,KAAK,MAAM,KAAK,IAAA,IAAQ,GAAI,IAAI;AAChD,SAAO,GAAG,WAAW,SAAS,mBAAmB,UAAU,CAAC,IAAI,mBAAmB,QAAQ,CAAC,kBAAkB,mBAAmB,kBAAkB,CAAC,YAAY,OAAO;AACzK;"}

package/dist/simulator/capabilities.cjs

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const auth = require("../types/auth.cjs");
+const ENDPOINT_CAPABILITIES = {
+  // Auth endpoint takes credentials, not an auth token — no cap check.
+  b2_authorize_account: [],
+  // Bucket management.
+  b2_create_bucket: [auth.Capability.WriteBuckets],
+  b2_delete_bucket: [auth.Capability.DeleteBuckets],
+  b2_update_bucket: [auth.Capability.WriteBuckets],
+  b2_list_buckets: [auth.Capability.ListBuckets],
+  // File upload + URL acquisition.
+  b2_get_upload_url: [auth.Capability.WriteFiles],
+  b2_get_upload_part_url: [auth.Capability.WriteFiles],
+  b2_upload_file: [auth.Capability.WriteFiles],
+  b2_upload_part: [auth.Capability.WriteFiles],
+  b2_start_large_file: [auth.Capability.WriteFiles],
+  b2_finish_large_file: [auth.Capability.WriteFiles],
+  b2_cancel_large_file: [auth.Capability.WriteFiles],
+  b2_copy_file: [auth.Capability.WriteFiles],
+  b2_copy_part: [auth.Capability.WriteFiles],
+  // File listing + reading.
+  b2_list_file_names: [auth.Capability.ListFiles],
+  b2_list_file_versions: [auth.Capability.ListFiles],
+  b2_list_unfinished_large_files: [auth.Capability.ListFiles],
+  b2_list_parts: [auth.Capability.ListFiles],
+  b2_get_file_info: [auth.Capability.ReadFiles],
+  b2_download_file_by_id: [auth.Capability.ReadFiles],
+  b2_download_file_by_name: [auth.Capability.ReadFiles],
+  // File mutations.
+  b2_hide_file: [auth.Capability.WriteFiles],
+  b2_delete_file_version: [auth.Capability.DeleteFiles],
+  // Object lock + legal hold.
+  b2_update_file_retention: [auth.Capability.WriteFileRetentions],
+  b2_update_file_legal_hold: [auth.Capability.WriteFileLegalHolds],
+  // Application keys.
+  b2_create_key: [auth.Capability.WriteKeys],
+  b2_list_keys: [auth.Capability.ListKeys],
+  b2_delete_key: [auth.Capability.DeleteKeys],
+  // Download authorisation.
+  b2_get_download_authorization: [auth.Capability.ShareFiles],
+  // Notification rules.
+  b2_get_bucket_notification_rules: [auth.Capability.ReadBucketNotifications],
+  b2_set_bucket_notification_rules: [auth.Capability.WriteBucketNotifications]
+};
+function missingCapabilitiesFor(endpoint, granted) {
+  const required = ENDPOINT_CAPABILITIES[endpoint] ?? [];
+  const grantedSet = new Set(granted);
+  return required.filter((cap) => !grantedSet.has(cap));
+}
+exports.ENDPOINT_CAPABILITIES = ENDPOINT_CAPABILITIES;
+exports.missingCapabilitiesFor = missingCapabilitiesFor;
+//# sourceMappingURL=capabilities.cjs.map

package/dist/simulator/capabilities.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.cjs","sources":["../../src/simulator/capabilities.ts"],"sourcesContent":["/**\n * Capability requirement table mapping each B2 native API endpoint to\n * the capability (or capabilities — usually one) the caller's\n * application key must hold to invoke it. Used by `B2Simulator` when\n * `strictAuth: true` is set, so test code that exercises a restricted\n * key sees the same `403 unauthorized` response real B2 would return.\n *\n * Source: https://www.backblaze.com/apidocs (each endpoint page lists\n * the required capability in its description).\n *\n * @packageDocumentation\n */\n\nimport { Capability } from '../types/auth.ts'\n\n/** Endpoint → required capability(s). An empty array means \"no capability check\". */\nexport const ENDPOINT_CAPABILITIES: Record<string, readonly Capability[]> = {\n  // Auth endpoint takes credentials, not an auth token — no cap check.\n  b2_authorize_account: [],\n  // Bucket management.\n  b2_create_bucket: [Capability.WriteBuckets],\n  b2_delete_bucket: [Capability.DeleteBuckets],\n  b2_update_bucket: [Capability.WriteBuckets],\n  b2_list_buckets: [Capability.ListBuckets],\n  // File upload + URL acquisition.\n  b2_get_upload_url: [Capability.WriteFiles],\n  b2_get_upload_part_url: [Capability.WriteFiles],\n  b2_upload_file: [Capability.WriteFiles],\n  b2_upload_part: [Capability.WriteFiles],\n  b2_start_large_file: [Capability.WriteFiles],\n  b2_finish_large_file: [Capability.WriteFiles],\n  b2_cancel_large_file: [Capability.WriteFiles],\n  b2_copy_file: [Capability.WriteFiles],\n  b2_copy_part: [Capability.WriteFiles],\n  // File listing + reading.\n  b2_list_file_names: [Capability.ListFiles],\n  b2_list_file_versions: [Capability.ListFiles],\n  b2_list_unfinished_large_files: [Capability.ListFiles],\n  b2_list_parts: [Capability.ListFiles],\n  b2_get_file_info: [Capability.ReadFiles],\n  b2_download_file_by_id: [Capability.ReadFiles],\n  b2_download_file_by_name: [Capability.ReadFiles],\n  // File mutations.\n  b2_hide_file: [Capability.WriteFiles],\n  b2_delete_file_version: [Capability.DeleteFiles],\n  // Object lock + legal hold.\n  b2_update_file_retention: [Capability.WriteFileRetentions],\n  b2_update_file_legal_hold: [Capability.WriteFileLegalHolds],\n  // Application keys.\n  b2_create_key: [Capability.WriteKeys],\n  b2_list_keys: [Capability.ListKeys],\n  b2_delete_key: [Capability.DeleteKeys],\n  // Download authorisation.\n  b2_get_download_authorization: [Capability.ShareFiles],\n  // Notification rules.\n  b2_get_bucket_notification_rules: [Capability.ReadBucketNotifications],\n  b2_set_bucket_notification_rules: [Capability.WriteBucketNotifications],\n}\n\n/**\n * Find which capabilities are missing from the caller's grant set\n * relative to the endpoint requirement.\n *\n * @param endpoint - B2 endpoint name (e.g. `'b2_upload_file'`).\n * @param granted - Capabilities the caller's key has.\n *\n * @returns The subset of required capabilities that the caller is\n *   missing. Empty array means \"request authorized\".\n */\nexport function missingCapabilitiesFor(\n  endpoint: string,\n  granted: readonly Capability[],\n): readonly Capability[] {\n  const required = ENDPOINT_CAPABILITIES[endpoint] ?? []\n  const grantedSet = new Set(granted)\n  return required.filter((cap) => !grantedSet.has(cap))\n}\n"],"names":["Capability"],"mappings":";;;AAgBO,MAAM,wBAA+D;AAAA;AAAA,EAE1E,sBAAsB,CAAA;AAAA;AAAA,EAEtB,kBAAkB,CAACA,KAAAA,WAAW,YAAY;AAAA,EAC1C,kBAAkB,CAACA,KAAAA,WAAW,aAAa;AAAA,EAC3C,kBAAkB,CAACA,KAAAA,WAAW,YAAY;AAAA,EAC1C,iBAAiB,CAACA,KAAAA,WAAW,WAAW;AAAA;AAAA,EAExC,mBAAmB,CAACA,KAAAA,WAAW,UAAU;AAAA,EACzC,wBAAwB,CAACA,KAAAA,WAAW,UAAU;AAAA,EAC9C,gBAAgB,CAACA,KAAAA,WAAW,UAAU;AAAA,EACtC,gBAAgB,CAACA,KAAAA,WAAW,UAAU;AAAA,EACtC,qBAAqB,CAACA,KAAAA,WAAW,UAAU;AAAA,EAC3C,sBAAsB,CAACA,KAAAA,WAAW,UAAU;AAAA,EAC5C,sBAAsB,CAACA,KAAAA,WAAW,UAAU;AAAA,EAC5C,cAAc,CAACA,KAAAA,WAAW,UAAU;AAAA,EACpC,cAAc,CAACA,KAAAA,WAAW,UAAU;AAAA;AAAA,EAEpC,oBAAoB,CAACA,KAAAA,WAAW,SAAS;AAAA,EACzC,uBAAuB,CAACA,KAAAA,WAAW,SAAS;AAAA,EAC5C,gCAAgC,CAACA,KAAAA,WAAW,SAAS;AAAA,EACrD,eAAe,CAACA,KAAAA,WAAW,SAAS;AAAA,EACpC,kBAAkB,CAACA,KAAAA,WAAW,SAAS;AAAA,EACvC,wBAAwB,CAACA,KAAAA,WAAW,SAAS;AAAA,EAC7C,0BAA0B,CAACA,KAAAA,WAAW,SAAS;AAAA;AAAA,EAE/C,cAAc,CAACA,KAAAA,WAAW,UAAU;AAAA,EACpC,wBAAwB,CAACA,KAAAA,WAAW,WAAW;AAAA;AAAA,EAE/C,0BAA0B,CAACA,KAAAA,WAAW,mBAAmB;AAAA,EACzD,2BAA2B,CAACA,KAAAA,WAAW,mBAAmB;AAAA;AAAA,EAE1D,eAAe,CAACA,KAAAA,WAAW,SAAS;AAAA,EACpC,cAAc,CAACA,KAAAA,WAAW,QAAQ;AAAA,EAClC,eAAe,CAACA,KAAAA,WAAW,UAAU;AAAA;AAAA,EAErC,+BAA+B,CAACA,KAAAA,WAAW,UAAU;AAAA;AAAA,EAErD,kCAAkC,CAACA,KAAAA,WAAW,uBAAuB;AAAA,EACrE,kCAAkC,CAACA,KAAAA,WAAW,wBAAwB;AACxE;AAYO,SAAS,uBACd,UACA,SACuB;AACvB,QAAM,WAAW,sBAAsB,QAAQ,KAAK,CAAA;AACpD,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,SAAO,SAAS,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,GAAG,CAAC;AACtD;;;"}

package/dist/simulator/capabilities.d.cts

@@ -0,0 +1,15 @@
+import { Capability } from '../types/auth.js';
+/** Endpoint → required capability(s). An empty array means "no capability check". */
+export declare const ENDPOINT_CAPABILITIES: Record<string, readonly Capability[]>;
+/**
+ * Find which capabilities are missing from the caller's grant set
+ * relative to the endpoint requirement.
+ *
+ * @param endpoint - B2 endpoint name (e.g. `'b2_upload_file'`).
+ * @param granted - Capabilities the caller's key has.
+ *
+ * @returns The subset of required capabilities that the caller is
+ *   missing. Empty array means "request authorized".
+ */
+export declare function missingCapabilitiesFor(endpoint: string, granted: readonly Capability[]): readonly Capability[];
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/simulator/capabilities.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/simulator/capabilities.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAyCvE,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,UAAU,EAAE,GAC7B,SAAS,UAAU,EAAE,CAIvB"}

package/dist/simulator/capabilities.d.ts

@@ -0,0 +1,15 @@
+import { Capability } from '../types/auth.js';
+/** Endpoint → required capability(s). An empty array means "no capability check". */
+export declare const ENDPOINT_CAPABILITIES: Record<string, readonly Capability[]>;
+/**
+ * Find which capabilities are missing from the caller's grant set
+ * relative to the endpoint requirement.
+ *
+ * @param endpoint - B2 endpoint name (e.g. `'b2_upload_file'`).
+ * @param granted - Capabilities the caller's key has.
+ *
+ * @returns The subset of required capabilities that the caller is
+ *   missing. Empty array means "request authorized".
+ */
+export declare function missingCapabilitiesFor(endpoint: string, granted: readonly Capability[]): readonly Capability[];
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/simulator/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/simulator/capabilities.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAyCvE,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,UAAU,EAAE,GAC7B,SAAS,UAAU,EAAE,CAIvB"}

package/dist/simulator/capabilities.js

@@ -0,0 +1,53 @@
+import { Capability } from "../types/auth.js";
+const ENDPOINT_CAPABILITIES = {
+  // Auth endpoint takes credentials, not an auth token — no cap check.
+  b2_authorize_account: [],
+  // Bucket management.
+  b2_create_bucket: [Capability.WriteBuckets],
+  b2_delete_bucket: [Capability.DeleteBuckets],
+  b2_update_bucket: [Capability.WriteBuckets],
+  b2_list_buckets: [Capability.ListBuckets],
+  // File upload + URL acquisition.
+  b2_get_upload_url: [Capability.WriteFiles],
+  b2_get_upload_part_url: [Capability.WriteFiles],
+  b2_upload_file: [Capability.WriteFiles],
+  b2_upload_part: [Capability.WriteFiles],
+  b2_start_large_file: [Capability.WriteFiles],
+  b2_finish_large_file: [Capability.WriteFiles],
+  b2_cancel_large_file: [Capability.WriteFiles],
+  b2_copy_file: [Capability.WriteFiles],
+  b2_copy_part: [Capability.WriteFiles],
+  // File listing + reading.
+  b2_list_file_names: [Capability.ListFiles],
+  b2_list_file_versions: [Capability.ListFiles],
+  b2_list_unfinished_large_files: [Capability.ListFiles],
+  b2_list_parts: [Capability.ListFiles],
+  b2_get_file_info: [Capability.ReadFiles],
+  b2_download_file_by_id: [Capability.ReadFiles],
+  b2_download_file_by_name: [Capability.ReadFiles],
+  // File mutations.
+  b2_hide_file: [Capability.WriteFiles],
+  b2_delete_file_version: [Capability.DeleteFiles],
+  // Object lock + legal hold.
+  b2_update_file_retention: [Capability.WriteFileRetentions],
+  b2_update_file_legal_hold: [Capability.WriteFileLegalHolds],
+  // Application keys.
+  b2_create_key: [Capability.WriteKeys],
+  b2_list_keys: [Capability.ListKeys],
+  b2_delete_key: [Capability.DeleteKeys],
+  // Download authorisation.
+  b2_get_download_authorization: [Capability.ShareFiles],
+  // Notification rules.
+  b2_get_bucket_notification_rules: [Capability.ReadBucketNotifications],
+  b2_set_bucket_notification_rules: [Capability.WriteBucketNotifications]
+};
+function missingCapabilitiesFor(endpoint, granted) {
+  const required = ENDPOINT_CAPABILITIES[endpoint] ?? [];
+  const grantedSet = new Set(granted);
+  return required.filter((cap) => !grantedSet.has(cap));
+}
+export {
+  ENDPOINT_CAPABILITIES,
+  missingCapabilitiesFor
+};
+//# sourceMappingURL=capabilities.js.map

package/dist/simulator/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sources":["../../src/simulator/capabilities.ts"],"sourcesContent":["/**\n * Capability requirement table mapping each B2 native API endpoint to\n * the capability (or capabilities — usually one) the caller's\n * application key must hold to invoke it. Used by `B2Simulator` when\n * `strictAuth: true` is set, so test code that exercises a restricted\n * key sees the same `403 unauthorized` response real B2 would return.\n *\n * Source: https://www.backblaze.com/apidocs (each endpoint page lists\n * the required capability in its description).\n *\n * @packageDocumentation\n */\n\nimport { Capability } from '../types/auth.ts'\n\n/** Endpoint → required capability(s). An empty array means \"no capability check\". */\nexport const ENDPOINT_CAPABILITIES: Record<string, readonly Capability[]> = {\n  // Auth endpoint takes credentials, not an auth token — no cap check.\n  b2_authorize_account: [],\n  // Bucket management.\n  b2_create_bucket: [Capability.WriteBuckets],\n  b2_delete_bucket: [Capability.DeleteBuckets],\n  b2_update_bucket: [Capability.WriteBuckets],\n  b2_list_buckets: [Capability.ListBuckets],\n  // File upload + URL acquisition.\n  b2_get_upload_url: [Capability.WriteFiles],\n  b2_get_upload_part_url: [Capability.WriteFiles],\n  b2_upload_file: [Capability.WriteFiles],\n  b2_upload_part: [Capability.WriteFiles],\n  b2_start_large_file: [Capability.WriteFiles],\n  b2_finish_large_file: [Capability.WriteFiles],\n  b2_cancel_large_file: [Capability.WriteFiles],\n  b2_copy_file: [Capability.WriteFiles],\n  b2_copy_part: [Capability.WriteFiles],\n  // File listing + reading.\n  b2_list_file_names: [Capability.ListFiles],\n  b2_list_file_versions: [Capability.ListFiles],\n  b2_list_unfinished_large_files: [Capability.ListFiles],\n  b2_list_parts: [Capability.ListFiles],\n  b2_get_file_info: [Capability.ReadFiles],\n  b2_download_file_by_id: [Capability.ReadFiles],\n  b2_download_file_by_name: [Capability.ReadFiles],\n  // File mutations.\n  b2_hide_file: [Capability.WriteFiles],\n  b2_delete_file_version: [Capability.DeleteFiles],\n  // Object lock + legal hold.\n  b2_update_file_retention: [Capability.WriteFileRetentions],\n  b2_update_file_legal_hold: [Capability.WriteFileLegalHolds],\n  // Application keys.\n  b2_create_key: [Capability.WriteKeys],\n  b2_list_keys: [Capability.ListKeys],\n  b2_delete_key: [Capability.DeleteKeys],\n  // Download authorisation.\n  b2_get_download_authorization: [Capability.ShareFiles],\n  // Notification rules.\n  b2_get_bucket_notification_rules: [Capability.ReadBucketNotifications],\n  b2_set_bucket_notification_rules: [Capability.WriteBucketNotifications],\n}\n\n/**\n * Find which capabilities are missing from the caller's grant set\n * relative to the endpoint requirement.\n *\n * @param endpoint - B2 endpoint name (e.g. `'b2_upload_file'`).\n * @param granted - Capabilities the caller's key has.\n *\n * @returns The subset of required capabilities that the caller is\n *   missing. Empty array means \"request authorized\".\n */\nexport function missingCapabilitiesFor(\n  endpoint: string,\n  granted: readonly Capability[],\n): readonly Capability[] {\n  const required = ENDPOINT_CAPABILITIES[endpoint] ?? []\n  const grantedSet = new Set(granted)\n  return required.filter((cap) => !grantedSet.has(cap))\n}\n"],"names":[],"mappings":";AAgBO,MAAM,wBAA+D;AAAA;AAAA,EAE1E,sBAAsB,CAAA;AAAA;AAAA,EAEtB,kBAAkB,CAAC,WAAW,YAAY;AAAA,EAC1C,kBAAkB,CAAC,WAAW,aAAa;AAAA,EAC3C,kBAAkB,CAAC,WAAW,YAAY;AAAA,EAC1C,iBAAiB,CAAC,WAAW,WAAW;AAAA;AAAA,EAExC,mBAAmB,CAAC,WAAW,UAAU;AAAA,EACzC,wBAAwB,CAAC,WAAW,UAAU;AAAA,EAC9C,gBAAgB,CAAC,WAAW,UAAU;AAAA,EACtC,gBAAgB,CAAC,WAAW,UAAU;AAAA,EACtC,qBAAqB,CAAC,WAAW,UAAU;AAAA,EAC3C,sBAAsB,CAAC,WAAW,UAAU;AAAA,EAC5C,sBAAsB,CAAC,WAAW,UAAU;AAAA,EAC5C,cAAc,CAAC,WAAW,UAAU;AAAA,EACpC,cAAc,CAAC,WAAW,UAAU;AAAA;AAAA,EAEpC,oBAAoB,CAAC,WAAW,SAAS;AAAA,EACzC,uBAAuB,CAAC,WAAW,SAAS;AAAA,EAC5C,gCAAgC,CAAC,WAAW,SAAS;AAAA,EACrD,eAAe,CAAC,WAAW,SAAS;AAAA,EACpC,kBAAkB,CAAC,WAAW,SAAS;AAAA,EACvC,wBAAwB,CAAC,WAAW,SAAS;AAAA,EAC7C,0BAA0B,CAAC,WAAW,SAAS;AAAA;AAAA,EAE/C,cAAc,CAAC,WAAW,UAAU;AAAA,EACpC,wBAAwB,CAAC,WAAW,WAAW;AAAA;AAAA,EAE/C,0BAA0B,CAAC,WAAW,mBAAmB;AAAA,EACzD,2BAA2B,CAAC,WAAW,mBAAmB;AAAA;AAAA,EAE1D,eAAe,CAAC,WAAW,SAAS;AAAA,EACpC,cAAc,CAAC,WAAW,QAAQ;AAAA,EAClC,eAAe,CAAC,WAAW,UAAU;AAAA;AAAA,EAErC,+BAA+B,CAAC,WAAW,UAAU;AAAA;AAAA,EAErD,kCAAkC,CAAC,WAAW,uBAAuB;AAAA,EACrE,kCAAkC,CAAC,WAAW,wBAAwB;AACxE;AAYO,SAAS,uBACd,UACA,SACuB;AACvB,QAAM,WAAW,sBAAsB,QAAQ,KAAK,CAAA;AACpD,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,SAAO,SAAS,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,GAAG,CAAC;AACtD;"}