@backblaze-labs/b2-sdk 0.2.0 → 0.3.0

package/dist/sync/synchronizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"synchronizer.js","names":[],"sources":["../../src/sync/synchronizer.ts"],"sourcesContent":["import type { Bucket } from '../bucket.ts'\nimport type { SseCDownloadKey } from '../raw/index.ts'\nimport { type ContentSource, FileSource } from '../streams/source.ts'\nimport type { EncryptionSetting } from '../types/encryption.ts'\nimport { fileId as fileIdOf } from '../types/ids.ts'\nimport { DEFAULT_TRANSFER_CONCURRENCY } from '../util/defaults.ts'\nimport { sanitizeErrorReason } from '../util/error-reason.ts'\nimport type { SyncAction } from './actions/index.ts'\nimport {\n  CopyAction,\n  DeleteLocalAction,\n  DeleteRemoteAction,\n  DownloadAction,\n  HideAction,\n  SkipAction,\n  UploadAction,\n} from './actions/index.ts'\nimport {\n  hashReadableStreamSha1,\n  normalizeSha1VerificationMaxBytes,\n  withSha1VerificationDeadline,\n} from './b2-sha1-reader.ts'\nimport { localFilesystemErrorReason } from './filesystem-errors.ts'\nimport {\n  deleteLocalFileInsideRoot,\n  validateScannedLocalFile,\n  writeLocalStreamInsideRoot,\n} from './local-file-io.ts'\nimport { isLocalFilesystemRoot } from './local-filesystem-root.ts'\nimport { readLocalSha1File } from './local-sha1.ts'\nimport { type SyncPair, zipFolders } from './pairing.ts'\nimport { safeRelativePathSegments } from './path-safety.ts'\nimport {\n  assertSupportedCompareMode,\n  type B2Sha1Reader,\n  type ComparePreparationResult,\n  preparePairsForCompare,\n  readyComparePair,\n} from './policies/compare.ts'\nimport type { ActionFactory } from './policies/index.ts'\nimport { generateActions } from './policies/index.ts'\nimport { asRawB2KeyPrefix, b2KeyToRelativePathUnderPrefix } from './prefix.ts'\nimport {\n  DEFAULT_SHA1_VERIFICATION_TIMEOUT_MILLIS,\n  normalizeSha1TimeoutMillis,\n} from './sha1-options.ts'\nimport type {\n  B2SyncPath,\n  LocalSyncPath,\n  SyncDirection,\n  SyncEvent,\n  SyncFolder,\n  SyncOptions,\n  SyncPath,\n  SyncScanOptions,\n  SyncSkipEvent,\n} from './types.ts'\n\nconst MAX_BUFFERED_SCAN_EVENTS = 100\nconst MAX_AGGREGATE_FAILED_PATHS = 100\nconst DEFAULT_DOWNLOAD_IDLE_TIMEOUT_MILLIS = 60_000\n\ninterface ScanEventBuffer {\n  readonly events: SyncEvent[]\n  fatalFilesystemErrorMessage?: string\n  sourceInventoryIncompleteMessage?: string\n  dropped: number\n}\n\n/**\n * Test hooks for bounded planning behavior.\n *\n * @internal\n */\nexport const synchronizerTestHooks: {\n  afterNonSha1PlanBatch?: (batchSize: number) => void\n} = {}\n\n/** Base configuration for a sync operation. */\nexport interface SynchronizerConfig {\n  /** The folder to read files from. */\n  readonly source: SyncFolder\n  /** The folder to write files to. */\n  readonly dest: SyncFolder\n  /** Options controlling comparison, deletion policy, and concurrency. */\n  readonly options: SyncOptions\n}\n\n/** A sync folder constrained to the local filesystem. */\nexport interface LocalSyncFolder extends SyncFolder {\n  /** Discriminant identifying a local folder. */\n  readonly type: 'local'\n  /** Absolute filesystem path to the local root directory. */\n  readonly root: string\n}\n\n/** A sync folder constrained to a B2 bucket prefix. */\nexport interface B2SyncFolder extends SyncFolder {\n  /** Discriminant identifying a B2 folder. */\n  readonly type: 'b2'\n  /** Raw B2 key prefix represented by this folder when known. */\n  readonly rawPrefix?: string\n}\n\n/** Configuration for a local-to-B2 sync (upload direction). */\nexport interface SynchronizerUpConfig extends SynchronizerConfig {\n  /** Local source folder. */\n  readonly source: LocalSyncFolder\n  /** B2 destination folder. */\n  readonly dest: B2SyncFolder\n  /** The target B2 bucket. */\n  readonly bucket: Bucket\n  /**\n   * Raw B2 key prefix for uploaded files in the bucket.\n   * Backslashes are preserved as raw B2 key characters.\n   */\n  readonly prefix: string\n}\n\n/** Configuration for a B2-to-local sync (download direction). */\nexport interface SynchronizerDownConfig extends SynchronizerConfig {\n  /** B2 source folder. */\n  readonly source: B2SyncFolder\n  /** Local destination folder. */\n  readonly dest: LocalSyncFolder\n  /** The source B2 bucket. */\n  readonly bucket: Bucket\n}\n\n/** Configuration for a B2-to-B2 sync (copy direction). */\nexport interface SynchronizerB2Config extends SynchronizerConfig {\n  /** B2 source folder. */\n  readonly source: B2SyncFolder\n  /** B2 destination folder. */\n  readonly dest: B2SyncFolder\n  /** The B2 bucket used for copy, hide, and delete operations. */\n  readonly bucket: Bucket\n  /**\n   * Key prefix for destination-side copy, hide, and delete mutations.\n   *\n   * When omitted, the synchronizer uses `dest.rawPrefix` when the destination\n   * folder exposes one. Set this explicitly for custom B2 folders that do not\n   * expose their raw prefix.\n   */\n  readonly prefix?: string\n}\n\n/** Concrete sync configurations supported by {@link synchronize}. */\nexport type SupportedSynchronizerConfig =\n  | SynchronizerUpConfig\n  | SynchronizerDownConfig\n  | SynchronizerB2Config\n\ninterface PreparedActionPlan {\n  readonly event: SyncEvent\n  readonly actions: readonly SyncAction[]\n}\n\ninterface LocalRootIdentity {\n  readonly deviceId: number | bigint\n  readonly inode: number | bigint\n}\n\ninterface LocalRootContext {\n  readonly root: string\n  readonly realPath: string\n  readonly identity?: LocalRootIdentity\n}\n\ninterface LocalRootContexts {\n  readonly source?: LocalRootContext\n  readonly dest?: LocalRootContext\n}\n\n/**\n * Infers the sync direction from the source and destination folder types.\n * @param source - The folder to read files from.\n * @param dest - The folder to write files to.\n *\n * @returns The resolved sync direction based on folder types.\n *\n * @throws When the source and destination folder types form an unsupported combination.\n */\nfunction resolveDirection(source: SyncFolder, dest: SyncFolder): SyncDirection {\n  if (source.type === 'local' && dest.type === 'b2') return 'local-to-b2'\n  if (source.type === 'b2' && dest.type === 'local') return 'b2-to-local'\n  if (source.type === 'b2' && dest.type === 'b2') return 'b2-to-b2'\n  throw new Error(`Unsupported sync direction: ${source.type} to ${dest.type}`)\n}\n\n/**\n * Runs a full sync operation: scans both folders, pairs files, generates actions,\n * and executes them with bounded concurrency. Yields {@link SyncEvent} entries for\n * each comparison and action result.\n *\n * @param config - The synchronizer configuration (source, dest, options, and optional bucket).\n *\n * @returns An async generator that yields comparison and action events.\n */\nexport function synchronize(config: SupportedSynchronizerConfig): AsyncGenerator<SyncEvent>\n/**\n * Legacy overload for broad custom synchronizer configurations.\n *\n * @param config - The synchronizer configuration.\n *\n * @returns An async generator that yields comparison and action events.\n *\n * @deprecated Use {@link SupportedSynchronizerConfig}. This legacy overload\n * accepts broad custom configurations for source compatibility, but the\n * supported union is the public contract for built-in sync directions.\n */\nexport function synchronize(config: SynchronizerConfig): AsyncGenerator<SyncEvent>\nexport async function* synchronize(config: SynchronizerConfig): AsyncGenerator<SyncEvent> {\n  const { source, dest, options } = config\n  assertSupportedCompareMode(options.compareMode)\n  const direction = resolveDirection(source, dest)\n  const dryRun = options.dryRun ?? false\n  const concurrency = normalizeSyncConcurrency(options.concurrency)\n  const keepDays = options.keepDays ?? 0\n  const compareThreshold = options.compareThreshold ?? 0\n  const nowMillis = Date.now()\n  const localRootContexts = await resolveLocalRootContexts(config)\n  const queuedEvents: SyncEvent[] = []\n  const failedPaths: string[] = []\n  const failedPathSet = new Set<string>()\n  let errorCount = 0\n  let failedPathOmittedCount = 0\n  let scanHadError = false\n  const runningActions = new Set<Promise<void>>()\n  const scanEvents: ScanEventBuffer = { events: [], dropped: 0 }\n  const scanOptions: SyncScanOptions = {\n    ...(options.include !== undefined ? { include: options.include } : {}),\n    ...(options.exclude !== undefined ? { exclude: options.exclude } : {}),\n    ...(options.signal !== undefined ? { signal: options.signal } : {}),\n    ...(options.maxScanEntries !== undefined ? { maxScanEntries: options.maxScanEntries } : {}),\n    ...(direction === 'b2-to-local' ? { requireLocalSafePaths: true } : {}),\n    onError: (event) => {\n      scanHadError = true\n      recordSyncError(event)\n      queueEvent(event)\n    },\n  }\n\n  const factory = createActionFactory(config, localRootContexts)\n  const readB2Sha1 = dryRun ? undefined : createB2Sha1Reader(config)\n  const actionAbortController = new AbortController()\n  const removeAbortForwarder = forwardAbortSignal(options.signal, actionAbortController)\n  let completed = false\n\n  async function* finishAfterAbort(): AsyncGenerator<SyncEvent> {\n    await drainActions()\n    yield* emitQueuedEvents()\n  }\n\n  try {\n    let pairs: SyncPair[]\n    try {\n      pairs = await collectPairs()\n    } catch (err) {\n      await drainActions()\n      if (options.signal?.aborted) {\n        yield* finishAfterAbort()\n        return\n      }\n      if (!scanHadError) {\n        yield* emitQueuedEvents()\n        throw err\n      }\n\n      yield* emitQueuedEvents()\n      yield aggregateErrorEvent()\n      completed = true\n      return\n    }\n\n    yield* emitQueuedEvents()\n    const filesystemError = scanFilesystemError(scanEvents)\n    if (filesystemError !== undefined) throw filesystemError\n\n    if (options.signal?.aborted) {\n      yield* finishAfterAbort()\n      return\n    }\n\n    if (scanHadError) {\n      if (errorCount > 0) yield aggregateErrorEvent()\n      completed = true\n      return\n    }\n\n    if (options.compareMode === 'sha1') {\n      const compareBatchSize = concurrency\n      for (let index = 0; index < pairs.length; index += compareBatchSize) {\n        if (yield* emitSha1Batch(pairs.slice(index, index + compareBatchSize))) return\n      }\n    } else {\n      for (let index = 0; index < pairs.length; index += concurrency) {\n        const items = pairs\n          .slice(index, index + concurrency)\n          .map((pair) => planPreparedPair(pair, readyComparePair(pair)))\n        synchronizerTestHooks.afterNonSha1PlanBatch?.(items.length)\n        if (yield* emitPreparedItems(items)) return\n      }\n    }\n\n    await drainActions()\n    yield* emitQueuedEvents()\n\n    if (errorCount > 0) {\n      yield aggregateErrorEvent()\n    }\n    completed = true\n  } finally {\n    if (!completed) {\n      abortActionController(\n        actionAbortController,\n        new DOMException('Sync iterator closed', 'AbortError'),\n      )\n    }\n    removeAbortForwarder()\n    await drainActions()\n  }\n\n  async function collectPairs(): Promise<SyncPair[]> {\n    const pairs: SyncPair[] = []\n    for await (const pair of zipFolders(source, dest, scanOptions, {\n      onSourceSkip(event) {\n        bufferScanEvent(scanEvents, event, direction, 'source')\n      },\n      onDestSkip(event) {\n        bufferScanEvent(scanEvents, event, direction, 'dest')\n      },\n    })) {\n      if (options.signal?.aborted) return pairs\n      validateB2SourcePairPrefix(pair, config)\n      pairs.push(pair)\n    }\n    return pairs\n  }\n\n  async function* emitSha1Batch(batch: readonly SyncPair[]): AsyncGenerator<SyncEvent, boolean> {\n    if (batch.length === 0) return false\n\n    // Keep SHA-1 hashing / B2 verification and transfer actions under one effective\n    // concurrency ceiling. This intentionally creates a batch barrier instead of\n    // overlapping compare reads with prior transfers.\n    await drainActions()\n    yield* emitQueuedEvents()\n\n    const preparedBatch = await processPreparedBatch(batch)\n    if (yield* emitPreparedItems(preparedBatch.items)) return true\n    if (preparedBatch.aborted || options.signal?.aborted) {\n      yield* finishAfterAbort()\n      return true\n    }\n    return false\n  }\n\n  async function* emitPreparedItems(\n    items: readonly PreparedActionPlan[],\n  ): AsyncGenerator<SyncEvent, boolean> {\n    for (const item of items) {\n      yield* emitQueuedEvents()\n      yield item.event\n      yield* emitQueuedEvents()\n      /* v8 ignore next -- abort between compare yield and scheduling is timing-dependent */\n      if (options.signal?.aborted) {\n        yield* finishAfterAbort()\n        return true\n      }\n      for (const action of item.actions) {\n        await scheduleAction(action)\n        yield* emitQueuedEvents()\n      }\n    }\n    return false\n  }\n\n  async function processPreparedBatch(\n    batch: readonly SyncPair[],\n  ): Promise<{ readonly items: readonly PreparedActionPlan[]; readonly aborted: boolean }> {\n    if (batch.length === 0) return { items: [], aborted: false }\n    const preparedPairs = await preparePairsForCompare(batch, 'sha1', {\n      concurrency,\n      ...(options.signal !== undefined ? { signal: options.signal } : {}),\n      ...(options.sha1ReadTimeoutMillis !== undefined\n        ? { sha1ReadTimeoutMillis: options.sha1ReadTimeoutMillis }\n        : {}),\n      readLocalSha1: readLocalSha1File,\n      ...(readB2Sha1 !== undefined ? { readB2Sha1 } : {}),\n    })\n\n    const items: PreparedActionPlan[] = []\n    for (const { originalPair, prepared } of preparedPairs) {\n      if (prepared.aborted || options.signal?.aborted) return { items, aborted: true }\n      items.push(planPreparedPair(originalPair, prepared))\n    }\n    return { items, aborted: false }\n  }\n\n  function planPreparedPair(\n    pair: SyncPair,\n    prepared: ComparePreparationResult,\n  ): PreparedActionPlan {\n    const event: SyncEvent = {\n      type: 'compare',\n      path: (pair[0] ?? pair[1])?.relativePath ?? '',\n      size: 0,\n      bytesHashed: prepared.bytesHashed,\n      ...(prepared.bytesVerified > 0 ? { bytesVerified: prepared.bytesVerified } : {}),\n    }\n\n    let preparedErrorEventCount = 0\n    for (const preparedEvent of prepared.events) {\n      queueEvent(preparedEvent)\n      if (preparedEvent.type === 'error') {\n        preparedErrorEventCount++\n        recordFailurePath(preparedEvent.path)\n      }\n    }\n    errorCount += prepared.errors.length\n    for (let index = preparedErrorEventCount; index < prepared.errors.length; index++) {\n      recordFailurePath(event.path)\n    }\n    if (prepared.skipActionGeneration) return { event, actions: [] }\n    if (\n      (scanHadError || scanHadFilesystemError(scanEvents)) &&\n      prepared.pair[0] === null &&\n      prepared.pair[1] !== null\n    ) {\n      return {\n        event,\n        actions: [\n          new SkipAction(prepared.pair[1].relativePath, 'not removed because scan errors occurred'),\n        ],\n      }\n    }\n    if (\n      sourceInventoryIncomplete(scanEvents) &&\n      prepared.pair[0] === null &&\n      prepared.pair[1] !== null\n    ) {\n      return {\n        event,\n        actions: [\n          new SkipAction(\n            prepared.pair[1].relativePath,\n            scanEvents.sourceInventoryIncompleteMessage ??\n              'not removed because the source scan skipped unsafe B2 names',\n          ),\n        ],\n      }\n    }\n\n    const actions = [\n      ...generateActions(\n        prepared.pair,\n        direction,\n        options.compareMode,\n        options.keepMode,\n        keepDays,\n        nowMillis,\n        factory,\n        compareThreshold,\n      ),\n    ]\n\n    return { event, actions }\n  }\n\n  async function scheduleAction(action: SyncAction): Promise<void> {\n    const task = executeAction(action).finally(() => {\n      runningActions.delete(task)\n    })\n    runningActions.add(task)\n    if (runningActions.size >= concurrency) await Promise.race(runningActions)\n  }\n\n  async function executeAction(action: SyncAction): Promise<void> {\n    try {\n      if (actionAbortController.signal.aborted) return\n      const event = await action.execute(dryRun, actionAbortController.signal)\n      queueEvent(event)\n    } catch (err) {\n      const event: SyncEvent = {\n        type: 'error',\n        path: action.relativePath,\n        size: 0,\n        message: sanitizeErrorReason(err),\n      }\n      recordSyncError(event)\n      queueEvent(event)\n    }\n  }\n\n  function recordSyncError(event: SyncEvent): void {\n    errorCount += 1\n    recordFailurePath(event.path)\n  }\n\n  function recordFailurePath(path: string): void {\n    if (path === '') return\n    if (failedPathSet.has(path)) return\n    failedPathSet.add(path)\n    if (failedPaths.length < MAX_AGGREGATE_FAILED_PATHS) {\n      failedPaths.push(path)\n    } else {\n      failedPathOmittedCount++\n    }\n  }\n\n  function aggregateErrorEvent(): SyncEvent {\n    return {\n      type: 'error',\n      path: '',\n      size: 0,\n      message: `${errorCount} sync error(s) occurred`,\n      failureCount: errorCount,\n      failedPaths: [...failedPaths],\n      ...(failedPathOmittedCount > 0 ? { failedPathOmittedCount } : {}),\n    }\n  }\n\n  function queueEvent(event: SyncEvent): void {\n    queuedEvents.push(event)\n  }\n\n  async function* emitQueuedEvents(): AsyncGenerator<SyncEvent> {\n    yield* drainScanEvents(scanEvents)\n    for (const event of queuedEvents.splice(0)) yield event\n  }\n\n  async function drainActions(): Promise<void> {\n    while (runningActions.size > 0) {\n      await Promise.race(runningActions)\n    }\n  }\n}\n\n/**\n * Normalizes user-provided sync concurrency before it controls compare batches and transfers.\n *\n * @param value - Optional concurrency value from sync options.\n *\n * @returns A positive integer concurrency value.\n *\n * @throws When the configured concurrency is not a positive integer.\n */\nfunction normalizeSyncConcurrency(value: number | undefined): number {\n  const candidate = value ?? DEFAULT_TRANSFER_CONCURRENCY\n  if (!Number.isInteger(candidate) || candidate < 1) {\n    throw new RangeError('Sync concurrency must be a positive integer')\n  }\n  return candidate\n}\n\nfunction normalizeDownloadIdleTimeoutMillis(value: number | undefined): number {\n  if (value === undefined) return DEFAULT_DOWNLOAD_IDLE_TIMEOUT_MILLIS\n  if (value === Number.POSITIVE_INFINITY) return value\n  if (!Number.isFinite(value) || value < 1) {\n    throw new RangeError('downloadIdleTimeoutMillis must be a positive finite number or Infinity')\n  }\n  return Math.floor(value)\n}\n\nfunction assertValidB2ContentLength(contentLength: number): number {\n  if (!Number.isSafeInteger(contentLength) || contentLength < 0) {\n    throw new Error('B2 contentLength must be a non-negative safe integer')\n  }\n  return contentLength\n}\n\nfunction createB2Sha1Reader(config: SynchronizerConfig): B2Sha1Reader | undefined {\n  const upConfig = config as Partial<SynchronizerUpConfig>\n  const downConfig = config as Partial<SynchronizerDownConfig>\n  const bucket = upConfig.bucket ?? downConfig.bucket\n  if (bucket === undefined) return undefined\n  const readablePrefixes = b2ReadableRawPrefixes(config)\n  const idleTimeoutMillis = normalizeSha1TimeoutMillis(config.options.sha1ReadTimeoutMillis)\n  const verificationTimeoutMillis = normalizeSha1TimeoutMillis(\n    config.options.sha1VerificationTimeoutMillis,\n    DEFAULT_SHA1_VERIFICATION_TIMEOUT_MILLIS,\n  )\n\n  return async (path, signal) => {\n    const expectedBytes = assertValidB2ContentLength(path.selectedVersion.contentLength)\n    const maxBytes = normalizeSha1VerificationMaxBytes(\n      expectedBytes,\n      config.options.sha1VerificationMaxBytes,\n    )\n    return withSha1VerificationDeadline(\n      signal,\n      verificationTimeoutMillis,\n      async (deadlineSignal) => {\n        deadlineSignal.throwIfAborted()\n        if (maxBytes < expectedBytes) {\n          throw new Error(\n            `sha1 B2 verification skipped because contentLength ${expectedBytes} exceeds ${maxBytes} byte verification budget`,\n          )\n        }\n        const serverSideEncryption = toSseCDownloadKey(\n          config.options.encryptionProvider?.getSettingForDownload(path.selectedVersion),\n        )\n        const fileName = validateB2SyncPathInAnyPrefix(readablePrefixes, path, 'read')\n        const result = await bucket.file(fileName).downloadById(path.selectedVersion.fileId, {\n          ...(serverSideEncryption !== undefined ? { serverSideEncryption } : {}),\n          signal: deadlineSignal,\n        })\n        const verified = await hashReadableStreamSha1(result.body, deadlineSignal, {\n          idleTimeoutMillis,\n          maxBytes,\n          expectedBytes,\n        })\n        return { contentSha1: verified.contentSha1, bytesRead: verified.bytesRead }\n      },\n    )\n  }\n}\n\nfunction forwardAbortSignal(\n  source: AbortSignal | undefined,\n  controller: AbortController,\n): () => void {\n  if (source === undefined) return () => undefined\n  if (source.aborted) {\n    abortActionController(controller, source.reason)\n    return () => undefined\n  }\n\n  const abort = () => abortActionController(controller, source.reason)\n  source.addEventListener('abort', abort, { once: true })\n  return () => source.removeEventListener('abort', abort)\n}\n\nfunction abortActionController(controller: AbortController, reason: unknown): void {\n  if (!controller.signal.aborted) {\n    controller.abort(reason)\n  }\n}\n\n/**\n * Narrowing assertion that a `Bucket` is present for an action that requires\n * it. Throws with a consistent, context-tagged message when the configured\n * direction did not supply one (e.g. `b2-to-local` direction asking for an\n * upload action).\n *\n * Uses TypeScript's `asserts` signature so call-site flow narrows\n * `bucket` from `Bucket | undefined` to `Bucket` after the check, without\n * requiring a separate `if (!bucket) throw ...` line per action factory.\n *\n * @param bucket - The (possibly missing) bucket reference.\n * @param context - Short verb describing the action being constructed\n *   (e.g. `'upload'`, `'download'`). Surfaced in the error message.\n *\n * @throws `Error` when `bucket` is `undefined` or `null`.\n */\nfunction assertBucket(bucket: Bucket | undefined, context: string): asserts bucket is Bucket {\n  if (!bucket) throw new Error(`Bucket required for ${context} actions`)\n}\n\n/**\n * Returns the root for a local sync folder required by an action.\n *\n * @param folder - The configured folder to validate.\n * @param role - Whether the local folder is the source or destination.\n * @param context - Short verb describing the action being constructed.\n *\n * @returns The local filesystem root.\n *\n * @throws `Error` when the folder is not local or has no root.\n */\nfunction requireLocalRoot(\n  folder: SyncFolder | undefined,\n  role: 'source' | 'destination',\n  context: string,\n): string {\n  const root = folder?.type === 'local' ? (folder as Partial<LocalSyncFolder>).root : undefined\n  if (typeof root !== 'string' || root === '') {\n    throw new Error(`Local ${role} root required for ${context} actions`)\n  }\n  return root\n}\n\nasync function resolveLocalRootContexts(config: SynchronizerConfig): Promise<LocalRootContexts> {\n  const sourceIsLocalFilesystem = isLocalFilesystemFolder(config.source)\n  const destIsLocalFilesystem = isLocalFilesystemFolder(config.dest)\n  if (!sourceIsLocalFilesystem && !destIsLocalFilesystem) return {}\n\n  const sourceContext = config.dest.type === 'b2' ? 'upload' : 'sync'\n  const destContext = config.source.type === 'b2' ? 'download' : 'sync'\n  return {\n    ...(sourceIsLocalFilesystem\n      ? {\n          source: await resolveLocalRootContext(\n            requireLocalRoot(config.source, 'source', sourceContext),\n          ),\n        }\n      : {}),\n    ...(destIsLocalFilesystem\n      ? {\n          dest: await resolveLocalRootContext(\n            requireLocalRoot(config.dest, 'destination', destContext),\n          ),\n        }\n      : {}),\n  }\n}\n\nasync function resolveLocalRootContext(root: string): Promise<LocalRootContext> {\n  const { realpath, stat } = await import('node:fs/promises')\n  const { resolve } = await import('node:path')\n  const safeRoot = resolve(root)\n  const realPath = await realpath(safeRoot).catch((err: unknown) => {\n    if (isNotFoundError(err)) return safeRoot\n    throw err\n  })\n  const stats = await stat(realPath).catch((err: unknown) => {\n    if (isNotFoundError(err)) return undefined\n    throw err\n  })\n  if (stats !== undefined && !stats.isDirectory()) {\n    throw new Error('Local sync root is not a directory')\n  }\n  return {\n    root: safeRoot,\n    realPath,\n    ...(stats === undefined\n      ? {}\n      : { identity: { deviceId: stats.dev, inode: stats.ino } satisfies LocalRootIdentity }),\n  }\n}\n\nfunction isLocalFilesystemFolder(folder: SyncFolder | undefined): folder is LocalSyncFolder {\n  return folder?.type === 'local' && isLocalFilesystemRoot(folder)\n}\n/**\n * Narrows a setting to SSE-C; non-SSE-C source settings need no key on read.\n *\n * @param setting - Provider-supplied encryption setting, or undefined.\n *\n * @returns The SSE-C setting when one is provided; otherwise undefined.\n */\nfunction toSseCEncryptionSetting(\n  setting: EncryptionSetting | undefined,\n): Extract<EncryptionSetting, { readonly mode: 'SSE-C' }> | undefined {\n  if (setting?.mode !== 'SSE-C') return undefined\n  return setting\n}\n\n/**\n * Returns a download key from SSE-C settings; non-SSE-C downloads need no key.\n *\n * @param setting - Provider-supplied encryption setting, or undefined.\n *\n * @returns A download key for SSE-C files; otherwise undefined.\n */\nfunction toSseCDownloadKey(setting: EncryptionSetting | undefined): SseCDownloadKey | undefined {\n  return toSseCEncryptionSetting(setting)\n}\n\n/**\n * Creates a configured sync engine wired to the bucket and paths in the given config.\n *\n * For sync operations that may need to remove destination-only files (the\n * `keepMode: 'delete'` policy), the factory reads the destination\n * bucket's cached `fileLockConfiguration` once so `removeOrphan` can\n * dispatch to either `hide` (locked buckets) or `deleteFileVersion`\n * (vanilla buckets) without a per-file branch. The cache is whatever\n * `client.listBuckets()` or `client.createBucket()` returned — callers\n * who flipped lock state mid-sync (rare) should refresh before\n * synchronize().\n *\n * @param config - Synchronizer configuration containing source, destination, and options.\n * @param localRootContexts - Resolved filesystem roots captured before action creation.\n *\n * @returns An action factory bound to the provided configuration.\n */\nfunction createActionFactory(\n  config: SynchronizerConfig,\n  localRootContexts: LocalRootContexts,\n): ActionFactory {\n  const upConfig = config as Partial<SynchronizerUpConfig>\n  const downConfig = config as Partial<SynchronizerDownConfig>\n  const uploadPrefix = asRawB2KeyPrefix(upConfig.prefix ?? b2FolderRawPrefix(config.dest) ?? '')\n  const sourceB2Prefix = b2FolderRawPrefix(config.source)\n\n  const destBucket = upConfig.bucket ?? downConfig.bucket\n  // Defensive optional chain on `info`: synchronizer tests use Bucket\n  // mocks that don't populate this field. Real `Bucket` instances always\n  // do (constructor parameter).\n  const bucketIsLocked = destBucket?.info?.fileLockConfiguration?.value?.isFileLockEnabled ?? false\n\n  const factory: ActionFactory = {\n    upload(source: LocalSyncPath, dest?: B2SyncPath): SyncAction {\n      const bucket = upConfig.bucket\n      assertBucket(bucket, 'upload')\n\n      return new UploadAction(\n        source.relativePath,\n        source.absolutePath,\n        source.size,\n        async (absPath, relPath, signal) => {\n          const rootContext = localRootContexts.source\n          const root = rootContext?.root ?? (upConfig.source as Partial<LocalSyncFolder>).root ?? ''\n          const fileName =\n            dest !== undefined\n              ? validateB2SyncPathInPrefix(uploadPrefix, dest)\n              : `${uploadPrefix}${relPath}`\n          if (rootContext !== undefined) {\n            await assertLocalRootContextCurrent(rootContext, relPath, { allowSymlinkRoot: true })\n          }\n          const targetPath =\n            rootContext === undefined\n              ? await resolveContainedLocalPath(root, source.relativePath, absPath)\n              : await resolveContainedLocalPath(rootContext.realPath, source.relativePath)\n          throwIfAborted(signal)\n          // FileSource avoids whole-file buffering and rejects path swaps on a\n          // best-effort basis. On Windows, callers that need tamper-resistant\n          // same-size rewrite detection should use compareMode: 'sha1' or an\n          // independent digest because restored modification times can hide\n          // local rewrites.\n          const fileSource = await createValidatedUploadFileSource(source, targetPath)\n          throwIfAborted(signal)\n          const serverSideEncryption = config.options.encryptionProvider?.getSettingForUpload(\n            fileName,\n            fileSource.size,\n          )\n          await bucket.upload({\n            fileName,\n            source: fileSource,\n            ...(serverSideEncryption !== undefined ? { serverSideEncryption } : {}),\n            ...(signal !== undefined ? { signal } : {}),\n          })\n        },\n      )\n    },\n\n    download(source: B2SyncPath, scannedDest?: LocalSyncPath | null): SyncAction {\n      const bucket = downConfig.bucket\n      assertBucket(bucket, 'download')\n\n      return new DownloadAction(source.relativePath, source.size, async (relPath, signal) => {\n        const rootContext = localRootContexts.dest\n        const root = rootContext?.root ?? (downConfig.dest as Partial<LocalSyncFolder>).root ?? ''\n        safeRelativePathSegments(relPath)\n        const b2FileName =\n          sourceB2Prefix === undefined\n            ? source.selectedVersion.fileName\n            : validateB2SyncPathInPrefix(sourceB2Prefix, source, 'read')\n        const idleTimeoutMillis = normalizeDownloadIdleTimeoutMillis(\n          config.options.downloadIdleTimeoutMillis,\n        )\n        const expectedBytes = assertValidB2ContentLength(source.selectedVersion.contentLength)\n        if (rootContext !== undefined) {\n          await assertLocalRootContextCurrent(rootContext, relPath, { allowSymlinkRoot: false })\n        }\n        await ensureLocalSyncRootDirectory(root, relPath)\n        const serverSideEncryption = toSseCDownloadKey(\n          config.options.encryptionProvider?.getSettingForDownload(source.selectedVersion),\n        )\n        const result = await bucket.file(b2FileName).downloadById(source.selectedVersion.fileId, {\n          ...(serverSideEncryption !== undefined ? { serverSideEncryption } : {}),\n          ...(signal !== undefined ? { signal } : {}),\n        })\n        try {\n          await writeLocalStreamInsideRoot(root, relPath, result.body, {\n            expectedBytes,\n            ...(scannedDest !== undefined ? { expectedDestination: scannedDest } : {}),\n            idleTimeoutMillis,\n            ...(signal !== undefined ? { signal } : {}),\n          })\n        } catch (err) {\n          await cancelReadableStreamBody(result.body, err)\n          throw err\n        }\n      })\n    },\n\n    copy(source: B2SyncPath, destRelativePath: string): SyncAction {\n      return copyToB2Key(source, `${uploadPrefix}${destRelativePath}`)\n    },\n\n    copyB2Path(source: B2SyncPath, dest: B2SyncPath): SyncAction {\n      return copyToB2Key(source, validateB2SyncPathInPrefix(uploadPrefix, dest))\n    },\n\n    hide(path: string): SyncAction {\n      const bucket = upConfig.bucket ?? downConfig.bucket\n      assertBucket(bucket, 'hide')\n\n      return new HideAction(path, async (_relPath, signal) => {\n        await bucket.hideFile(\n          `${uploadPrefix}${path}`,\n          signal === undefined ? undefined : { signal },\n        )\n      })\n    },\n\n    hideB2Path(path: B2SyncPath): SyncAction {\n      const bucket = upConfig.bucket ?? downConfig.bucket\n      assertBucket(bucket, 'hide')\n      const b2FileName = validateB2SyncPathInPrefix(uploadPrefix, path)\n\n      return new HideAction(path.relativePath, async (_relPath, signal) => {\n        await bucket.hideFile(b2FileName, signal === undefined ? undefined : { signal })\n      })\n    },\n\n    deleteRemote(path: B2SyncPath): SyncAction {\n      const bucket = upConfig.bucket ?? downConfig.bucket\n      assertBucket(bucket, 'delete')\n\n      // Bug fix: `DeleteRemoteAction` invokes the closure with\n      // `relativePath` (the scanner-stripped name relative to the sync\n      // prefix), but B2 stores files under the FULL name including the\n      // prefix. Use the FileVersion's authoritative `fileName` — the\n      // actual B2 key — rather than reconstructing it via prefix\n      // concat. Without this, syncs with a non-empty destination\n      // prefix (e.g. `'site/'`) failed orphan deletion with\n      // `file_not_present`.\n      const b2FileName = validateB2SyncPathInPrefix(uploadPrefix, path)\n      return new DeleteRemoteAction(\n        path.relativePath,\n        path.selectedVersion.fileId as string,\n        async (fileId, _fileName, signal) => {\n          await bucket.deleteFileVersion(\n            b2FileName,\n            fileIdOf(fileId),\n            signal === undefined ? undefined : { signal },\n          )\n        },\n      )\n    },\n\n    deleteLocal(path: LocalSyncPath): SyncAction {\n      const rootContext = localRootContexts.dest\n      const root = rootContext?.root ?? localSyncRoot(downConfig.dest)\n      return new DeleteLocalAction(\n        path.relativePath,\n        path.absolutePath,\n        async (absPath, signal) => {\n          signal?.throwIfAborted()\n          if (absPath !== path.absolutePath) {\n            throw new Error(`Refusing to delete outside sync root: ${path.relativePath}`)\n          }\n          signal?.throwIfAborted()\n          try {\n            if (rootContext !== undefined) {\n              await assertLocalRootContextCurrent(rootContext, path.relativePath, {\n                allowSymlinkRoot: false,\n              })\n            }\n            await deleteLocalFileInsideRoot(root, path)\n          } catch (err) {\n            if (isLocalDeleteSafetyError(err)) throw err\n            throw new Error(`failed to delete local file: ${localFilesystemErrorReason(err)}`)\n          }\n        },\n      )\n    },\n\n    removeOrphan(dest: B2SyncPath): SyncAction {\n      // Locked buckets: `b2_delete_file_version` is blocked or stacks\n      // hide markers under retention; a hide is the safe choice.\n      // Vanilla buckets: plain delete is the right move — hide markers\n      // would just litter the version history.\n      return bucketIsLocked\n        ? (factory.hideB2Path?.(dest) ?? factory.hide(dest.relativePath))\n        : factory.deleteRemote(dest)\n    },\n  }\n\n  function copyToB2Key(source: B2SyncPath, targetPath: string): SyncAction {\n    const bucket = upConfig.bucket\n    assertBucket(bucket, 'copy')\n\n    return new CopyAction(source.relativePath, source.size, async (_relPath, signal) => {\n      if (sourceB2Prefix !== undefined) validateB2SyncPathInPrefix(sourceB2Prefix, source, 'read')\n      const destinationServerSideEncryption =\n        config.options.encryptionProvider?.getSettingForUpload(targetPath, source.size)\n      const sourceServerSideEncryption = toSseCEncryptionSetting(\n        config.options.encryptionProvider?.getSettingForDownload(source.selectedVersion),\n      )\n      await bucket.copyFile({\n        sourceFileId: source.selectedVersion.fileId,\n        fileName: targetPath,\n        ...(destinationServerSideEncryption !== undefined\n          ? { destinationServerSideEncryption }\n          : {}),\n        ...(sourceServerSideEncryption !== undefined ? { sourceServerSideEncryption } : {}),\n        ...(signal !== undefined ? { signal } : {}),\n      })\n    })\n  }\n\n  return factory\n}\n\nasync function createValidatedUploadFileSource(\n  source: LocalSyncPath,\n  absolutePath: string,\n): Promise<ContentSource> {\n  try {\n    const fileSource = await FileSource.fromPath(absolutePath)\n    await validateScannedLocalFile({ ...source, absolutePath })\n    return fileSource\n  } catch (err) {\n    throw normalizeLocalUploadSourceError(err)\n  }\n}\n\nfunction normalizeLocalUploadSourceError(err: unknown): Error {\n  if (err instanceof Error && err.message.startsWith('local file changed before upload')) {\n    return err\n  }\n  const message = err instanceof Error ? err.message : String(err)\n  if (message.includes('not a regular file')) {\n    return new Error('local file changed before upload: not a regular file')\n  }\n  if (message.includes('changed') || message.includes('modified')) {\n    return new Error('local file changed before upload')\n  }\n  return new Error(`local file changed before upload: ${sanitizeErrorReason(err)}`)\n}\n\nfunction localSyncRoot(folder: LocalSyncFolder | undefined): string {\n  return folder?.type === 'local' ? folder.root : ''\n}\n\nfunction b2FolderRawPrefix(folder: SyncFolder | undefined): string | undefined {\n  if (folder?.type !== 'b2') return undefined\n  const rawPrefix = (folder as B2SyncFolder).rawPrefix\n  return typeof rawPrefix === 'string' ? rawPrefix : undefined\n}\n\nfunction validateB2SourcePairPrefix(pair: SyncPair, config: SynchronizerConfig): void {\n  const [source] = pair\n  if (config.source.type !== 'b2' || source === null || !isB2SyncPath(source)) return\n  const sourcePrefix = b2FolderRawPrefix(config.source)\n  if (sourcePrefix === undefined) return\n  validateB2SyncPathInPrefix(sourcePrefix, source, 'read')\n}\n\nfunction b2ReadableRawPrefixes(config: SynchronizerConfig): readonly string[] {\n  const prefixes: string[] = []\n  const sourcePrefix = b2FolderRawPrefix(config.source)\n  if (config.source.type === 'b2') prefixes.push(sourcePrefix ?? '')\n\n  const upConfig = config as Partial<SynchronizerUpConfig>\n  if (config.dest.type === 'b2') {\n    prefixes.push(upConfig.prefix ?? b2FolderRawPrefix(config.dest) ?? '')\n  }\n\n  return [...new Set(prefixes.map((prefix) => asRawB2KeyPrefix(prefix)))]\n}\n\nfunction validateB2SyncPathInAnyPrefix(\n  prefixes: readonly string[],\n  path: B2SyncPath,\n  operation: string,\n): string {\n  let firstError = new Error(`Refusing to ${operation} B2 key: ${path.relativePath}`)\n  for (const prefix of prefixes) {\n    try {\n      return validateB2SyncPathInPrefix(prefix, path, operation)\n    } catch (err) {\n      if (err instanceof Error) firstError = err\n    }\n  }\n  throw firstError\n}\n\nfunction validateB2SyncPathInPrefix(\n  prefix: string,\n  path: B2SyncPath,\n  operation = 'mutate',\n): string {\n  const fileName = path.selectedVersion.fileName\n  if (!fileName.startsWith(prefix)) {\n    throw new Error(\n      `Refusing to ${operation} B2 key outside configured prefix: ${path.relativePath}`,\n    )\n  }\n\n  const relativePath = b2KeyToRelativePathUnderPrefix(prefix, fileName)\n  if (relativePath !== path.relativePath) {\n    throw new Error(\n      `Refusing to ${operation} mismatched B2 key for sync path: ${path.relativePath}`,\n    )\n  }\n\n  return fileName\n}\n\nfunction isB2SyncPath(path: SyncPath): path is B2SyncPath {\n  return 'selectedVersion' in path\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted === true) {\n    throw signal.reason ?? new DOMException('Aborted', 'AbortError')\n  }\n}\n\nasync function cancelReadableStreamBody(\n  body: ReadableStream<Uint8Array>,\n  reason: unknown,\n): Promise<void> {\n  if (body.locked) return\n  try {\n    await body.cancel(reason)\n  } catch {\n    // Best-effort response cleanup must not mask the setup or write failure.\n  }\n}\n\nasync function assertLocalRootContextCurrent(\n  context: LocalRootContext,\n  relativePath: string,\n  options: { readonly allowSymlinkRoot: boolean },\n): Promise<void> {\n  if (context.identity === undefined) return\n\n  const { lstat, realpath, stat } = await import('node:fs/promises')\n  let currentRealPath: string\n  try {\n    const rootLinkStats = await lstat(context.root)\n    if (!options.allowSymlinkRoot && rootLinkStats.isSymbolicLink()) {\n      throw new Error(`Refusing to access sync root through symlink: ${relativePath}`)\n    }\n    currentRealPath = await realpath(context.root)\n  } catch (err) {\n    if (err instanceof Error && err.message.startsWith('Refusing to access sync root')) throw err\n    throw new Error(`Local sync root changed before filesystem action: ${relativePath}`)\n  }\n\n  if (currentRealPath !== context.realPath) {\n    throw new Error(`Local sync root changed before filesystem action: ${relativePath}`)\n  }\n\n  let currentStats: Awaited<ReturnType<typeof stat>>\n  try {\n    currentStats = await stat(context.realPath)\n  } catch {\n    throw new Error(`Local sync root changed before filesystem action: ${relativePath}`)\n  }\n\n  if (\n    !currentStats.isDirectory() ||\n    currentStats.dev !== context.identity.deviceId ||\n    currentStats.ino !== context.identity.inode\n  ) {\n    throw new Error(`Local sync root changed before filesystem action: ${relativePath}`)\n  }\n}\n\nasync function ensureLocalSyncRootDirectory(root: string, relativePath: string): Promise<void> {\n  if (root === '') {\n    throw new Error('Local sync root required for filesystem mutation')\n  }\n\n  const { lstat, mkdir } = await import('node:fs/promises')\n  const { resolve } = await import('node:path')\n  const safeRoot = resolve(root)\n\n  try {\n    const stats = await lstat(safeRoot)\n    if (stats.isSymbolicLink()) {\n      throw new Error(`Refusing to access sync root through symlink: ${relativePath}`)\n    }\n    if (!stats.isDirectory()) {\n      throw new Error(`Local sync root is not a directory: ${relativePath}`)\n    }\n    return\n  } catch (error) {\n    if (!isNotFoundError(error)) throw error\n  }\n\n  await mkdir(safeRoot, { recursive: true })\n  await assertLocalRootHasNoSymlink(safeRoot, relativePath)\n}\n\nfunction bufferScanEvent(\n  buffer: ScanEventBuffer,\n  event: SyncEvent,\n  direction: SyncDirection,\n  scanSide: 'source' | 'dest',\n): void {\n  if (event.type === 'skip' && event.reason === 'filesystem-error') {\n    buffer.fatalFilesystemErrorMessage ??= event.message\n  }\n  if (sourceSkipMakesInventoryIncomplete(event, direction, scanSide)) {\n    buffer.sourceInventoryIncompleteMessage ??= sourceInventoryIncompleteMessage(direction)\n  }\n  if (buffer.events.length < MAX_BUFFERED_SCAN_EVENTS) {\n    buffer.events.push(event)\n  } else {\n    buffer.dropped++\n  }\n}\n\nfunction* drainScanEvents(buffer: ScanEventBuffer): Generator<SyncEvent> {\n  while (buffer.events.length > 0) {\n    const event = buffer.events.shift()\n    if (event) yield event\n  }\n\n  if (buffer.dropped > 0) {\n    yield {\n      type: 'skip',\n      path: '',\n      size: 0,\n      reason: 'scan-skip-overflow',\n      message: `${buffer.dropped} scanner skip event(s) were omitted after ${MAX_BUFFERED_SCAN_EVENTS} buffered diagnostics`,\n    }\n    buffer.dropped = 0\n  }\n}\n\nfunction scanHadFilesystemError(scanEvents: ScanEventBuffer): boolean {\n  return scanEvents.fatalFilesystemErrorMessage !== undefined\n}\n\nfunction sourceInventoryIncomplete(scanEvents: ScanEventBuffer): boolean {\n  return scanEvents.sourceInventoryIncompleteMessage !== undefined\n}\n\nfunction scanFilesystemError(scanEvents: ScanEventBuffer): Error | undefined {\n  return scanEvents.fatalFilesystemErrorMessage === undefined\n    ? undefined\n    : new Error(scanEvents.fatalFilesystemErrorMessage)\n}\n\nfunction sourceSkipMakesInventoryIncomplete(\n  event: SyncEvent,\n  direction: SyncDirection,\n  scanSide: 'source' | 'dest',\n): event is SyncSkipEvent {\n  if (scanSide !== 'source' || event.type !== 'skip') return false\n\n  if (direction === 'local-to-b2') {\n    return (\n      event.reason === 'unsafe-name' ||\n      event.reason === 'stale-download-partial' ||\n      event.reason === 'path-too-long-for-regexp'\n    )\n  }\n\n  if (direction === 'b2-to-local' || direction === 'b2-to-b2') {\n    return (\n      event.reason === 'unsafe-name' ||\n      event.reason === 'local-unsafe-name' ||\n      event.reason === 'relative-path-collision' ||\n      event.reason === 'local-path-collision' ||\n      event.reason === 'path-too-long-for-regexp'\n    )\n  }\n\n  return false\n}\n\nfunction sourceInventoryIncompleteMessage(direction: SyncDirection): string {\n  return direction === 'local-to-b2'\n    ? 'not removed because the source scan skipped local paths'\n    : 'not removed because the source scan skipped unsafe B2 names'\n}\n\nfunction isLocalDeleteSafetyError(err: unknown): boolean {\n  if (!(err instanceof Error)) return false\n  return (\n    err.message === 'Local sync root required for filesystem mutation' ||\n    err.message.startsWith('Local sync root changed before filesystem action: ') ||\n    err.message.startsWith('Refusing to ') ||\n    err.message.startsWith('Local sync root is not a directory: ') ||\n    err.message.startsWith('unsafe local delete path: ')\n  )\n}\n\nasync function resolveContainedLocalPath(\n  root: string,\n  relativePath: string,\n  absolutePath?: string,\n): Promise<string> {\n  if (root === '') {\n    throw new Error('Local sync root required for filesystem mutation')\n  }\n\n  const { isAbsolute, relative, resolve, sep } = await import('node:path')\n  const safeRoot = resolve(root)\n  const target =\n    absolutePath === undefined ? resolve(safeRoot, relativePath) : resolve(absolutePath)\n  const pathFromRoot = relative(safeRoot, target)\n  const escapesRoot =\n    pathFromRoot === '..' || pathFromRoot.startsWith(`..${sep}`) || isAbsolute(pathFromRoot)\n\n  /* v8 ignore next -- defense-in-depth after prior no-follow and symlink checks. */\n  if (escapesRoot) {\n    throw new Error(`Refusing to access path outside sync root: ${relativePath}`)\n  }\n\n  await assertLocalRootHasNoSymlink(safeRoot, relativePath)\n  await assertPathHasNoSymlinkComponents(safeRoot, pathFromRoot, relativePath)\n\n  return target\n}\n\nasync function assertLocalRootHasNoSymlink(safeRoot: string, relativePath: string): Promise<void> {\n  const { lstat } = await import('node:fs/promises')\n  try {\n    const stats = await lstat(safeRoot)\n    if (stats.isSymbolicLink()) {\n      throw new Error(`Refusing to access sync root through symlink: ${relativePath}`)\n    }\n  } catch (error) {\n    if (isNotFoundError(error)) return\n    throw error\n  }\n}\n\nasync function assertPathHasNoSymlinkComponents(\n  safeRoot: string,\n  pathFromRoot: string,\n  relativePath: string,\n): Promise<void> {\n  if (pathFromRoot === '') return\n\n  const { lstat } = await import('node:fs/promises')\n  const { join, sep } = await import('node:path')\n  let current = safeRoot\n\n  for (const segment of pathFromRoot.split(sep)) {\n    current = join(current, segment)\n    let stats: Awaited<ReturnType<typeof lstat>>\n    try {\n      stats = await lstat(current)\n    } catch (error) {\n      if (isNotFoundError(error)) return\n      throw error\n    }\n    if (stats.isSymbolicLink()) {\n      throw new Error(`Refusing to access path through symlink: ${relativePath}`)\n    }\n  }\n}\n\nfunction isNotFoundError(error: unknown): boolean {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    (error as { readonly code?: unknown }).code === 'ENOENT'\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0DA,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,uCAAuC;;;;;;AAc7C,IAAa,wBAET,CAAC;;;;;;;;;;AA2GL,SAAS,iBAAiB,QAAoB,MAAiC;CAC7E,IAAI,OAAO,SAAS,WAAW,KAAK,SAAS,MAAM,OAAO;CAC1D,IAAI,OAAO,SAAS,QAAQ,KAAK,SAAS,SAAS,OAAO;CAC1D,IAAI,OAAO,SAAS,QAAQ,KAAK,SAAS,MAAM,OAAO;CACvD,MAAM,IAAI,MAAM,+BAA+B,OAAO,KAAK,MAAM,KAAK,MAAM;AAC9E;AAwBA,gBAAuB,YAAY,QAAuD;CACxF,MAAM,EAAE,QAAQ,MAAM,YAAY;CAClC,2BAA2B,QAAQ,WAAW;CAC9C,MAAM,YAAY,iBAAiB,QAAQ,IAAI;CAC/C,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,cAAc,yBAAyB,QAAQ,WAAW;CAChE,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,YAAY,KAAK,IAAI;CAC3B,MAAM,oBAAoB,MAAM,yBAAyB,MAAM;CAC/D,MAAM,eAA4B,CAAC;CACnC,MAAM,cAAwB,CAAC;CAC/B,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,yBAAyB;CAC7B,IAAI,eAAe;CACnB,MAAM,iCAAiB,IAAI,IAAmB;CAC9C,MAAM,aAA8B;EAAE,QAAQ,CAAC;EAAG,SAAS;CAAE;CAC7D,MAAM,cAA+B;EACnC,GAAI,QAAQ,YAAY,KAAA,IAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACpE,GAAI,QAAQ,YAAY,KAAA,IAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACpE,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACjE,GAAI,QAAQ,mBAAmB,KAAA,IAAY,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;EACzF,GAAI,cAAc,gBAAgB,EAAE,uBAAuB,KAAK,IAAI,CAAC;EACrE,UAAU,UAAU;GAClB,eAAe;GACf,gBAAgB,KAAK;GACrB,WAAW,KAAK;EAClB;CACF;CAEA,MAAM,UAAU,oBAAoB,QAAQ,iBAAiB;CAC7D,MAAM,aAAa,SAAS,KAAA,IAAY,mBAAmB,MAAM;CACjE,MAAM,wBAAwB,IAAI,gBAAgB;CAClD,MAAM,uBAAuB,mBAAmB,QAAQ,QAAQ,qBAAqB;CACrF,IAAI,YAAY;CAEhB,gBAAgB,mBAA8C;EAC5D,MAAM,aAAa;EACnB,OAAO,iBAAiB;CAC1B;CAEA,IAAI;EACF,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,aAAa;EAC7B,SAAS,KAAK;GACZ,MAAM,aAAa;GACnB,IAAI,QAAQ,QAAQ,SAAS;IAC3B,OAAO,iBAAiB;IACxB;GACF;GACA,IAAI,CAAC,cAAc;IACjB,OAAO,iBAAiB;IACxB,MAAM;GACR;GAEA,OAAO,iBAAiB;GACxB,MAAM,oBAAoB;GAC1B,YAAY;GACZ;EACF;EAEA,OAAO,iBAAiB;EACxB,MAAM,kBAAkB,oBAAoB,UAAU;EACtD,IAAI,oBAAoB,KAAA,GAAW,MAAM;EAEzC,IAAI,QAAQ,QAAQ,SAAS;GAC3B,OAAO,iBAAiB;GACxB;EACF;EAEA,IAAI,cAAc;GAChB,IAAI,aAAa,GAAG,MAAM,oBAAoB;GAC9C,YAAY;GACZ;EACF;EAEA,IAAI,QAAQ,gBAAgB,QAAQ;GAClC,MAAM,mBAAmB;GACzB,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,kBACjD,IAAI,OAAO,cAAc,MAAM,MAAM,OAAO,QAAQ,gBAAgB,CAAC,GAAG;EAE5E,OACE,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,aAAa;GAC9D,MAAM,QAAQ,MACX,MAAM,OAAO,QAAQ,WAAW,CAAC,CACjC,KAAK,SAAS,iBAAiB,MAAM,iBAAiB,IAAI,CAAC,CAAC;GAC/D,sBAAsB,wBAAwB,MAAM,MAAM;GAC1D,IAAI,OAAO,kBAAkB,KAAK,GAAG;EACvC;EAGF,MAAM,aAAa;EACnB,OAAO,iBAAiB;EAExB,IAAI,aAAa,GACf,MAAM,oBAAoB;EAE5B,YAAY;CACd,UAAU;EACR,IAAI,CAAC,WACH,sBACE,uBACA,IAAI,aAAa,wBAAwB,YAAY,CACvD;EAEF,qBAAqB;EACrB,MAAM,aAAa;CACrB;CAEA,eAAe,eAAoC;EACjD,MAAM,QAAoB,CAAC;EAC3B,WAAW,MAAM,QAAQ,WAAW,QAAQ,MAAM,aAAa;GAC7D,aAAa,OAAO;IAClB,gBAAgB,YAAY,OAAO,WAAW,QAAQ;GACxD;GACA,WAAW,OAAO;IAChB,gBAAgB,YAAY,OAAO,WAAW,MAAM;GACtD;EACF,CAAC,GAAG;GACF,IAAI,QAAQ,QAAQ,SAAS,OAAO;GACpC,2BAA2B,MAAM,MAAM;GACvC,MAAM,KAAK,IAAI;EACjB;EACA,OAAO;CACT;CAEA,gBAAgB,cAAc,OAAgE;EAC5F,IAAI,MAAM,WAAW,GAAG,OAAO;EAK/B,MAAM,aAAa;EACnB,OAAO,iBAAiB;EAExB,MAAM,gBAAgB,MAAM,qBAAqB,KAAK;EACtD,IAAI,OAAO,kBAAkB,cAAc,KAAK,GAAG,OAAO;EAC1D,IAAI,cAAc,WAAW,QAAQ,QAAQ,SAAS;GACpD,OAAO,iBAAiB;GACxB,OAAO;EACT;EACA,OAAO;CACT;CAEA,gBAAgB,kBACd,OACoC;EACpC,KAAK,MAAM,QAAQ,OAAO;GACxB,OAAO,iBAAiB;GACxB,MAAM,KAAK;GACX,OAAO,iBAAiB;;GAExB,IAAI,QAAQ,QAAQ,SAAS;IAC3B,OAAO,iBAAiB;IACxB,OAAO;GACT;GACA,KAAK,MAAM,UAAU,KAAK,SAAS;IACjC,MAAM,eAAe,MAAM;IAC3B,OAAO,iBAAiB;GAC1B;EACF;EACA,OAAO;CACT;CAEA,eAAe,qBACb,OACuF;EACvF,IAAI,MAAM,WAAW,GAAG,OAAO;GAAE,OAAO,CAAC;GAAG,SAAS;EAAM;EAC3D,MAAM,gBAAgB,MAAM,uBAAuB,OAAO,QAAQ;GAChE;GACA,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACjE,GAAI,QAAQ,0BAA0B,KAAA,IAClC,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;GACL,eAAe;GACf,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;EACnD,CAAC;EAED,MAAM,QAA8B,CAAC;EACrC,KAAK,MAAM,EAAE,cAAc,cAAc,eAAe;GACtD,IAAI,SAAS,WAAW,QAAQ,QAAQ,SAAS,OAAO;IAAE;IAAO,SAAS;GAAK;GAC/E,MAAM,KAAK,iBAAiB,cAAc,QAAQ,CAAC;EACrD;EACA,OAAO;GAAE;GAAO,SAAS;EAAM;CACjC;CAEA,SAAS,iBACP,MACA,UACoB;EACpB,MAAM,QAAmB;GACvB,MAAM;GACN,OAAO,KAAK,MAAM,KAAK,GAAA,EAAK,gBAAgB;GAC5C,MAAM;GACN,aAAa,SAAS;GACtB,GAAI,SAAS,gBAAgB,IAAI,EAAE,eAAe,SAAS,cAAc,IAAI,CAAC;EAChF;EAEA,IAAI,0BAA0B;EAC9B,KAAK,MAAM,iBAAiB,SAAS,QAAQ;GAC3C,WAAW,aAAa;GACxB,IAAI,cAAc,SAAS,SAAS;IAClC;IACA,kBAAkB,cAAc,IAAI;GACtC;EACF;EACA,cAAc,SAAS,OAAO;EAC9B,KAAK,IAAI,QAAQ,yBAAyB,QAAQ,SAAS,OAAO,QAAQ,SACxE,kBAAkB,MAAM,IAAI;EAE9B,IAAI,SAAS,sBAAsB,OAAO;GAAE;GAAO,SAAS,CAAC;EAAE;EAC/D,KACG,gBAAgB,uBAAuB,UAAU,MAClD,SAAS,KAAK,OAAO,QACrB,SAAS,KAAK,OAAO,MAErB,OAAO;GACL;GACA,SAAS,CACP,IAAI,WAAW,SAAS,KAAK,EAAE,CAAC,cAAc,0CAA0C,CAC1F;EACF;EAEF,IACE,0BAA0B,UAAU,KACpC,SAAS,KAAK,OAAO,QACrB,SAAS,KAAK,OAAO,MAErB,OAAO;GACL;GACA,SAAS,CACP,IAAI,WACF,SAAS,KAAK,EAAE,CAAC,cACjB,WAAW,oCACT,6DACJ,CACF;EACF;EAgBF,OAAO;GAAE;GAAO,SAAA,CAZd,GAAG,gBACD,SAAS,MACT,WACA,QAAQ,aACR,QAAQ,UACR,UACA,WACA,SACA,gBACF,CAGc;EAAQ;CAC1B;CAEA,eAAe,eAAe,QAAmC;EAC/D,MAAM,OAAO,cAAc,MAAM,CAAC,CAAC,cAAc;GAC/C,eAAe,OAAO,IAAI;EAC5B,CAAC;EACD,eAAe,IAAI,IAAI;EACvB,IAAI,eAAe,QAAQ,aAAa,MAAM,QAAQ,KAAK,cAAc;CAC3E;CAEA,eAAe,cAAc,QAAmC;EAC9D,IAAI;GACF,IAAI,sBAAsB,OAAO,SAAS;GAE1C,WAAW,MADS,OAAO,QAAQ,QAAQ,sBAAsB,MAAM,CACvD;EAClB,SAAS,KAAK;GACZ,MAAM,QAAmB;IACvB,MAAM;IACN,MAAM,OAAO;IACb,MAAM;IACN,SAAS,oBAAoB,GAAG;GAClC;GACA,gBAAgB,KAAK;GACrB,WAAW,KAAK;EAClB;CACF;CAEA,SAAS,gBAAgB,OAAwB;EAC/C,cAAc;EACd,kBAAkB,MAAM,IAAI;CAC9B;CAEA,SAAS,kBAAkB,MAAoB;EAC7C,IAAI,SAAS,IAAI;EACjB,IAAI,cAAc,IAAI,IAAI,GAAG;EAC7B,cAAc,IAAI,IAAI;EACtB,IAAI,YAAY,SAAS,4BACvB,YAAY,KAAK,IAAI;OAErB;CAEJ;CAEA,SAAS,sBAAiC;EACxC,OAAO;GACL,MAAM;GACN,MAAM;GACN,MAAM;GACN,SAAS,GAAG,WAAW;GACvB,cAAc;GACd,aAAa,CAAC,GAAG,WAAW;GAC5B,GAAI,yBAAyB,IAAI,EAAE,uBAAuB,IAAI,CAAC;EACjE;CACF;CAEA,SAAS,WAAW,OAAwB;EAC1C,aAAa,KAAK,KAAK;CACzB;CAEA,gBAAgB,mBAA8C;EAC5D,OAAO,gBAAgB,UAAU;EACjC,KAAK,MAAM,SAAS,aAAa,OAAO,CAAC,GAAG,MAAM;CACpD;CAEA,eAAe,eAA8B;EAC3C,OAAO,eAAe,OAAO,GAC3B,MAAM,QAAQ,KAAK,cAAc;CAErC;AACF;;;;;;;;;;AAWA,SAAS,yBAAyB,OAAmC;CACnE,MAAM,YAAY,SAAA;CAClB,IAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAC9C,MAAM,IAAI,WAAW,6CAA6C;CAEpE,OAAO;AACT;AAEA,SAAS,mCAAmC,OAAmC;CAC7E,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,UAAU,OAAO,mBAAmB,OAAO;CAC/C,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GACrC,MAAM,IAAI,WAAW,wEAAwE;CAE/F,OAAO,KAAK,MAAM,KAAK;AACzB;AAEA,SAAS,2BAA2B,eAA+B;CACjE,IAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,GAC1D,MAAM,IAAI,MAAM,sDAAsD;CAExE,OAAO;AACT;AAEA,SAAS,mBAAmB,QAAsD;CAChF,MAAM,WAAW;CACjB,MAAM,aAAa;CACnB,MAAM,SAAS,SAAS,UAAU,WAAW;CAC7C,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,MAAM,mBAAmB,sBAAsB,MAAM;CACrD,MAAM,oBAAoB,2BAA2B,OAAO,QAAQ,qBAAqB;CACzF,MAAM,4BAA4B,2BAChC,OAAO,QAAQ,+BACf,wCACF;CAEA,OAAO,OAAO,MAAM,WAAW;EAC7B,MAAM,gBAAgB,2BAA2B,KAAK,gBAAgB,aAAa;EACnF,MAAM,WAAW,kCACf,eACA,OAAO,QAAQ,wBACjB;EACA,OAAO,6BACL,QACA,2BACA,OAAO,mBAAmB;GACxB,eAAe,eAAe;GAC9B,IAAI,WAAW,eACb,MAAM,IAAI,MACR,sDAAsD,cAAc,WAAW,SAAS,0BAC1F;GAEF,MAAM,uBAAuB,kBAC3B,OAAO,QAAQ,oBAAoB,sBAAsB,KAAK,eAAe,CAC/E;GACA,MAAM,WAAW,8BAA8B,kBAAkB,MAAM,MAAM;GAK7E,MAAM,WAAW,MAAM,wBAAuB,MAJzB,OAAO,KAAK,QAAQ,CAAC,CAAC,aAAa,KAAK,gBAAgB,QAAQ;IACnF,GAAI,yBAAyB,KAAA,IAAY,EAAE,qBAAqB,IAAI,CAAC;IACrE,QAAQ;GACV,CAAC,EAAA,CACoD,MAAM,gBAAgB;IACzE;IACA;IACA;GACF,CAAC;GACD,OAAO;IAAE,aAAa,SAAS;IAAa,WAAW,SAAS;GAAU;EAC5E,CACF;CACF;AACF;AAEA,SAAS,mBACP,QACA,YACY;CACZ,IAAI,WAAW,KAAA,GAAW,aAAa,KAAA;CACvC,IAAI,OAAO,SAAS;EAClB,sBAAsB,YAAY,OAAO,MAAM;EAC/C,aAAa,KAAA;CACf;CAEA,MAAM,cAAc,sBAAsB,YAAY,OAAO,MAAM;CACnE,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,aAAa,OAAO,oBAAoB,SAAS,KAAK;AACxD;AAEA,SAAS,sBAAsB,YAA6B,QAAuB;CACjF,IAAI,CAAC,WAAW,OAAO,SACrB,WAAW,MAAM,MAAM;AAE3B;;;;;;;;;;;;;;;;;AAkBA,SAAS,aAAa,QAA4B,SAA2C;CAC3F,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,uBAAuB,QAAQ,SAAS;AACvE;;;;;;;;;;;;AAaA,SAAS,iBACP,QACA,MACA,SACQ;CACR,MAAM,OAAO,QAAQ,SAAS,UAAW,OAAoC,OAAO,KAAA;CACpF,IAAI,OAAO,SAAS,YAAY,SAAS,IACvC,MAAM,IAAI,MAAM,SAAS,KAAK,qBAAqB,QAAQ,SAAS;CAEtE,OAAO;AACT;AAEA,eAAe,yBAAyB,QAAwD;CAC9F,MAAM,0BAA0B,wBAAwB,OAAO,MAAM;CACrE,MAAM,wBAAwB,wBAAwB,OAAO,IAAI;CACjE,IAAI,CAAC,2BAA2B,CAAC,uBAAuB,OAAO,CAAC;CAEhE,MAAM,gBAAgB,OAAO,KAAK,SAAS,OAAO,WAAW;CAC7D,MAAM,cAAc,OAAO,OAAO,SAAS,OAAO,aAAa;CAC/D,OAAO;EACL,GAAI,0BACA,EACE,QAAQ,MAAM,wBACZ,iBAAiB,OAAO,QAAQ,UAAU,aAAa,CACzD,EACF,IACA,CAAC;EACL,GAAI,wBACA,EACE,MAAM,MAAM,wBACV,iBAAiB,OAAO,MAAM,eAAe,WAAW,CAC1D,EACF,IACA,CAAC;CACP;AACF;AAEA,eAAe,wBAAwB,MAAyC;CAC9E,MAAM,EAAE,UAAU,SAAS,MAAM,OAAO;CACxC,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,WAAW,MAAM,SAAS,QAAQ,CAAC,CAAC,OAAO,QAAiB;EAChE,IAAI,gBAAgB,GAAG,GAAG,OAAO;EACjC,MAAM;CACR,CAAC;CACD,MAAM,QAAQ,MAAM,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAiB;EACzD,IAAI,gBAAgB,GAAG,GAAG,OAAO,KAAA;EACjC,MAAM;CACR,CAAC;CACD,IAAI,UAAU,KAAA,KAAa,CAAC,MAAM,YAAY,GAC5C,MAAM,IAAI,MAAM,oCAAoC;CAEtD,OAAO;EACL,MAAM;EACN;EACA,GAAI,UAAU,KAAA,IACV,CAAC,IACD,EAAE,UAAU;GAAE,UAAU,MAAM;GAAK,OAAO,MAAM;EAAI,EAA8B;CACxF;AACF;AAEA,SAAS,wBAAwB,QAA2D;CAC1F,OAAO,QAAQ,SAAS,WAAW,sBAAsB,MAAM;AACjE;;;;;;;;AAQA,SAAS,wBACP,SACoE;CACpE,IAAI,SAAS,SAAS,SAAS,OAAO,KAAA;CACtC,OAAO;AACT;;;;;;;;AASA,SAAS,kBAAkB,SAAqE;CAC9F,OAAO,wBAAwB,OAAO;AACxC;;;;;;;;;;;;;;;;;;AAmBA,SAAS,oBACP,QACA,mBACe;CACf,MAAM,WAAW;CACjB,MAAM,aAAa;CACnB,MAAM,eAAe,iBAAiB,SAAS,UAAU,kBAAkB,OAAO,IAAI,KAAK,EAAE;CAC7F,MAAM,iBAAiB,kBAAkB,OAAO,MAAM;CAMtD,MAAM,kBAJa,SAAS,UAAU,WAAW,OAAA,EAId,MAAM,uBAAuB,OAAO,qBAAqB;CAE5F,MAAM,UAAyB;EAC7B,OAAO,QAAuB,MAA+B;GAC3D,MAAM,SAAS,SAAS;GACxB,aAAa,QAAQ,QAAQ;GAE7B,OAAO,IAAI,aACT,OAAO,cACP,OAAO,cACP,OAAO,MACP,OAAO,SAAS,SAAS,WAAW;IAClC,MAAM,cAAc,kBAAkB;IACtC,MAAM,OAAO,aAAa,QAAS,SAAS,OAAoC,QAAQ;IACxF,MAAM,WACJ,SAAS,KAAA,IACL,2BAA2B,cAAc,IAAI,IAC7C,GAAG,eAAe;IACxB,IAAI,gBAAgB,KAAA,GAClB,MAAM,8BAA8B,aAAa,SAAS,EAAE,kBAAkB,KAAK,CAAC;IAEtF,MAAM,aACJ,gBAAgB,KAAA,IACZ,MAAM,0BAA0B,MAAM,OAAO,cAAc,OAAO,IAClE,MAAM,0BAA0B,YAAY,UAAU,OAAO,YAAY;IAC/E,eAAe,MAAM;IAMrB,MAAM,aAAa,MAAM,gCAAgC,QAAQ,UAAU;IAC3E,eAAe,MAAM;IACrB,MAAM,uBAAuB,OAAO,QAAQ,oBAAoB,oBAC9D,UACA,WAAW,IACb;IACA,MAAM,OAAO,OAAO;KAClB;KACA,QAAQ;KACR,GAAI,yBAAyB,KAAA,IAAY,EAAE,qBAAqB,IAAI,CAAC;KACrE,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;GACH,CACF;EACF;EAEA,SAAS,QAAoB,aAAgD;GAC3E,MAAM,SAAS,WAAW;GAC1B,aAAa,QAAQ,UAAU;GAE/B,OAAO,IAAI,eAAe,OAAO,cAAc,OAAO,MAAM,OAAO,SAAS,WAAW;IACrF,MAAM,cAAc,kBAAkB;IACtC,MAAM,OAAO,aAAa,QAAS,WAAW,KAAkC,QAAQ;IACxF,yBAAyB,OAAO;IAChC,MAAM,aACJ,mBAAmB,KAAA,IACf,OAAO,gBAAgB,WACvB,2BAA2B,gBAAgB,QAAQ,MAAM;IAC/D,MAAM,oBAAoB,mCACxB,OAAO,QAAQ,yBACjB;IACA,MAAM,gBAAgB,2BAA2B,OAAO,gBAAgB,aAAa;IACrF,IAAI,gBAAgB,KAAA,GAClB,MAAM,8BAA8B,aAAa,SAAS,EAAE,kBAAkB,MAAM,CAAC;IAEvF,MAAM,6BAA6B,MAAM,OAAO;IAChD,MAAM,uBAAuB,kBAC3B,OAAO,QAAQ,oBAAoB,sBAAsB,OAAO,eAAe,CACjF;IACA,MAAM,SAAS,MAAM,OAAO,KAAK,UAAU,CAAC,CAAC,aAAa,OAAO,gBAAgB,QAAQ;KACvF,GAAI,yBAAyB,KAAA,IAAY,EAAE,qBAAqB,IAAI,CAAC;KACrE,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,IAAI;KACF,MAAM,2BAA2B,MAAM,SAAS,OAAO,MAAM;MAC3D;MACA,GAAI,gBAAgB,KAAA,IAAY,EAAE,qBAAqB,YAAY,IAAI,CAAC;MACxE;MACA,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;KAC3C,CAAC;IACH,SAAS,KAAK;KACZ,MAAM,yBAAyB,OAAO,MAAM,GAAG;KAC/C,MAAM;IACR;GACF,CAAC;EACH;EAEA,KAAK,QAAoB,kBAAsC;GAC7D,OAAO,YAAY,QAAQ,GAAG,eAAe,kBAAkB;EACjE;EAEA,WAAW,QAAoB,MAA8B;GAC3D,OAAO,YAAY,QAAQ,2BAA2B,cAAc,IAAI,CAAC;EAC3E;EAEA,KAAK,MAA0B;GAC7B,MAAM,SAAS,SAAS,UAAU,WAAW;GAC7C,aAAa,QAAQ,MAAM;GAE3B,OAAO,IAAI,WAAW,MAAM,OAAO,UAAU,WAAW;IACtD,MAAM,OAAO,SACX,GAAG,eAAe,QAClB,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAC9C;GACF,CAAC;EACH;EAEA,WAAW,MAA8B;GACvC,MAAM,SAAS,SAAS,UAAU,WAAW;GAC7C,aAAa,QAAQ,MAAM;GAC3B,MAAM,aAAa,2BAA2B,cAAc,IAAI;GAEhE,OAAO,IAAI,WAAW,KAAK,cAAc,OAAO,UAAU,WAAW;IACnE,MAAM,OAAO,SAAS,YAAY,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAAC;GACjF,CAAC;EACH;EAEA,aAAa,MAA8B;GACzC,MAAM,SAAS,SAAS,UAAU,WAAW;GAC7C,aAAa,QAAQ,QAAQ;GAU7B,MAAM,aAAa,2BAA2B,cAAc,IAAI;GAChE,OAAO,IAAI,mBACT,KAAK,cACL,KAAK,gBAAgB,QACrB,OAAO,UAAQ,WAAW,WAAW;IACnC,MAAM,OAAO,kBACX,YACA,OAAS,QAAM,GACf,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAC9C;GACF,CACF;EACF;EAEA,YAAY,MAAiC;GAC3C,MAAM,cAAc,kBAAkB;GACtC,MAAM,OAAO,aAAa,QAAQ,cAAc,WAAW,IAAI;GAC/D,OAAO,IAAI,kBACT,KAAK,cACL,KAAK,cACL,OAAO,SAAS,WAAW;IACzB,QAAQ,eAAe;IACvB,IAAI,YAAY,KAAK,cACnB,MAAM,IAAI,MAAM,yCAAyC,KAAK,cAAc;IAE9E,QAAQ,eAAe;IACvB,IAAI;KACF,IAAI,gBAAgB,KAAA,GAClB,MAAM,8BAA8B,aAAa,KAAK,cAAc,EAClE,kBAAkB,MACpB,CAAC;KAEH,MAAM,0BAA0B,MAAM,IAAI;IAC5C,SAAS,KAAK;KACZ,IAAI,yBAAyB,GAAG,GAAG,MAAM;KACzC,MAAM,IAAI,MAAM,gCAAgC,2BAA2B,GAAG,GAAG;IACnF;GACF,CACF;EACF;EAEA,aAAa,MAA8B;GAKzC,OAAO,iBACF,QAAQ,aAAa,IAAI,KAAK,QAAQ,KAAK,KAAK,YAAY,IAC7D,QAAQ,aAAa,IAAI;EAC/B;CACF;CAEA,SAAS,YAAY,QAAoB,YAAgC;EACvE,MAAM,SAAS,SAAS;EACxB,aAAa,QAAQ,MAAM;EAE3B,OAAO,IAAI,WAAW,OAAO,cAAc,OAAO,MAAM,OAAO,UAAU,WAAW;GAClF,IAAI,mBAAmB,KAAA,GAAW,2BAA2B,gBAAgB,QAAQ,MAAM;GAC3F,MAAM,kCACJ,OAAO,QAAQ,oBAAoB,oBAAoB,YAAY,OAAO,IAAI;GAChF,MAAM,6BAA6B,wBACjC,OAAO,QAAQ,oBAAoB,sBAAsB,OAAO,eAAe,CACjF;GACA,MAAM,OAAO,SAAS;IACpB,cAAc,OAAO,gBAAgB;IACrC,UAAU;IACV,GAAI,oCAAoC,KAAA,IACpC,EAAE,gCAAgC,IAClC,CAAC;IACL,GAAI,+BAA+B,KAAA,IAAY,EAAE,2BAA2B,IAAI,CAAC;IACjF,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;GAC3C,CAAC;EACH,CAAC;CACH;CAEA,OAAO;AACT;AAEA,eAAe,gCACb,QACA,cACwB;CACxB,IAAI;EACF,MAAM,aAAa,MAAM,WAAW,SAAS,YAAY;EACzD,MAAM,yBAAyB;GAAE,GAAG;GAAQ;EAAa,CAAC;EAC1D,OAAO;CACT,SAAS,KAAK;EACZ,MAAM,gCAAgC,GAAG;CAC3C;AACF;AAEA,SAAS,gCAAgC,KAAqB;CAC5D,IAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,kCAAkC,GACnF,OAAO;CAET,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC/D,IAAI,QAAQ,SAAS,oBAAoB,GACvC,uBAAO,IAAI,MAAM,sDAAsD;CAEzE,IAAI,QAAQ,SAAS,SAAS,KAAK,QAAQ,SAAS,UAAU,GAC5D,uBAAO,IAAI,MAAM,kCAAkC;CAErD,uBAAO,IAAI,MAAM,qCAAqC,oBAAoB,GAAG,GAAG;AAClF;AAEA,SAAS,cAAc,QAA6C;CAClE,OAAO,QAAQ,SAAS,UAAU,OAAO,OAAO;AAClD;AAEA,SAAS,kBAAkB,QAAoD;CAC7E,IAAI,QAAQ,SAAS,MAAM,OAAO,KAAA;CAClC,MAAM,YAAa,OAAwB;CAC3C,OAAO,OAAO,cAAc,WAAW,YAAY,KAAA;AACrD;AAEA,SAAS,2BAA2B,MAAgB,QAAkC;CACpF,MAAM,CAAC,UAAU;CACjB,IAAI,OAAO,OAAO,SAAS,QAAQ,WAAW,QAAQ,CAAC,aAAa,MAAM,GAAG;CAC7E,MAAM,eAAe,kBAAkB,OAAO,MAAM;CACpD,IAAI,iBAAiB,KAAA,GAAW;CAChC,2BAA2B,cAAc,QAAQ,MAAM;AACzD;AAEA,SAAS,sBAAsB,QAA+C;CAC5E,MAAM,WAAqB,CAAC;CAC5B,MAAM,eAAe,kBAAkB,OAAO,MAAM;CACpD,IAAI,OAAO,OAAO,SAAS,MAAM,SAAS,KAAK,gBAAgB,EAAE;CAEjE,MAAM,WAAW;CACjB,IAAI,OAAO,KAAK,SAAS,MACvB,SAAS,KAAK,SAAS,UAAU,kBAAkB,OAAO,IAAI,KAAK,EAAE;CAGvE,OAAO,CAAC,GAAG,IAAI,IAAI,SAAS,KAAK,WAAW,iBAAiB,MAAM,CAAC,CAAC,CAAC;AACxE;AAEA,SAAS,8BACP,UACA,MACA,WACQ;CACR,IAAI,6BAAa,IAAI,MAAM,eAAe,UAAU,WAAW,KAAK,cAAc;CAClF,KAAK,MAAM,UAAU,UACnB,IAAI;EACF,OAAO,2BAA2B,QAAQ,MAAM,SAAS;CAC3D,SAAS,KAAK;EACZ,IAAI,eAAe,OAAO,aAAa;CACzC;CAEF,MAAM;AACR;AAEA,SAAS,2BACP,QACA,MACA,YAAY,UACJ;CACR,MAAM,WAAW,KAAK,gBAAgB;CACtC,IAAI,CAAC,SAAS,WAAW,MAAM,GAC7B,MAAM,IAAI,MACR,eAAe,UAAU,qCAAqC,KAAK,cACrE;CAIF,IADqB,+BAA+B,QAAQ,QACxD,MAAiB,KAAK,cACxB,MAAM,IAAI,MACR,eAAe,UAAU,oCAAoC,KAAK,cACpE;CAGF,OAAO;AACT;AAEA,SAAS,aAAa,MAAoC;CACxD,OAAO,qBAAqB;AAC9B;AAEA,SAAS,eAAe,QAAuC;CAC7D,IAAI,QAAQ,YAAY,MACtB,MAAM,OAAO,UAAU,IAAI,aAAa,WAAW,YAAY;AAEnE;AAEA,eAAe,yBACb,MACA,QACe;CACf,IAAI,KAAK,QAAQ;CACjB,IAAI;EACF,MAAM,KAAK,OAAO,MAAM;CAC1B,QAAQ,CAER;AACF;AAEA,eAAe,8BACb,SACA,cACA,SACe;CACf,IAAI,QAAQ,aAAa,KAAA,GAAW;CAEpC,MAAM,EAAE,OAAO,UAAU,SAAS,MAAM,OAAO;CAC/C,IAAI;CACJ,IAAI;EACF,MAAM,gBAAgB,MAAM,MAAM,QAAQ,IAAI;EAC9C,IAAI,CAAC,QAAQ,oBAAoB,cAAc,eAAe,GAC5D,MAAM,IAAI,MAAM,iDAAiD,cAAc;EAEjF,kBAAkB,MAAM,SAAS,QAAQ,IAAI;CAC/C,SAAS,KAAK;EACZ,IAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,8BAA8B,GAAG,MAAM;EAC1F,MAAM,IAAI,MAAM,qDAAqD,cAAc;CACrF;CAEA,IAAI,oBAAoB,QAAQ,UAC9B,MAAM,IAAI,MAAM,qDAAqD,cAAc;CAGrF,IAAI;CACJ,IAAI;EACF,eAAe,MAAM,KAAK,QAAQ,QAAQ;CAC5C,QAAQ;EACN,MAAM,IAAI,MAAM,qDAAqD,cAAc;CACrF;CAEA,IACE,CAAC,aAAa,YAAY,KAC1B,aAAa,QAAQ,QAAQ,SAAS,YACtC,aAAa,QAAQ,QAAQ,SAAS,OAEtC,MAAM,IAAI,MAAM,qDAAqD,cAAc;AAEvF;AAEA,eAAe,6BAA6B,MAAc,cAAqC;CAC7F,IAAI,SAAS,IACX,MAAM,IAAI,MAAM,kDAAkD;CAGpE,MAAM,EAAE,OAAO,UAAU,MAAM,OAAO;CACtC,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,MAAM,WAAW,QAAQ,IAAI;CAE7B,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,QAAQ;EAClC,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,iDAAiD,cAAc;EAEjF,IAAI,CAAC,MAAM,YAAY,GACrB,MAAM,IAAI,MAAM,uCAAuC,cAAc;EAEvE;CACF,SAAS,OAAO;EACd,IAAI,CAAC,gBAAgB,KAAK,GAAG,MAAM;CACrC;CAEA,MAAM,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;CACzC,MAAM,4BAA4B,UAAU,YAAY;AAC1D;AAEA,SAAS,gBACP,QACA,OACA,WACA,UACM;CACN,IAAI,MAAM,SAAS,UAAU,MAAM,WAAW,oBAC5C,OAAO,gCAAgC,MAAM;CAE/C,IAAI,mCAAmC,OAAO,WAAW,QAAQ,GAC/D,OAAO,qCAAqC,iCAAiC,SAAS;CAExF,IAAI,OAAO,OAAO,SAAS,0BACzB,OAAO,OAAO,KAAK,KAAK;MAExB,OAAO;AAEX;AAEA,UAAU,gBAAgB,QAA+C;CACvE,OAAO,OAAO,OAAO,SAAS,GAAG;EAC/B,MAAM,QAAQ,OAAO,OAAO,MAAM;EAClC,IAAI,OAAO,MAAM;CACnB;CAEA,IAAI,OAAO,UAAU,GAAG;EACtB,MAAM;GACJ,MAAM;GACN,MAAM;GACN,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,OAAO,QAAQ,4CAA4C,yBAAyB;EAClG;EACA,OAAO,UAAU;CACnB;AACF;AAEA,SAAS,uBAAuB,YAAsC;CACpE,OAAO,WAAW,gCAAgC,KAAA;AACpD;AAEA,SAAS,0BAA0B,YAAsC;CACvE,OAAO,WAAW,qCAAqC,KAAA;AACzD;AAEA,SAAS,oBAAoB,YAAgD;CAC3E,OAAO,WAAW,gCAAgC,KAAA,IAC9C,KAAA,IACA,IAAI,MAAM,WAAW,2BAA2B;AACtD;AAEA,SAAS,mCACP,OACA,WACA,UACwB;CACxB,IAAI,aAAa,YAAY,MAAM,SAAS,QAAQ,OAAO;CAE3D,IAAI,cAAc,eAChB,OACE,MAAM,WAAW,iBACjB,MAAM,WAAW,4BACjB,MAAM,WAAW;CAIrB,IAAI,cAAc,iBAAiB,cAAc,YAC/C,OACE,MAAM,WAAW,iBACjB,MAAM,WAAW,uBACjB,MAAM,WAAW,6BACjB,MAAM,WAAW,0BACjB,MAAM,WAAW;CAIrB,OAAO;AACT;AAEA,SAAS,iCAAiC,WAAkC;CAC1E,OAAO,cAAc,gBACjB,4DACA;AACN;AAEA,SAAS,yBAAyB,KAAuB;CACvD,IAAI,EAAE,eAAe,QAAQ,OAAO;CACpC,OACE,IAAI,YAAY,sDAChB,IAAI,QAAQ,WAAW,oDAAoD,KAC3E,IAAI,QAAQ,WAAW,cAAc,KACrC,IAAI,QAAQ,WAAW,sCAAsC,KAC7D,IAAI,QAAQ,WAAW,4BAA4B;AAEvD;AAEA,eAAe,0BACb,MACA,cACA,cACiB;CACjB,IAAI,SAAS,IACX,MAAM,IAAI,MAAM,kDAAkD;CAGpE,MAAM,EAAE,YAAY,UAAU,SAAS,QAAQ,MAAM,OAAO;CAC5D,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,SACJ,iBAAiB,KAAA,IAAY,QAAQ,UAAU,YAAY,IAAI,QAAQ,YAAY;CACrF,MAAM,eAAe,SAAS,UAAU,MAAM;;CAK9C,IAHE,iBAAiB,QAAQ,aAAa,WAAW,KAAK,KAAK,KAAK,WAAW,YAAY,GAIvF,MAAM,IAAI,MAAM,8CAA8C,cAAc;CAG9E,MAAM,4BAA4B,UAAU,YAAY;CACxD,MAAM,iCAAiC,UAAU,cAAc,YAAY;CAE3E,OAAO;AACT;AAEA,eAAe,4BAA4B,UAAkB,cAAqC;CAChG,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,IAAI;EAEF,KAAI,MADgB,MAAM,QAAQ,EAAA,CACxB,eAAe,GACvB,MAAM,IAAI,MAAM,iDAAiD,cAAc;CAEnF,SAAS,OAAO;EACd,IAAI,gBAAgB,KAAK,GAAG;EAC5B,MAAM;CACR;AACF;AAEA,eAAe,iCACb,UACA,cACA,cACe;CACf,IAAI,iBAAiB,IAAI;CAEzB,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,MAAM,EAAE,MAAM,QAAQ,MAAM,OAAO;CACnC,IAAI,UAAU;CAEd,KAAK,MAAM,WAAW,aAAa,MAAM,GAAG,GAAG;EAC7C,UAAU,KAAK,SAAS,OAAO;EAC/B,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,MAAM,OAAO;EAC7B,SAAS,OAAO;GACd,IAAI,gBAAgB,KAAK,GAAG;GAC5B,MAAM;EACR;EACA,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,4CAA4C,cAAc;CAE9E;AACF;AAEA,SAAS,gBAAgB,OAAyB;CAChD,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAAsC,SAAS;AAEpD"}
+{"version":3,"file":"synchronizer.js","names":[],"sources":["../../src/sync/synchronizer.ts"],"sourcesContent":["import type { Bucket } from '../bucket.ts'\nimport type { SseCDownloadKey } from '../raw/index.ts'\nimport { type ContentSource, FileSource } from '../streams/source.ts'\nimport type { EncryptionSetting } from '../types/encryption.ts'\nimport { fileId as fileIdOf } from '../types/ids.ts'\nimport { DEFAULT_TRANSFER_CONCURRENCY } from '../util/defaults.ts'\nimport { sanitizeErrorReason } from '../util/error-reason.ts'\nimport type { SyncAction } from './actions/index.ts'\nimport {\n  CopyAction,\n  DeleteLocalAction,\n  DeleteRemoteAction,\n  DownloadAction,\n  HideAction,\n  SkipAction,\n  UploadAction,\n} from './actions/index.ts'\nimport {\n  hashReadableStreamSha1,\n  normalizeSha1VerificationMaxBytes,\n  withSha1VerificationDeadline,\n} from './b2-sha1-reader.ts'\nimport { localFilesystemErrorReason } from './filesystem-errors.ts'\nimport {\n  deleteLocalFileInsideRoot,\n  validateScannedLocalFile,\n  writeLocalStreamInsideRoot,\n} from './local-file-io.ts'\nimport { isLocalFilesystemRoot } from './local-filesystem-root.ts'\nimport { readLocalSha1File } from './local-sha1.ts'\nimport { type SyncPair, zipFolders } from './pairing.ts'\nimport { safeRelativePathSegments } from './path-safety.ts'\nimport {\n  assertSupportedCompareMode,\n  type B2Sha1Reader,\n  type ComparePreparationResult,\n  preparePairsForCompare,\n  readyComparePair,\n} from './policies/compare.ts'\nimport type { ActionFactory } from './policies/index.ts'\nimport { generateActions } from './policies/index.ts'\nimport { asRawB2KeyPrefix, b2KeyToRelativePathUnderPrefix } from './prefix.ts'\nimport {\n  DEFAULT_SHA1_VERIFICATION_TIMEOUT_MILLIS,\n  normalizeSha1TimeoutMillis,\n} from './sha1-options.ts'\nimport type {\n  B2SyncPath,\n  LocalSyncPath,\n  SyncDirection,\n  SyncEvent,\n  SyncFolder,\n  SyncOptions,\n  SyncPath,\n  SyncScanOptions,\n  SyncSkipEvent,\n} from './types.ts'\n\nconst MAX_BUFFERED_SCAN_EVENTS = 100\nconst MAX_AGGREGATE_FAILED_PATHS = 100\nconst DEFAULT_DOWNLOAD_IDLE_TIMEOUT_MILLIS = 60_000\n\ninterface ScanEventBuffer {\n  readonly events: SyncEvent[]\n  fatalFilesystemErrorMessage?: string\n  sourceInventoryIncompleteMessage?: string\n  dropped: number\n}\n\n/**\n * Test hooks for bounded planning behavior.\n *\n * @internal\n */\nexport const synchronizerTestHooks: {\n  afterNonSha1PlanBatch?: (batchSize: number) => void\n} = {}\n\n/** Base configuration for a sync operation. */\nexport interface SynchronizerConfig {\n  /** The folder to read files from. */\n  readonly source: SyncFolder\n  /** The folder to write files to. */\n  readonly dest: SyncFolder\n  /** Options controlling comparison, deletion policy, and concurrency. */\n  readonly options: SyncOptions\n}\n\n/** A sync folder constrained to the local filesystem. */\nexport interface LocalSyncFolder extends SyncFolder {\n  /** Discriminant identifying a local folder. */\n  readonly type: 'local'\n  /** Absolute filesystem path to the local root directory. */\n  readonly root: string\n}\n\n/** A sync folder constrained to a B2 bucket prefix. */\nexport interface B2SyncFolder extends SyncFolder {\n  /** Discriminant identifying a B2 folder. */\n  readonly type: 'b2'\n  /** Raw B2 key prefix represented by this folder when known. */\n  readonly rawPrefix?: string\n}\n\n/** Configuration for a local-to-B2 sync (upload direction). */\nexport interface SynchronizerUpConfig extends SynchronizerConfig {\n  /** Local source folder. */\n  readonly source: LocalSyncFolder\n  /** B2 destination folder. */\n  readonly dest: B2SyncFolder\n  /** The target B2 bucket. */\n  readonly bucket: Bucket\n  /**\n   * Raw B2 key prefix for uploaded files in the bucket.\n   * Backslashes are preserved as raw B2 key characters.\n   */\n  readonly prefix: string\n}\n\n/** Configuration for a B2-to-local sync (download direction). */\nexport interface SynchronizerDownConfig extends SynchronizerConfig {\n  /** B2 source folder. */\n  readonly source: B2SyncFolder\n  /** Local destination folder. */\n  readonly dest: LocalSyncFolder\n  /** The source B2 bucket. */\n  readonly bucket: Bucket\n}\n\n/** Configuration for a B2-to-B2 sync (copy direction). */\nexport interface SynchronizerB2Config extends SynchronizerConfig {\n  /** B2 source folder. */\n  readonly source: B2SyncFolder\n  /** B2 destination folder. */\n  readonly dest: B2SyncFolder\n  /** The B2 bucket used for copy, hide, and delete operations. */\n  readonly bucket: Bucket\n  /**\n   * Key prefix for destination-side copy, hide, and delete mutations.\n   *\n   * When omitted, the synchronizer uses `dest.rawPrefix` when the destination\n   * folder exposes one. Set this explicitly for custom B2 folders that do not\n   * expose their raw prefix.\n   */\n  readonly prefix?: string\n}\n\n/** Concrete sync configurations supported by {@link synchronize}. */\nexport type SupportedSynchronizerConfig =\n  | SynchronizerUpConfig\n  | SynchronizerDownConfig\n  | SynchronizerB2Config\n\ninterface PreparedActionPlan {\n  readonly event: SyncEvent\n  readonly actions: readonly SyncAction[]\n}\n\ninterface LocalRootIdentity {\n  readonly deviceId: number | bigint\n  readonly inode: number | bigint\n}\n\ninterface LocalRootContext {\n  readonly root: string\n  readonly realPath: string\n  readonly identity?: LocalRootIdentity\n}\n\ninterface LocalRootContexts {\n  readonly source?: LocalRootContext\n  readonly dest?: LocalRootContext\n}\n\n/**\n * Infers the sync direction from the source and destination folder types.\n * @param source - The folder to read files from.\n * @param dest - The folder to write files to.\n *\n * @returns The resolved sync direction based on folder types.\n *\n * @throws When the source and destination folder types form an unsupported combination.\n */\nfunction resolveDirection(source: SyncFolder, dest: SyncFolder): SyncDirection {\n  if (source.type === 'local' && dest.type === 'b2') return 'local-to-b2'\n  if (source.type === 'b2' && dest.type === 'local') return 'b2-to-local'\n  if (source.type === 'b2' && dest.type === 'b2') return 'b2-to-b2'\n  throw new Error(`Unsupported sync direction: ${source.type} to ${dest.type}`)\n}\n\n/**\n * Runs a full sync operation: scans both folders, pairs files, generates actions,\n * and executes them with bounded concurrency. Yields {@link SyncEvent} entries for\n * each comparison and action result.\n *\n * @param config - The synchronizer configuration (source, dest, options, and optional bucket).\n *\n * @returns An async generator that yields comparison and action events.\n */\nexport function synchronize(config: SupportedSynchronizerConfig): AsyncGenerator<SyncEvent>\n/**\n * Legacy overload for broad custom synchronizer configurations.\n *\n * @param config - The synchronizer configuration.\n *\n * @returns An async generator that yields comparison and action events.\n *\n * @deprecated Use {@link SupportedSynchronizerConfig}. This legacy overload\n * accepts broad custom configurations for source compatibility, but the\n * supported union is the public contract for built-in sync directions.\n */\nexport function synchronize(config: SynchronizerConfig): AsyncGenerator<SyncEvent>\nexport async function* synchronize(config: SynchronizerConfig): AsyncGenerator<SyncEvent> {\n  const { source, dest, options } = config\n  assertSupportedCompareMode(options.compareMode)\n  const direction = resolveDirection(source, dest)\n  const dryRun = options.dryRun ?? false\n  const concurrency = normalizeSyncConcurrency(options.concurrency)\n  const keepDays = options.keepDays ?? 0\n  const compareThreshold = options.compareThreshold ?? 0\n  const nowMillis = Date.now()\n  const localRootContexts = await resolveLocalRootContexts(config)\n  const queuedEvents: SyncEvent[] = []\n  const failedPaths: string[] = []\n  const failedPathSet = new Set<string>()\n  let errorCount = 0\n  let failedPathOmittedCount = 0\n  let scanHadError = false\n  const runningActions = new Set<Promise<void>>()\n  const scanEvents: ScanEventBuffer = { events: [], dropped: 0 }\n  const scanOptions: SyncScanOptions = {\n    ...(options.include !== undefined ? { include: options.include } : {}),\n    ...(options.exclude !== undefined ? { exclude: options.exclude } : {}),\n    ...(options.signal !== undefined ? { signal: options.signal } : {}),\n    ...(options.maxScanEntries !== undefined ? { maxScanEntries: options.maxScanEntries } : {}),\n    ...(direction === 'b2-to-local' ? { requireLocalSafePaths: true } : {}),\n    onError: (event) => {\n      scanHadError = true\n      recordSyncError(event)\n      queueEvent(event)\n    },\n  }\n\n  const factory = createActionFactory(config, localRootContexts)\n  const readB2Sha1 = dryRun ? undefined : createB2Sha1Reader(config)\n  const actionAbortController = new AbortController()\n  const removeAbortForwarder = forwardAbortSignal(options.signal, actionAbortController)\n  let completed = false\n\n  async function* finishAfterAbort(): AsyncGenerator<SyncEvent> {\n    await drainActions()\n    yield* emitQueuedEvents()\n  }\n\n  try {\n    let pairs: SyncPair[]\n    try {\n      pairs = await collectPairs()\n    } catch (err) {\n      await drainActions()\n      if (options.signal?.aborted) {\n        yield* finishAfterAbort()\n        return\n      }\n      if (!scanHadError) {\n        yield* emitQueuedEvents()\n        throw err\n      }\n\n      yield* emitQueuedEvents()\n      yield aggregateErrorEvent()\n      completed = true\n      return\n    }\n\n    yield* emitQueuedEvents()\n    const filesystemError = scanFilesystemError(scanEvents)\n    if (filesystemError !== undefined) throw filesystemError\n\n    if (options.signal?.aborted) {\n      yield* finishAfterAbort()\n      return\n    }\n\n    if (scanHadError) {\n      if (errorCount > 0) yield aggregateErrorEvent()\n      completed = true\n      return\n    }\n\n    if (options.compareMode === 'sha1') {\n      const compareBatchSize = concurrency\n      for (let index = 0; index < pairs.length; index += compareBatchSize) {\n        if (yield* emitSha1Batch(pairs.slice(index, index + compareBatchSize))) return\n      }\n    } else {\n      for (let index = 0; index < pairs.length; index += concurrency) {\n        const items = pairs\n          .slice(index, index + concurrency)\n          .map((pair) => planPreparedPair(pair, readyComparePair(pair)))\n        synchronizerTestHooks.afterNonSha1PlanBatch?.(items.length)\n        if (yield* emitPreparedItems(items)) return\n      }\n    }\n\n    await drainActions()\n    yield* emitQueuedEvents()\n\n    if (errorCount > 0) {\n      yield aggregateErrorEvent()\n    }\n    completed = true\n  } finally {\n    if (!completed) {\n      abortActionController(\n        actionAbortController,\n        new DOMException('Sync iterator closed', 'AbortError'),\n      )\n    }\n    removeAbortForwarder()\n    await drainActions()\n  }\n\n  async function collectPairs(): Promise<SyncPair[]> {\n    const pairs: SyncPair[] = []\n    for await (const pair of zipFolders(source, dest, scanOptions, {\n      onSourceSkip(event) {\n        bufferScanEvent(scanEvents, event, direction, 'source')\n      },\n      onDestSkip(event) {\n        bufferScanEvent(scanEvents, event, direction, 'dest')\n      },\n    })) {\n      if (options.signal?.aborted) return pairs\n      validateB2SourcePairPrefix(pair, config)\n      pairs.push(pair)\n    }\n    return pairs\n  }\n\n  async function* emitSha1Batch(batch: readonly SyncPair[]): AsyncGenerator<SyncEvent, boolean> {\n    if (batch.length === 0) return false\n\n    // Keep SHA-1 hashing / B2 verification and transfer actions under one effective\n    // concurrency ceiling. This intentionally creates a batch barrier instead of\n    // overlapping compare reads with prior transfers.\n    await drainActions()\n    yield* emitQueuedEvents()\n\n    const preparedBatch = await processPreparedBatch(batch)\n    if (yield* emitPreparedItems(preparedBatch.items)) return true\n    if (preparedBatch.aborted || options.signal?.aborted) {\n      yield* finishAfterAbort()\n      return true\n    }\n    return false\n  }\n\n  async function* emitPreparedItems(\n    items: readonly PreparedActionPlan[],\n  ): AsyncGenerator<SyncEvent, boolean> {\n    for (const item of items) {\n      yield* emitQueuedEvents()\n      yield item.event\n      yield* emitQueuedEvents()\n      /* v8 ignore next -- abort between compare yield and scheduling is timing-dependent */\n      if (options.signal?.aborted) {\n        yield* finishAfterAbort()\n        return true\n      }\n      for (const action of item.actions) {\n        await scheduleAction(action)\n        yield* emitQueuedEvents()\n      }\n    }\n    return false\n  }\n\n  async function processPreparedBatch(\n    batch: readonly SyncPair[],\n  ): Promise<{ readonly items: readonly PreparedActionPlan[]; readonly aborted: boolean }> {\n    if (batch.length === 0) return { items: [], aborted: false }\n    const preparedPairs = await preparePairsForCompare(batch, 'sha1', {\n      concurrency,\n      ...(options.signal !== undefined ? { signal: options.signal } : {}),\n      ...(options.sha1ReadTimeoutMillis !== undefined\n        ? { sha1ReadTimeoutMillis: options.sha1ReadTimeoutMillis }\n        : {}),\n      readLocalSha1: readLocalSha1File,\n      ...(readB2Sha1 !== undefined ? { readB2Sha1 } : {}),\n    })\n\n    const items: PreparedActionPlan[] = []\n    for (const { originalPair, prepared } of preparedPairs) {\n      if (prepared.aborted || options.signal?.aborted) return { items, aborted: true }\n      items.push(planPreparedPair(originalPair, prepared))\n    }\n    return { items, aborted: false }\n  }\n\n  function planPreparedPair(\n    pair: SyncPair,\n    prepared: ComparePreparationResult,\n  ): PreparedActionPlan {\n    const event: SyncEvent = {\n      type: 'compare',\n      path: (pair[0] ?? pair[1])?.relativePath ?? '',\n      size: 0,\n      bytesHashed: prepared.bytesHashed,\n      ...(prepared.bytesVerified > 0 ? { bytesVerified: prepared.bytesVerified } : {}),\n    }\n\n    let preparedErrorEventCount = 0\n    for (const preparedEvent of prepared.events) {\n      queueEvent(preparedEvent)\n      if (preparedEvent.type === 'error') {\n        preparedErrorEventCount++\n        recordFailurePath(preparedEvent.path)\n      }\n    }\n    errorCount += prepared.errors.length\n    for (let index = preparedErrorEventCount; index < prepared.errors.length; index++) {\n      recordFailurePath(event.path)\n    }\n    if (prepared.skipActionGeneration) return { event, actions: [] }\n    if (\n      (scanHadError || scanHadFilesystemError(scanEvents)) &&\n      prepared.pair[0] === null &&\n      prepared.pair[1] !== null\n    ) {\n      return {\n        event,\n        actions: [\n          new SkipAction(prepared.pair[1].relativePath, 'not removed because scan errors occurred'),\n        ],\n      }\n    }\n    if (\n      sourceInventoryIncomplete(scanEvents) &&\n      prepared.pair[0] === null &&\n      prepared.pair[1] !== null\n    ) {\n      return {\n        event,\n        actions: [\n          new SkipAction(\n            prepared.pair[1].relativePath,\n            scanEvents.sourceInventoryIncompleteMessage ??\n              'not removed because the source scan skipped unsafe B2 names',\n          ),\n        ],\n      }\n    }\n\n    const actions = [\n      ...generateActions(\n        prepared.pair,\n        direction,\n        options.compareMode,\n        options.keepMode,\n        keepDays,\n        nowMillis,\n        factory,\n        compareThreshold,\n      ),\n    ]\n\n    return { event, actions }\n  }\n\n  async function scheduleAction(action: SyncAction): Promise<void> {\n    const task = executeAction(action).finally(() => {\n      runningActions.delete(task)\n    })\n    runningActions.add(task)\n    if (runningActions.size >= concurrency) await Promise.race(runningActions)\n  }\n\n  async function executeAction(action: SyncAction): Promise<void> {\n    try {\n      if (actionAbortController.signal.aborted) return\n      const event = await action.execute(dryRun, actionAbortController.signal)\n      queueEvent(event)\n    } catch (err) {\n      const event: SyncEvent = {\n        type: 'error',\n        path: action.relativePath,\n        size: 0,\n        message: sanitizeErrorReason(err),\n      }\n      recordSyncError(event)\n      queueEvent(event)\n    }\n  }\n\n  function recordSyncError(event: SyncEvent): void {\n    errorCount += 1\n    recordFailurePath(event.path)\n  }\n\n  function recordFailurePath(path: string): void {\n    if (path === '') return\n    if (failedPathSet.has(path)) return\n    failedPathSet.add(path)\n    if (failedPaths.length < MAX_AGGREGATE_FAILED_PATHS) {\n      failedPaths.push(path)\n    } else {\n      failedPathOmittedCount++\n    }\n  }\n\n  function aggregateErrorEvent(): SyncEvent {\n    return {\n      type: 'error',\n      path: '',\n      size: 0,\n      message: `${errorCount} sync error(s) occurred`,\n      failureCount: errorCount,\n      failedPaths: [...failedPaths],\n      ...(failedPathOmittedCount > 0 ? { failedPathOmittedCount } : {}),\n    }\n  }\n\n  function queueEvent(event: SyncEvent): void {\n    queuedEvents.push(event)\n  }\n\n  async function* emitQueuedEvents(): AsyncGenerator<SyncEvent> {\n    yield* drainScanEvents(scanEvents)\n    for (const event of queuedEvents.splice(0)) yield event\n  }\n\n  async function drainActions(): Promise<void> {\n    while (runningActions.size > 0) {\n      await Promise.race(runningActions)\n    }\n  }\n}\n\n/**\n * Normalizes user-provided sync concurrency before it controls compare batches and transfers.\n *\n * @param value - Optional concurrency value from sync options.\n *\n * @returns A positive integer concurrency value.\n *\n * @throws When the configured concurrency is not a positive integer.\n */\nfunction normalizeSyncConcurrency(value: number | undefined): number {\n  const candidate = value ?? DEFAULT_TRANSFER_CONCURRENCY\n  if (!Number.isInteger(candidate) || candidate < 1) {\n    throw new RangeError('Sync concurrency must be a positive integer')\n  }\n  return candidate\n}\n\nfunction normalizeDownloadIdleTimeoutMillis(value: number | undefined): number {\n  if (value === undefined) return DEFAULT_DOWNLOAD_IDLE_TIMEOUT_MILLIS\n  if (value === Number.POSITIVE_INFINITY) return value\n  if (!Number.isFinite(value) || value < 1) {\n    throw new RangeError('downloadIdleTimeoutMillis must be a positive finite number or Infinity')\n  }\n  return Math.floor(value)\n}\n\nfunction assertValidB2ContentLength(contentLength: number): number {\n  if (!Number.isSafeInteger(contentLength) || contentLength < 0) {\n    throw new Error('B2 contentLength must be a non-negative safe integer')\n  }\n  return contentLength\n}\n\nfunction createB2Sha1Reader(config: SynchronizerConfig): B2Sha1Reader | undefined {\n  const upConfig = config as Partial<SynchronizerUpConfig>\n  const downConfig = config as Partial<SynchronizerDownConfig>\n  const bucket = upConfig.bucket ?? downConfig.bucket\n  if (bucket === undefined) return undefined\n  const readablePrefixes = b2ReadableRawPrefixes(config)\n  const idleTimeoutMillis = normalizeSha1TimeoutMillis(config.options.sha1ReadTimeoutMillis)\n  const verificationTimeoutMillis = normalizeSha1TimeoutMillis(\n    config.options.sha1VerificationTimeoutMillis,\n    DEFAULT_SHA1_VERIFICATION_TIMEOUT_MILLIS,\n  )\n\n  return async (path, signal) => {\n    const expectedBytes = assertValidB2ContentLength(path.selectedVersion.contentLength)\n    const maxBytes = normalizeSha1VerificationMaxBytes(\n      expectedBytes,\n      config.options.sha1VerificationMaxBytes,\n    )\n    return withSha1VerificationDeadline(\n      signal,\n      verificationTimeoutMillis,\n      async (deadlineSignal) => {\n        deadlineSignal.throwIfAborted()\n        if (maxBytes < expectedBytes) {\n          throw new Error(\n            `sha1 B2 verification skipped because contentLength ${expectedBytes} exceeds ${maxBytes} byte verification budget`,\n          )\n        }\n        const serverSideEncryption = toSseCDownloadKey(\n          config.options.encryptionProvider?.getSettingForDownload(path.selectedVersion),\n        )\n        const fileName = validateB2SyncPathInAnyPrefix(readablePrefixes, path, 'read')\n        const result = await bucket.file(fileName).downloadById(path.selectedVersion.fileId, {\n          ...(serverSideEncryption !== undefined ? { serverSideEncryption } : {}),\n          signal: deadlineSignal,\n        })\n        const verified = await hashReadableStreamSha1(result.body, deadlineSignal, {\n          idleTimeoutMillis,\n          maxBytes,\n          expectedBytes,\n        })\n        return { contentSha1: verified.contentSha1, bytesRead: verified.bytesRead }\n      },\n    )\n  }\n}\n\nfunction forwardAbortSignal(\n  source: AbortSignal | undefined,\n  controller: AbortController,\n): () => void {\n  if (source === undefined) return () => undefined\n  if (source.aborted) {\n    abortActionController(controller, source.reason)\n    return () => undefined\n  }\n\n  const abort = () => abortActionController(controller, source.reason)\n  source.addEventListener('abort', abort, { once: true })\n  return () => source.removeEventListener('abort', abort)\n}\n\nfunction abortActionController(controller: AbortController, reason: unknown): void {\n  if (!controller.signal.aborted) {\n    controller.abort(reason)\n  }\n}\n\n/**\n * Narrowing assertion that a `Bucket` is present for an action that requires\n * it. Throws with a consistent, context-tagged message when the configured\n * direction did not supply one (e.g. `b2-to-local` direction asking for an\n * upload action).\n *\n * Uses TypeScript's `asserts` signature so call-site flow narrows\n * `bucket` from `Bucket | undefined` to `Bucket` after the check, without\n * requiring a separate `if (!bucket) throw ...` line per action factory.\n *\n * @param bucket - The (possibly missing) bucket reference.\n * @param context - Short verb describing the action being constructed\n *   (e.g. `'upload'`, `'download'`). Surfaced in the error message.\n *\n * @throws `Error` when `bucket` is `undefined` or `null`.\n */\nfunction assertBucket(bucket: Bucket | undefined, context: string): asserts bucket is Bucket {\n  if (!bucket) throw new Error(`Bucket required for ${context} actions`)\n}\n\n/**\n * Returns the root for a local sync folder required by an action.\n *\n * @param folder - The configured folder to validate.\n * @param role - Whether the local folder is the source or destination.\n * @param context - Short verb describing the action being constructed.\n *\n * @returns The local filesystem root.\n *\n * @throws `Error` when the folder is not local or has no root.\n */\nfunction requireLocalRoot(\n  folder: SyncFolder | undefined,\n  role: 'source' | 'destination',\n  context: string,\n): string {\n  const root = folder?.type === 'local' ? (folder as Partial<LocalSyncFolder>).root : undefined\n  if (typeof root !== 'string' || root === '') {\n    throw new Error(`Local ${role} root required for ${context} actions`)\n  }\n  return root\n}\n\nasync function resolveLocalRootContexts(config: SynchronizerConfig): Promise<LocalRootContexts> {\n  const sourceIsLocalFilesystem = isLocalFilesystemFolder(config.source)\n  const destIsLocalFilesystem = isLocalFilesystemFolder(config.dest)\n  if (!sourceIsLocalFilesystem && !destIsLocalFilesystem) return {}\n\n  const sourceContext = config.dest.type === 'b2' ? 'upload' : 'sync'\n  const destContext = config.source.type === 'b2' ? 'download' : 'sync'\n  return {\n    ...(sourceIsLocalFilesystem\n      ? {\n          source: await resolveLocalRootContext(\n            requireLocalRoot(config.source, 'source', sourceContext),\n          ),\n        }\n      : {}),\n    ...(destIsLocalFilesystem\n      ? {\n          dest: await resolveLocalRootContext(\n            requireLocalRoot(config.dest, 'destination', destContext),\n          ),\n        }\n      : {}),\n  }\n}\n\nasync function resolveLocalRootContext(root: string): Promise<LocalRootContext> {\n  const { realpath, stat } = await import('node:fs/promises')\n  const { resolve } = await import('node:path')\n  const safeRoot = resolve(root)\n  const realPath = await realpath(safeRoot).catch((err: unknown) => {\n    if (isNotFoundError(err)) return safeRoot\n    throw err\n  })\n  const stats = await stat(realPath).catch((err: unknown) => {\n    if (isNotFoundError(err)) return undefined\n    throw err\n  })\n  if (stats !== undefined && !stats.isDirectory()) {\n    throw new Error('Local sync root is not a directory')\n  }\n  return {\n    root: safeRoot,\n    realPath,\n    ...(stats === undefined\n      ? {}\n      : { identity: { deviceId: stats.dev, inode: stats.ino } satisfies LocalRootIdentity }),\n  }\n}\n\nfunction isLocalFilesystemFolder(folder: SyncFolder | undefined): folder is LocalSyncFolder {\n  return folder?.type === 'local' && isLocalFilesystemRoot(folder)\n}\n/**\n * Narrows a setting to SSE-C; non-SSE-C source settings need no key on read.\n *\n * @param setting - Provider-supplied encryption setting, or undefined.\n *\n * @returns The SSE-C setting when one is provided; otherwise undefined.\n */\nfunction toSseCEncryptionSetting(\n  setting: EncryptionSetting | undefined,\n): Extract<EncryptionSetting, { readonly mode: 'SSE-C' }> | undefined {\n  if (setting?.mode !== 'SSE-C') return undefined\n  return setting\n}\n\n/**\n * Returns a download key from SSE-C settings; non-SSE-C downloads need no key.\n *\n * @param setting - Provider-supplied encryption setting, or undefined.\n *\n * @returns A download key for SSE-C files; otherwise undefined.\n */\nfunction toSseCDownloadKey(setting: EncryptionSetting | undefined): SseCDownloadKey | undefined {\n  return toSseCEncryptionSetting(setting)\n}\n\n/**\n * Creates a configured sync engine wired to the bucket and paths in the given config.\n *\n * For sync operations that may need to remove destination-only files (the\n * `keepMode: 'delete'` policy), the factory reads the destination\n * bucket's cached `fileLockConfiguration` once so `removeOrphan` can\n * dispatch to either `hide` (locked buckets) or `deleteFileVersion`\n * (vanilla buckets) without a per-file branch. The cache is whatever\n * `client.listBuckets()` or `client.createBucket()` returned — callers\n * who flipped lock state mid-sync (rare) should refresh before\n * synchronize().\n *\n * @param config - Synchronizer configuration containing source, destination, and options.\n * @param localRootContexts - Resolved filesystem roots captured before action creation.\n *\n * @returns An action factory bound to the provided configuration.\n */\nfunction createActionFactory(\n  config: SynchronizerConfig,\n  localRootContexts: LocalRootContexts,\n): ActionFactory {\n  const upConfig = config as Partial<SynchronizerUpConfig>\n  const downConfig = config as Partial<SynchronizerDownConfig>\n  const uploadPrefix = asRawB2KeyPrefix(upConfig.prefix ?? b2FolderRawPrefix(config.dest) ?? '')\n  const sourceB2Prefix = b2FolderRawPrefix(config.source)\n\n  const destBucket = upConfig.bucket ?? downConfig.bucket\n  // Defensive optional chain on `info`: synchronizer tests use Bucket\n  // mocks that don't populate this field. Real `Bucket` instances always\n  // do (constructor parameter).\n  const bucketIsLocked = destBucket?.info?.fileLockConfiguration?.value?.isFileLockEnabled ?? false\n\n  const factory: ActionFactory = {\n    upload(source: LocalSyncPath, dest?: B2SyncPath): SyncAction {\n      const bucket = upConfig.bucket\n      assertBucket(bucket, 'upload')\n\n      return new UploadAction(\n        source.relativePath,\n        source.absolutePath,\n        source.size,\n        async (absPath, relPath, signal) => {\n          const rootContext = localRootContexts.source\n          const root = rootContext?.root ?? (upConfig.source as Partial<LocalSyncFolder>).root ?? ''\n          const fileName =\n            dest !== undefined\n              ? validateB2SyncPathInPrefix(uploadPrefix, dest)\n              : `${uploadPrefix}${relPath}`\n          if (rootContext !== undefined) {\n            await assertLocalRootContextCurrent(rootContext, relPath, { allowSymlinkRoot: true })\n          }\n          const targetPath =\n            rootContext === undefined\n              ? await resolveContainedLocalPath(root, source.relativePath, absPath)\n              : await resolveContainedLocalPath(rootContext.realPath, source.relativePath)\n          throwIfAborted(signal)\n          // FileSource avoids whole-file buffering and rejects path swaps on a\n          // best-effort basis. On Windows, callers that need tamper-resistant\n          // same-size rewrite detection should use compareMode: 'sha1' or an\n          // independent digest because restored modification times can hide\n          // local rewrites.\n          const fileSource = await createValidatedUploadFileSource(source, targetPath)\n          throwIfAborted(signal)\n          const serverSideEncryption = config.options.encryptionProvider?.getSettingForUpload(\n            fileName,\n            fileSource.size,\n          )\n          await bucket.upload({\n            fileName,\n            source: fileSource,\n            ...(serverSideEncryption !== undefined ? { serverSideEncryption } : {}),\n            ...(signal !== undefined ? { signal } : {}),\n          })\n        },\n      )\n    },\n\n    download(source: B2SyncPath, scannedDest?: LocalSyncPath | null): SyncAction {\n      const bucket = downConfig.bucket\n      assertBucket(bucket, 'download')\n\n      return new DownloadAction(source.relativePath, source.size, async (relPath, signal) => {\n        const rootContext = localRootContexts.dest\n        const root = rootContext?.root ?? (downConfig.dest as Partial<LocalSyncFolder>).root ?? ''\n        safeRelativePathSegments(relPath)\n        const b2FileName =\n          sourceB2Prefix === undefined\n            ? source.selectedVersion.fileName\n            : validateB2SyncPathInPrefix(sourceB2Prefix, source, 'read')\n        const idleTimeoutMillis = normalizeDownloadIdleTimeoutMillis(\n          config.options.downloadIdleTimeoutMillis,\n        )\n        const expectedBytes = assertValidB2ContentLength(source.selectedVersion.contentLength)\n        if (rootContext !== undefined) {\n          await assertLocalRootContextCurrent(rootContext, relPath, { allowSymlinkRoot: false })\n        }\n        await ensureLocalSyncRootDirectory(root, relPath)\n        const serverSideEncryption = toSseCDownloadKey(\n          config.options.encryptionProvider?.getSettingForDownload(source.selectedVersion),\n        )\n        const result = await bucket.file(b2FileName).downloadById(source.selectedVersion.fileId, {\n          ...(serverSideEncryption !== undefined ? { serverSideEncryption } : {}),\n          ...(signal !== undefined ? { signal } : {}),\n        })\n        try {\n          await writeLocalStreamInsideRoot(root, relPath, result.body, {\n            expectedBytes,\n            ...(scannedDest !== undefined ? { expectedDestination: scannedDest } : {}),\n            idleTimeoutMillis,\n            ...(signal !== undefined ? { signal } : {}),\n          })\n        } catch (err) {\n          await cancelReadableStreamBody(result.body, err)\n          throw err\n        }\n      })\n    },\n\n    copy(source: B2SyncPath, destRelativePath: string): SyncAction {\n      return copyToB2Key(source, `${uploadPrefix}${destRelativePath}`)\n    },\n\n    copyB2Path(source: B2SyncPath, dest: B2SyncPath): SyncAction {\n      return copyToB2Key(source, validateB2SyncPathInPrefix(uploadPrefix, dest))\n    },\n\n    hide(path: string): SyncAction {\n      const bucket = upConfig.bucket ?? downConfig.bucket\n      assertBucket(bucket, 'hide')\n\n      return new HideAction(path, async (_relPath, signal) => {\n        await bucket.hideFile(\n          `${uploadPrefix}${path}`,\n          signal === undefined ? undefined : { signal },\n        )\n      })\n    },\n\n    hideB2Path(path: B2SyncPath): SyncAction {\n      const bucket = upConfig.bucket ?? downConfig.bucket\n      assertBucket(bucket, 'hide')\n      const b2FileName = validateB2SyncPathInPrefix(uploadPrefix, path)\n\n      return new HideAction(path.relativePath, async (_relPath, signal) => {\n        await bucket.hideFile(b2FileName, signal === undefined ? undefined : { signal })\n      })\n    },\n\n    deleteRemote(path: B2SyncPath): SyncAction {\n      const bucket = upConfig.bucket ?? downConfig.bucket\n      assertBucket(bucket, 'delete')\n\n      // Bug fix: `DeleteRemoteAction` invokes the closure with\n      // `relativePath` (the scanner-stripped name relative to the sync\n      // prefix), but B2 stores files under the FULL name including the\n      // prefix. Use the FileVersion's authoritative `fileName` — the\n      // actual B2 key — rather than reconstructing it via prefix\n      // concat. Without this, syncs with a non-empty destination\n      // prefix (e.g. `'site/'`) failed orphan deletion with\n      // `file_not_present`.\n      const b2FileName = validateB2SyncPathInPrefix(uploadPrefix, path)\n      return new DeleteRemoteAction(\n        path.relativePath,\n        path.selectedVersion.fileId as string,\n        async (fileId, _fileName, signal) => {\n          await bucket.deleteFileVersion(\n            b2FileName,\n            fileIdOf(fileId),\n            signal === undefined ? undefined : { signal },\n          )\n        },\n      )\n    },\n\n    deleteLocal(path: LocalSyncPath): SyncAction {\n      const rootContext = localRootContexts.dest\n      const root = rootContext?.root ?? localSyncRoot(downConfig.dest)\n      return new DeleteLocalAction(\n        path.relativePath,\n        path.absolutePath,\n        async (absPath, signal) => {\n          signal?.throwIfAborted()\n          if (absPath !== path.absolutePath) {\n            throw new Error(`Refusing to delete outside sync root: ${path.relativePath}`)\n          }\n          signal?.throwIfAborted()\n          try {\n            if (rootContext !== undefined) {\n              await assertLocalRootContextCurrent(rootContext, path.relativePath, {\n                allowSymlinkRoot: false,\n              })\n            }\n            await deleteLocalFileInsideRoot(root, path)\n          } catch (err) {\n            if (isLocalDeleteSafetyError(err)) throw err\n            throw new Error(`failed to delete local file: ${localFilesystemErrorReason(err)}`)\n          }\n        },\n      )\n    },\n\n    removeOrphan(dest: B2SyncPath): SyncAction {\n      // Locked buckets: `b2_delete_file_version` is blocked or stacks\n      // hide markers under retention; a hide is the safe choice.\n      // Vanilla buckets: plain delete is the right move — hide markers\n      // would just litter the version history.\n      return bucketIsLocked\n        ? (factory.hideB2Path?.(dest) ?? factory.hide(dest.relativePath))\n        : factory.deleteRemote(dest)\n    },\n  }\n\n  function copyToB2Key(source: B2SyncPath, targetPath: string): SyncAction {\n    const bucket = upConfig.bucket\n    assertBucket(bucket, 'copy')\n\n    return new CopyAction(source.relativePath, source.size, async (_relPath, signal) => {\n      if (sourceB2Prefix !== undefined) validateB2SyncPathInPrefix(sourceB2Prefix, source, 'read')\n      const destinationServerSideEncryption =\n        config.options.encryptionProvider?.getSettingForUpload(targetPath, source.size)\n      const sourceServerSideEncryption = toSseCEncryptionSetting(\n        config.options.encryptionProvider?.getSettingForDownload(source.selectedVersion),\n      )\n      await bucket.copyFile({\n        sourceFileId: source.selectedVersion.fileId,\n        fileName: targetPath,\n        ...(destinationServerSideEncryption !== undefined\n          ? { destinationServerSideEncryption }\n          : {}),\n        ...(sourceServerSideEncryption !== undefined ? { sourceServerSideEncryption } : {}),\n        ...(signal !== undefined ? { signal } : {}),\n      })\n    })\n  }\n\n  return factory\n}\n\nasync function createValidatedUploadFileSource(\n  source: LocalSyncPath,\n  absolutePath: string,\n): Promise<ContentSource> {\n  try {\n    const fileSource = await FileSource.fromPath(absolutePath)\n    await validateScannedLocalFile({ ...source, absolutePath })\n    return fileSource\n  } catch (err) {\n    throw normalizeLocalUploadSourceError(err)\n  }\n}\n\nfunction normalizeLocalUploadSourceError(err: unknown): Error {\n  if (err instanceof Error && err.message.startsWith('local file changed before upload')) {\n    return err\n  }\n  const message = err instanceof Error ? err.message : String(err)\n  if (message.includes('not a regular file')) {\n    return new Error('local file changed before upload: not a regular file')\n  }\n  if (message.includes('changed') || message.includes('modified')) {\n    return new Error('local file changed before upload')\n  }\n  return new Error(`local file changed before upload: ${sanitizeErrorReason(err)}`)\n}\n\nfunction localSyncRoot(folder: LocalSyncFolder | undefined): string {\n  return folder?.type === 'local' ? folder.root : ''\n}\n\nfunction b2FolderRawPrefix(folder: SyncFolder | undefined): string | undefined {\n  if (folder?.type !== 'b2') return undefined\n  const rawPrefix = (folder as B2SyncFolder).rawPrefix\n  return typeof rawPrefix === 'string' ? rawPrefix : undefined\n}\n\nfunction validateB2SourcePairPrefix(pair: SyncPair, config: SynchronizerConfig): void {\n  const [source] = pair\n  if (config.source.type !== 'b2' || source === null || !isB2SyncPath(source)) return\n  const sourcePrefix = b2FolderRawPrefix(config.source)\n  if (sourcePrefix === undefined) return\n  validateB2SyncPathInPrefix(sourcePrefix, source, 'read')\n}\n\nfunction b2ReadableRawPrefixes(config: SynchronizerConfig): readonly string[] {\n  const prefixes: string[] = []\n  const sourcePrefix = b2FolderRawPrefix(config.source)\n  if (config.source.type === 'b2') prefixes.push(sourcePrefix ?? '')\n\n  const upConfig = config as Partial<SynchronizerUpConfig>\n  if (config.dest.type === 'b2') {\n    prefixes.push(upConfig.prefix ?? b2FolderRawPrefix(config.dest) ?? '')\n  }\n\n  return [...new Set(prefixes.map((prefix) => asRawB2KeyPrefix(prefix)))]\n}\n\nfunction validateB2SyncPathInAnyPrefix(\n  prefixes: readonly string[],\n  path: B2SyncPath,\n  operation: string,\n): string {\n  let firstError = new Error(`Refusing to ${operation} B2 key: ${path.relativePath}`)\n  for (const prefix of prefixes) {\n    try {\n      return validateB2SyncPathInPrefix(prefix, path, operation)\n    } catch (err) {\n      if (err instanceof Error) firstError = err\n    }\n  }\n  throw firstError\n}\n\nfunction validateB2SyncPathInPrefix(\n  prefix: string,\n  path: B2SyncPath,\n  operation = 'mutate',\n): string {\n  const fileName = path.selectedVersion.fileName\n  if (!fileName.startsWith(prefix)) {\n    throw new Error(\n      `Refusing to ${operation} B2 key outside configured prefix: ${path.relativePath}`,\n    )\n  }\n\n  const relativePath = b2KeyToRelativePathUnderPrefix(prefix, fileName)\n  if (relativePath !== path.relativePath) {\n    throw new Error(\n      `Refusing to ${operation} mismatched B2 key for sync path: ${path.relativePath}`,\n    )\n  }\n\n  return fileName\n}\n\nfunction isB2SyncPath(path: SyncPath): path is B2SyncPath {\n  return 'selectedVersion' in path\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted === true) {\n    throw signal.reason ?? new DOMException('Aborted', 'AbortError')\n  }\n}\n\nasync function cancelReadableStreamBody(\n  body: ReadableStream<Uint8Array>,\n  reason: unknown,\n): Promise<void> {\n  if (body.locked) return\n  try {\n    await body.cancel(reason)\n  } catch {\n    // Best-effort response cleanup must not mask the setup or write failure.\n  }\n}\n\nasync function assertLocalRootContextCurrent(\n  context: LocalRootContext,\n  relativePath: string,\n  options: { readonly allowSymlinkRoot: boolean },\n): Promise<void> {\n  if (context.identity === undefined) return\n\n  const { lstat, realpath, stat } = await import('node:fs/promises')\n  let currentRealPath: string\n  try {\n    const rootLinkStats = await lstat(context.root)\n    if (!options.allowSymlinkRoot && rootLinkStats.isSymbolicLink()) {\n      throw new Error(`Refusing to access sync root through symlink: ${relativePath}`)\n    }\n    currentRealPath = await realpath(context.root)\n  } catch (err) {\n    if (err instanceof Error && err.message.startsWith('Refusing to access sync root')) throw err\n    throw new Error(`Local sync root changed before filesystem action: ${relativePath}`)\n  }\n\n  if (currentRealPath !== context.realPath) {\n    throw new Error(`Local sync root changed before filesystem action: ${relativePath}`)\n  }\n\n  let currentStats: Awaited<ReturnType<typeof stat>>\n  try {\n    currentStats = await stat(context.realPath)\n  } catch {\n    throw new Error(`Local sync root changed before filesystem action: ${relativePath}`)\n  }\n\n  if (\n    !currentStats.isDirectory() ||\n    currentStats.dev !== context.identity.deviceId ||\n    currentStats.ino !== context.identity.inode\n  ) {\n    throw new Error(`Local sync root changed before filesystem action: ${relativePath}`)\n  }\n}\n\nasync function ensureLocalSyncRootDirectory(root: string, relativePath: string): Promise<void> {\n  if (root === '') {\n    throw new Error('Local sync root required for filesystem mutation')\n  }\n\n  const { lstat, mkdir } = await import('node:fs/promises')\n  const { resolve } = await import('node:path')\n  const safeRoot = resolve(root)\n\n  try {\n    const stats = await lstat(safeRoot)\n    if (stats.isSymbolicLink()) {\n      throw new Error(`Refusing to access sync root through symlink: ${relativePath}`)\n    }\n    if (!stats.isDirectory()) {\n      throw new Error(`Local sync root is not a directory: ${relativePath}`)\n    }\n    return\n  } catch (error) {\n    if (!isNotFoundError(error)) throw error\n  }\n\n  await mkdir(safeRoot, { recursive: true })\n  await assertLocalRootHasNoSymlink(safeRoot, relativePath)\n}\n\nfunction bufferScanEvent(\n  buffer: ScanEventBuffer,\n  event: SyncEvent,\n  direction: SyncDirection,\n  scanSide: 'source' | 'dest',\n): void {\n  if (event.type === 'skip' && event.reason === 'filesystem-error') {\n    buffer.fatalFilesystemErrorMessage ??= event.message\n  }\n  if (sourceSkipMakesInventoryIncomplete(event, direction, scanSide)) {\n    buffer.sourceInventoryIncompleteMessage ??= sourceInventoryIncompleteMessage(direction)\n  }\n  if (buffer.events.length < MAX_BUFFERED_SCAN_EVENTS) {\n    buffer.events.push(event)\n  } else {\n    buffer.dropped++\n  }\n}\n\nfunction* drainScanEvents(buffer: ScanEventBuffer): Generator<SyncEvent> {\n  while (buffer.events.length > 0) {\n    const event = buffer.events.shift()\n    if (event) yield event\n  }\n\n  if (buffer.dropped > 0) {\n    yield {\n      type: 'skip',\n      path: '',\n      size: 0,\n      reason: 'scan-skip-overflow',\n      message: `${buffer.dropped} scanner skip event(s) were omitted after ${MAX_BUFFERED_SCAN_EVENTS} buffered diagnostics`,\n    }\n    buffer.dropped = 0\n  }\n}\n\nfunction scanHadFilesystemError(scanEvents: ScanEventBuffer): boolean {\n  return scanEvents.fatalFilesystemErrorMessage !== undefined\n}\n\nfunction sourceInventoryIncomplete(scanEvents: ScanEventBuffer): boolean {\n  return scanEvents.sourceInventoryIncompleteMessage !== undefined\n}\n\nfunction scanFilesystemError(scanEvents: ScanEventBuffer): Error | undefined {\n  return scanEvents.fatalFilesystemErrorMessage === undefined\n    ? undefined\n    : new Error(scanEvents.fatalFilesystemErrorMessage)\n}\n\nfunction sourceSkipMakesInventoryIncomplete(\n  event: SyncEvent,\n  direction: SyncDirection,\n  scanSide: 'source' | 'dest',\n): event is SyncSkipEvent {\n  if (scanSide !== 'source' || event.type !== 'skip') return false\n\n  if (direction === 'local-to-b2') {\n    return (\n      event.reason === 'unsafe-name' ||\n      event.reason === 'stale-download-partial' ||\n      event.reason === 'path-too-long-for-regexp'\n    )\n  }\n\n  if (direction === 'b2-to-local' || direction === 'b2-to-b2') {\n    return (\n      event.reason === 'unsafe-name' ||\n      event.reason === 'local-unsafe-name' ||\n      event.reason === 'relative-path-collision' ||\n      event.reason === 'local-path-collision' ||\n      event.reason === 'path-too-long-for-regexp'\n    )\n  }\n\n  return false\n}\n\nfunction sourceInventoryIncompleteMessage(direction: SyncDirection): string {\n  return direction === 'local-to-b2'\n    ? 'not removed because the source scan skipped local paths'\n    : 'not removed because the source scan skipped unsafe B2 names'\n}\n\nfunction isLocalDeleteSafetyError(err: unknown): boolean {\n  if (!(err instanceof Error)) return false\n  return (\n    err.message === 'Local sync root required for filesystem mutation' ||\n    err.message.startsWith('Local sync root changed before filesystem action: ') ||\n    err.message.startsWith('Refusing to ') ||\n    err.message.startsWith('Local sync root is not a directory: ') ||\n    err.message.startsWith('unsafe local delete path: ')\n  )\n}\n\nasync function resolveContainedLocalPath(\n  root: string,\n  relativePath: string,\n  absolutePath?: string,\n): Promise<string> {\n  if (root === '') {\n    throw new Error('Local sync root required for filesystem mutation')\n  }\n\n  const { isAbsolute, relative, resolve, sep } = await import('node:path')\n  const safeRoot = resolve(root)\n  const target =\n    absolutePath === undefined ? resolve(safeRoot, relativePath) : resolve(absolutePath)\n  const pathFromRoot = relative(safeRoot, target)\n  const escapesRoot =\n    pathFromRoot === '..' || pathFromRoot.startsWith(`..${sep}`) || isAbsolute(pathFromRoot)\n\n  /* v8 ignore next -- defense-in-depth after prior no-follow and symlink checks. */\n  if (escapesRoot) {\n    throw new Error(`Refusing to access path outside sync root: ${relativePath}`)\n  }\n\n  await assertLocalRootHasNoSymlink(safeRoot, relativePath)\n  await assertPathHasNoSymlinkComponents(safeRoot, pathFromRoot, relativePath)\n\n  return target\n}\n\nasync function assertLocalRootHasNoSymlink(safeRoot: string, relativePath: string): Promise<void> {\n  const { lstat } = await import('node:fs/promises')\n  try {\n    const stats = await lstat(safeRoot)\n    if (stats.isSymbolicLink()) {\n      throw new Error(`Refusing to access sync root through symlink: ${relativePath}`)\n    }\n  } catch (error) {\n    if (isNotFoundError(error)) return\n    throw error\n  }\n}\n\nasync function assertPathHasNoSymlinkComponents(\n  safeRoot: string,\n  pathFromRoot: string,\n  relativePath: string,\n): Promise<void> {\n  if (pathFromRoot === '') return\n\n  const { lstat } = await import('node:fs/promises')\n  const { join, sep } = await import('node:path')\n  let current = safeRoot\n\n  for (const segment of pathFromRoot.split(sep)) {\n    current = join(current, segment)\n    let stats: Awaited<ReturnType<typeof lstat>>\n    try {\n      stats = await lstat(current)\n    } catch (error) {\n      if (isNotFoundError(error)) return\n      throw error\n    }\n    if (stats.isSymbolicLink()) {\n      throw new Error(`Refusing to access path through symlink: ${relativePath}`)\n    }\n  }\n}\n\nfunction isNotFoundError(error: unknown): boolean {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    (error as { readonly code?: unknown }).code === 'ENOENT'\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0DA,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,uCAAuC;;;;;;AAc7C,IAAa,wBAET,CAAC;;;;;;;;;;AA2GL,SAAS,iBAAiB,QAAoB,MAAiC;CAC7E,IAAI,OAAO,SAAS,WAAW,KAAK,SAAS,MAAM,OAAO;CAC1D,IAAI,OAAO,SAAS,QAAQ,KAAK,SAAS,SAAS,OAAO;CAC1D,IAAI,OAAO,SAAS,QAAQ,KAAK,SAAS,MAAM,OAAO;CACvD,MAAM,IAAI,MAAM,+BAA+B,OAAO,KAAK,MAAM,KAAK,MAAM;AAC9E;AAwBA,gBAAuB,YAAY,QAAuD;CACxF,MAAM,EAAE,QAAQ,MAAM,YAAY;CAClC,2BAA2B,QAAQ,WAAW;CAC9C,MAAM,YAAY,iBAAiB,QAAQ,IAAI;CAC/C,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,cAAc,yBAAyB,QAAQ,WAAW;CAChE,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,YAAY,KAAK,IAAI;CAC3B,MAAM,oBAAoB,MAAM,yBAAyB,MAAM;CAC/D,MAAM,eAA4B,CAAC;CACnC,MAAM,cAAwB,CAAC;CAC/B,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,yBAAyB;CAC7B,IAAI,eAAe;CACnB,MAAM,iCAAiB,IAAI,IAAmB;CAC9C,MAAM,aAA8B;EAAE,QAAQ,CAAC;EAAG,SAAS;CAAE;CAC7D,MAAM,cAA+B;EACnC,GAAI,QAAQ,YAAY,KAAA,IAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACpE,GAAI,QAAQ,YAAY,KAAA,IAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACpE,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACjE,GAAI,QAAQ,mBAAmB,KAAA,IAAY,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;EACzF,GAAI,cAAc,gBAAgB,EAAE,uBAAuB,KAAK,IAAI,CAAC;EACrE,UAAU,UAAU;GAClB,eAAe;GACf,gBAAgB,KAAK;GACrB,WAAW,KAAK;EAClB;CACF;CAEA,MAAM,UAAU,oBAAoB,QAAQ,iBAAiB;CAC7D,MAAM,aAAa,SAAS,KAAA,IAAY,mBAAmB,MAAM;CACjE,MAAM,wBAAwB,IAAI,gBAAgB;CAClD,MAAM,uBAAuB,mBAAmB,QAAQ,QAAQ,qBAAqB;CACrF,IAAI,YAAY;CAEhB,gBAAgB,mBAA8C;EAC5D,MAAM,aAAa;EACnB,OAAO,iBAAiB;CAC1B;CAEA,IAAI;EACF,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,aAAa;EAC7B,SAAS,KAAK;GACZ,MAAM,aAAa;GACnB,IAAI,QAAQ,QAAQ,SAAS;IAC3B,OAAO,iBAAiB;IACxB;GACF;GACA,IAAI,CAAC,cAAc;IACjB,OAAO,iBAAiB;IACxB,MAAM;GACR;GAEA,OAAO,iBAAiB;GACxB,MAAM,oBAAoB;GAC1B,YAAY;GACZ;EACF;EAEA,OAAO,iBAAiB;EACxB,MAAM,kBAAkB,oBAAoB,UAAU;EACtD,IAAI,oBAAoB,KAAA,GAAW,MAAM;EAEzC,IAAI,QAAQ,QAAQ,SAAS;GAC3B,OAAO,iBAAiB;GACxB;EACF;EAEA,IAAI,cAAc;GAChB,IAAI,aAAa,GAAG,MAAM,oBAAoB;GAC9C,YAAY;GACZ;EACF;EAEA,IAAI,QAAQ,gBAAgB,QAAQ;GAClC,MAAM,mBAAmB;GACzB,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,kBACjD,IAAI,OAAO,cAAc,MAAM,MAAM,OAAO,QAAQ,gBAAgB,CAAC,GAAG;EAE5E,OACE,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,aAAa;GAC9D,MAAM,QAAQ,MACX,MAAM,OAAO,QAAQ,WAAW,CAAC,CACjC,KAAK,SAAS,iBAAiB,MAAM,iBAAiB,IAAI,CAAC,CAAC;GAC/D,sBAAsB,wBAAwB,MAAM,MAAM;GAC1D,IAAI,OAAO,kBAAkB,KAAK,GAAG;EACvC;EAGF,MAAM,aAAa;EACnB,OAAO,iBAAiB;EAExB,IAAI,aAAa,GACf,MAAM,oBAAoB;EAE5B,YAAY;CACd,UAAU;EACR,IAAI,CAAC,WACH,sBACE,uBACA,IAAI,aAAa,wBAAwB,YAAY,CACvD;EAEF,qBAAqB;EACrB,MAAM,aAAa;CACrB;CAEA,eAAe,eAAoC;EACjD,MAAM,QAAoB,CAAC;EAC3B,WAAW,MAAM,QAAQ,WAAW,QAAQ,MAAM,aAAa;GAC7D,aAAa,OAAO;IAClB,gBAAgB,YAAY,OAAO,WAAW,QAAQ;GACxD;GACA,WAAW,OAAO;IAChB,gBAAgB,YAAY,OAAO,WAAW,MAAM;GACtD;EACF,CAAC,GAAG;GACF,IAAI,QAAQ,QAAQ,SAAS,OAAO;GACpC,2BAA2B,MAAM,MAAM;GACvC,MAAM,KAAK,IAAI;EACjB;EACA,OAAO;CACT;CAEA,gBAAgB,cAAc,OAAgE;EAC5F,IAAI,MAAM,WAAW,GAAG,OAAO;EAK/B,MAAM,aAAa;EACnB,OAAO,iBAAiB;EAExB,MAAM,gBAAgB,MAAM,qBAAqB,KAAK;EACtD,IAAI,OAAO,kBAAkB,cAAc,KAAK,GAAG,OAAO;EAC1D,IAAI,cAAc,WAAW,QAAQ,QAAQ,SAAS;GACpD,OAAO,iBAAiB;GACxB,OAAO;EACT;EACA,OAAO;CACT;CAEA,gBAAgB,kBACd,OACoC;EACpC,KAAK,MAAM,QAAQ,OAAO;GACxB,OAAO,iBAAiB;GACxB,MAAM,KAAK;GACX,OAAO,iBAAiB;;GAExB,IAAI,QAAQ,QAAQ,SAAS;IAC3B,OAAO,iBAAiB;IACxB,OAAO;GACT;GACA,KAAK,MAAM,UAAU,KAAK,SAAS;IACjC,MAAM,eAAe,MAAM;IAC3B,OAAO,iBAAiB;GAC1B;EACF;EACA,OAAO;CACT;CAEA,eAAe,qBACb,OACuF;EACvF,IAAI,MAAM,WAAW,GAAG,OAAO;GAAE,OAAO,CAAC;GAAG,SAAS;EAAM;EAC3D,MAAM,gBAAgB,MAAM,uBAAuB,OAAO,QAAQ;GAChE;GACA,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACjE,GAAI,QAAQ,0BAA0B,KAAA,IAClC,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;GACL,eAAe;GACf,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;EACnD,CAAC;EAED,MAAM,QAA8B,CAAC;EACrC,KAAK,MAAM,EAAE,cAAc,cAAc,eAAe;GACtD,IAAI,SAAS,WAAW,QAAQ,QAAQ,SAAS,OAAO;IAAE;IAAO,SAAS;GAAK;GAC/E,MAAM,KAAK,iBAAiB,cAAc,QAAQ,CAAC;EACrD;EACA,OAAO;GAAE;GAAO,SAAS;EAAM;CACjC;CAEA,SAAS,iBACP,MACA,UACoB;EACpB,MAAM,QAAmB;GACvB,MAAM;GACN,OAAO,KAAK,MAAM,KAAK,GAAA,EAAK,gBAAgB;GAC5C,MAAM;GACN,aAAa,SAAS;GACtB,GAAI,SAAS,gBAAgB,IAAI,EAAE,eAAe,SAAS,cAAc,IAAI,CAAC;EAChF;EAEA,IAAI,0BAA0B;EAC9B,KAAK,MAAM,iBAAiB,SAAS,QAAQ;GAC3C,WAAW,aAAa;GACxB,IAAI,cAAc,SAAS,SAAS;IAClC;IACA,kBAAkB,cAAc,IAAI;GACtC;EACF;EACA,cAAc,SAAS,OAAO;EAC9B,KAAK,IAAI,QAAQ,yBAAyB,QAAQ,SAAS,OAAO,QAAQ,SACxE,kBAAkB,MAAM,IAAI;EAE9B,IAAI,SAAS,sBAAsB,OAAO;GAAE;GAAO,SAAS,CAAC;EAAE;EAC/D,KACG,gBAAgB,uBAAuB,UAAU,MAClD,SAAS,KAAK,OAAO,QACrB,SAAS,KAAK,OAAO,MAErB,OAAO;GACL;GACA,SAAS,CACP,IAAI,WAAW,SAAS,KAAK,EAAE,CAAC,cAAc,0CAA0C,CAC1F;EACF;EAEF,IACE,0BAA0B,UAAU,KACpC,SAAS,KAAK,OAAO,QACrB,SAAS,KAAK,OAAO,MAErB,OAAO;GACL;GACA,SAAS,CACP,IAAI,WACF,SAAS,KAAK,EAAE,CAAC,cACjB,WAAW,oCACT,6DACJ,CACF;EACF;EAgBF,OAAO;GAAE;GAAO,SAAA,CAZd,GAAG,gBACD,SAAS,MACT,WACA,QAAQ,aACR,QAAQ,UACR,UACA,WACA,SACA,gBACF,CAGc;EAAQ;CAC1B;CAEA,eAAe,eAAe,QAAmC;EAC/D,MAAM,OAAO,cAAc,MAAM,CAAC,CAAC,cAAc;GAC/C,eAAe,OAAO,IAAI;EAC5B,CAAC;EACD,eAAe,IAAI,IAAI;EACvB,IAAI,eAAe,QAAQ,aAAa,MAAM,QAAQ,KAAK,cAAc;CAC3E;CAEA,eAAe,cAAc,QAAmC;EAC9D,IAAI;GACF,IAAI,sBAAsB,OAAO,SAAS;GAE1C,WAAW,MADS,OAAO,QAAQ,QAAQ,sBAAsB,MAAM,CACvD;EAClB,SAAS,KAAK;GACZ,MAAM,QAAmB;IACvB,MAAM;IACN,MAAM,OAAO;IACb,MAAM;IACN,SAAS,oBAAoB,GAAG;GAClC;GACA,gBAAgB,KAAK;GACrB,WAAW,KAAK;EAClB;CACF;CAEA,SAAS,gBAAgB,OAAwB;EAC/C,cAAc;EACd,kBAAkB,MAAM,IAAI;CAC9B;CAEA,SAAS,kBAAkB,MAAoB;EAC7C,IAAI,SAAS,IAAI;EACjB,IAAI,cAAc,IAAI,IAAI,GAAG;EAC7B,cAAc,IAAI,IAAI;EACtB,IAAI,YAAY,SAAS,4BACvB,YAAY,KAAK,IAAI;OAErB;CAEJ;CAEA,SAAS,sBAAiC;EACxC,OAAO;GACL,MAAM;GACN,MAAM;GACN,MAAM;GACN,SAAS,GAAG,WAAW;GACvB,cAAc;GACd,aAAa,CAAC,GAAG,WAAW;GAC5B,GAAI,yBAAyB,IAAI,EAAE,uBAAuB,IAAI,CAAC;EACjE;CACF;CAEA,SAAS,WAAW,OAAwB;EAC1C,aAAa,KAAK,KAAK;CACzB;CAEA,gBAAgB,mBAA8C;EAC5D,OAAO,gBAAgB,UAAU;EACjC,KAAK,MAAM,SAAS,aAAa,OAAO,CAAC,GAAG,MAAM;CACpD;CAEA,eAAe,eAA8B;EAC3C,OAAO,eAAe,OAAO,GAC3B,MAAM,QAAQ,KAAK,cAAc;CAErC;AACF;;;;;;;;;;AAWA,SAAS,yBAAyB,OAAmC;CACnE,MAAM,YAAY,SAAA;CAClB,IAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAC9C,MAAM,IAAI,WAAW,6CAA6C;CAEpE,OAAO;AACT;AAEA,SAAS,mCAAmC,OAAmC;CAC7E,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,UAAU,OAAO,mBAAmB,OAAO;CAC/C,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GACrC,MAAM,IAAI,WAAW,wEAAwE;CAE/F,OAAO,KAAK,MAAM,KAAK;AACzB;AAEA,SAAS,2BAA2B,eAA+B;CACjE,IAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,GAC1D,MAAM,IAAI,MAAM,sDAAsD;CAExE,OAAO;AACT;AAEA,SAAS,mBAAmB,QAAsD;CAChF,MAAM,WAAW;CACjB,MAAM,aAAa;CACnB,MAAM,SAAS,SAAS,UAAU,WAAW;CAC7C,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,MAAM,mBAAmB,sBAAsB,MAAM;CACrD,MAAM,oBAAoB,2BAA2B,OAAO,QAAQ,qBAAqB;CACzF,MAAM,4BAA4B,2BAChC,OAAO,QAAQ,+BACf,wCACF;CAEA,OAAO,OAAO,MAAM,WAAW;EAC7B,MAAM,gBAAgB,2BAA2B,KAAK,gBAAgB,aAAa;EACnF,MAAM,WAAW,kCACf,eACA,OAAO,QAAQ,wBACjB;EACA,OAAO,6BACL,QACA,2BACA,OAAO,mBAAmB;GACxB,eAAe,eAAe;GAC9B,IAAI,WAAW,eACb,MAAM,IAAI,MACR,sDAAsD,cAAc,WAAW,SAAS,0BAC1F;GAEF,MAAM,uBAAuB,kBAC3B,OAAO,QAAQ,oBAAoB,sBAAsB,KAAK,eAAe,CAC/E;GACA,MAAM,WAAW,8BAA8B,kBAAkB,MAAM,MAAM;GAC7E,MAAM,SAAS,MAAM,OAAO,KAAK,QAAQ,CAAC,CAAC,aAAa,KAAK,gBAAgB,QAAQ;IACnF,GAAI,yBAAyB,KAAA,IAAY,EAAE,qBAAqB,IAAI,CAAC;IACrE,QAAQ;GACV,CAAC;GACD,MAAM,WAAW,MAAM,uBAAuB,OAAO,MAAM,gBAAgB;IACzE;IACA;IACA;GACF,CAAC;GACD,OAAO;IAAE,aAAa,SAAS;IAAa,WAAW,SAAS;GAAU;EAC5E,CACF;CACF;AACF;AAEA,SAAS,mBACP,QACA,YACY;CACZ,IAAI,WAAW,KAAA,GAAW,aAAa,KAAA;CACvC,IAAI,OAAO,SAAS;EAClB,sBAAsB,YAAY,OAAO,MAAM;EAC/C,aAAa,KAAA;CACf;CAEA,MAAM,cAAc,sBAAsB,YAAY,OAAO,MAAM;CACnE,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,aAAa,OAAO,oBAAoB,SAAS,KAAK;AACxD;AAEA,SAAS,sBAAsB,YAA6B,QAAuB;CACjF,IAAI,CAAC,WAAW,OAAO,SACrB,WAAW,MAAM,MAAM;AAE3B;;;;;;;;;;;;;;;;;AAkBA,SAAS,aAAa,QAA4B,SAA2C;CAC3F,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,uBAAuB,QAAQ,SAAS;AACvE;;;;;;;;;;;;AAaA,SAAS,iBACP,QACA,MACA,SACQ;CACR,MAAM,OAAO,QAAQ,SAAS,UAAW,OAAoC,OAAO,KAAA;CACpF,IAAI,OAAO,SAAS,YAAY,SAAS,IACvC,MAAM,IAAI,MAAM,SAAS,KAAK,qBAAqB,QAAQ,SAAS;CAEtE,OAAO;AACT;AAEA,eAAe,yBAAyB,QAAwD;CAC9F,MAAM,0BAA0B,wBAAwB,OAAO,MAAM;CACrE,MAAM,wBAAwB,wBAAwB,OAAO,IAAI;CACjE,IAAI,CAAC,2BAA2B,CAAC,uBAAuB,OAAO,CAAC;CAEhE,MAAM,gBAAgB,OAAO,KAAK,SAAS,OAAO,WAAW;CAC7D,MAAM,cAAc,OAAO,OAAO,SAAS,OAAO,aAAa;CAC/D,OAAO;EACL,GAAI,0BACA,EACE,QAAQ,MAAM,wBACZ,iBAAiB,OAAO,QAAQ,UAAU,aAAa,CACzD,EACF,IACA,CAAC;EACL,GAAI,wBACA,EACE,MAAM,MAAM,wBACV,iBAAiB,OAAO,MAAM,eAAe,WAAW,CAC1D,EACF,IACA,CAAC;CACP;AACF;AAEA,eAAe,wBAAwB,MAAyC;CAC9E,MAAM,EAAE,UAAU,SAAS,MAAM,OAAO;CACxC,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,WAAW,MAAM,SAAS,QAAQ,CAAC,CAAC,OAAO,QAAiB;EAChE,IAAI,gBAAgB,GAAG,GAAG,OAAO;EACjC,MAAM;CACR,CAAC;CACD,MAAM,QAAQ,MAAM,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAiB;EACzD,IAAI,gBAAgB,GAAG,GAAG,OAAO,KAAA;EACjC,MAAM;CACR,CAAC;CACD,IAAI,UAAU,KAAA,KAAa,CAAC,MAAM,YAAY,GAC5C,MAAM,IAAI,MAAM,oCAAoC;CAEtD,OAAO;EACL,MAAM;EACN;EACA,GAAI,UAAU,KAAA,IACV,CAAC,IACD,EAAE,UAAU;GAAE,UAAU,MAAM;GAAK,OAAO,MAAM;EAAI,EAA8B;CACxF;AACF;AAEA,SAAS,wBAAwB,QAA2D;CAC1F,OAAO,QAAQ,SAAS,WAAW,sBAAsB,MAAM;AACjE;;;;;;;;AAQA,SAAS,wBACP,SACoE;CACpE,IAAI,SAAS,SAAS,SAAS,OAAO,KAAA;CACtC,OAAO;AACT;;;;;;;;AASA,SAAS,kBAAkB,SAAqE;CAC9F,OAAO,wBAAwB,OAAO;AACxC;;;;;;;;;;;;;;;;;;AAmBA,SAAS,oBACP,QACA,mBACe;CACf,MAAM,WAAW;CACjB,MAAM,aAAa;CACnB,MAAM,eAAe,iBAAiB,SAAS,UAAU,kBAAkB,OAAO,IAAI,KAAK,EAAE;CAC7F,MAAM,iBAAiB,kBAAkB,OAAO,MAAM;CAMtD,MAAM,kBAJa,SAAS,UAAU,WAAW,OAAA,EAId,MAAM,uBAAuB,OAAO,qBAAqB;CAE5F,MAAM,UAAyB;EAC7B,OAAO,QAAuB,MAA+B;GAC3D,MAAM,SAAS,SAAS;GACxB,aAAa,QAAQ,QAAQ;GAE7B,OAAO,IAAI,aACT,OAAO,cACP,OAAO,cACP,OAAO,MACP,OAAO,SAAS,SAAS,WAAW;IAClC,MAAM,cAAc,kBAAkB;IACtC,MAAM,OAAO,aAAa,QAAS,SAAS,OAAoC,QAAQ;IACxF,MAAM,WACJ,SAAS,KAAA,IACL,2BAA2B,cAAc,IAAI,IAC7C,GAAG,eAAe;IACxB,IAAI,gBAAgB,KAAA,GAClB,MAAM,8BAA8B,aAAa,SAAS,EAAE,kBAAkB,KAAK,CAAC;IAEtF,MAAM,aACJ,gBAAgB,KAAA,IACZ,MAAM,0BAA0B,MAAM,OAAO,cAAc,OAAO,IAClE,MAAM,0BAA0B,YAAY,UAAU,OAAO,YAAY;IAC/E,eAAe,MAAM;IAMrB,MAAM,aAAa,MAAM,gCAAgC,QAAQ,UAAU;IAC3E,eAAe,MAAM;IACrB,MAAM,uBAAuB,OAAO,QAAQ,oBAAoB,oBAC9D,UACA,WAAW,IACb;IACA,MAAM,OAAO,OAAO;KAClB;KACA,QAAQ;KACR,GAAI,yBAAyB,KAAA,IAAY,EAAE,qBAAqB,IAAI,CAAC;KACrE,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;GACH,CACF;EACF;EAEA,SAAS,QAAoB,aAAgD;GAC3E,MAAM,SAAS,WAAW;GAC1B,aAAa,QAAQ,UAAU;GAE/B,OAAO,IAAI,eAAe,OAAO,cAAc,OAAO,MAAM,OAAO,SAAS,WAAW;IACrF,MAAM,cAAc,kBAAkB;IACtC,MAAM,OAAO,aAAa,QAAS,WAAW,KAAkC,QAAQ;IACxF,yBAAyB,OAAO;IAChC,MAAM,aACJ,mBAAmB,KAAA,IACf,OAAO,gBAAgB,WACvB,2BAA2B,gBAAgB,QAAQ,MAAM;IAC/D,MAAM,oBAAoB,mCACxB,OAAO,QAAQ,yBACjB;IACA,MAAM,gBAAgB,2BAA2B,OAAO,gBAAgB,aAAa;IACrF,IAAI,gBAAgB,KAAA,GAClB,MAAM,8BAA8B,aAAa,SAAS,EAAE,kBAAkB,MAAM,CAAC;IAEvF,MAAM,6BAA6B,MAAM,OAAO;IAChD,MAAM,uBAAuB,kBAC3B,OAAO,QAAQ,oBAAoB,sBAAsB,OAAO,eAAe,CACjF;IACA,MAAM,SAAS,MAAM,OAAO,KAAK,UAAU,CAAC,CAAC,aAAa,OAAO,gBAAgB,QAAQ;KACvF,GAAI,yBAAyB,KAAA,IAAY,EAAE,qBAAqB,IAAI,CAAC;KACrE,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,IAAI;KACF,MAAM,2BAA2B,MAAM,SAAS,OAAO,MAAM;MAC3D;MACA,GAAI,gBAAgB,KAAA,IAAY,EAAE,qBAAqB,YAAY,IAAI,CAAC;MACxE;MACA,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;KAC3C,CAAC;IACH,SAAS,KAAK;KACZ,MAAM,yBAAyB,OAAO,MAAM,GAAG;KAC/C,MAAM;IACR;GACF,CAAC;EACH;EAEA,KAAK,QAAoB,kBAAsC;GAC7D,OAAO,YAAY,QAAQ,GAAG,eAAe,kBAAkB;EACjE;EAEA,WAAW,QAAoB,MAA8B;GAC3D,OAAO,YAAY,QAAQ,2BAA2B,cAAc,IAAI,CAAC;EAC3E;EAEA,KAAK,MAA0B;GAC7B,MAAM,SAAS,SAAS,UAAU,WAAW;GAC7C,aAAa,QAAQ,MAAM;GAE3B,OAAO,IAAI,WAAW,MAAM,OAAO,UAAU,WAAW;IACtD,MAAM,OAAO,SACX,GAAG,eAAe,QAClB,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAC9C;GACF,CAAC;EACH;EAEA,WAAW,MAA8B;GACvC,MAAM,SAAS,SAAS,UAAU,WAAW;GAC7C,aAAa,QAAQ,MAAM;GAC3B,MAAM,aAAa,2BAA2B,cAAc,IAAI;GAEhE,OAAO,IAAI,WAAW,KAAK,cAAc,OAAO,UAAU,WAAW;IACnE,MAAM,OAAO,SAAS,YAAY,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAAC;GACjF,CAAC;EACH;EAEA,aAAa,MAA8B;GACzC,MAAM,SAAS,SAAS,UAAU,WAAW;GAC7C,aAAa,QAAQ,QAAQ;GAU7B,MAAM,aAAa,2BAA2B,cAAc,IAAI;GAChE,OAAO,IAAI,mBACT,KAAK,cACL,KAAK,gBAAgB,QACrB,OAAO,UAAQ,WAAW,WAAW;IACnC,MAAM,OAAO,kBACX,YACA,OAAS,QAAM,GACf,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAC9C;GACF,CACF;EACF;EAEA,YAAY,MAAiC;GAC3C,MAAM,cAAc,kBAAkB;GACtC,MAAM,OAAO,aAAa,QAAQ,cAAc,WAAW,IAAI;GAC/D,OAAO,IAAI,kBACT,KAAK,cACL,KAAK,cACL,OAAO,SAAS,WAAW;IACzB,QAAQ,eAAe;IACvB,IAAI,YAAY,KAAK,cACnB,MAAM,IAAI,MAAM,yCAAyC,KAAK,cAAc;IAE9E,QAAQ,eAAe;IACvB,IAAI;KACF,IAAI,gBAAgB,KAAA,GAClB,MAAM,8BAA8B,aAAa,KAAK,cAAc,EAClE,kBAAkB,MACpB,CAAC;KAEH,MAAM,0BAA0B,MAAM,IAAI;IAC5C,SAAS,KAAK;KACZ,IAAI,yBAAyB,GAAG,GAAG,MAAM;KACzC,MAAM,IAAI,MAAM,gCAAgC,2BAA2B,GAAG,GAAG;IACnF;GACF,CACF;EACF;EAEA,aAAa,MAA8B;GAKzC,OAAO,iBACF,QAAQ,aAAa,IAAI,KAAK,QAAQ,KAAK,KAAK,YAAY,IAC7D,QAAQ,aAAa,IAAI;EAC/B;CACF;CAEA,SAAS,YAAY,QAAoB,YAAgC;EACvE,MAAM,SAAS,SAAS;EACxB,aAAa,QAAQ,MAAM;EAE3B,OAAO,IAAI,WAAW,OAAO,cAAc,OAAO,MAAM,OAAO,UAAU,WAAW;GAClF,IAAI,mBAAmB,KAAA,GAAW,2BAA2B,gBAAgB,QAAQ,MAAM;GAC3F,MAAM,kCACJ,OAAO,QAAQ,oBAAoB,oBAAoB,YAAY,OAAO,IAAI;GAChF,MAAM,6BAA6B,wBACjC,OAAO,QAAQ,oBAAoB,sBAAsB,OAAO,eAAe,CACjF;GACA,MAAM,OAAO,SAAS;IACpB,cAAc,OAAO,gBAAgB;IACrC,UAAU;IACV,GAAI,oCAAoC,KAAA,IACpC,EAAE,gCAAgC,IAClC,CAAC;IACL,GAAI,+BAA+B,KAAA,IAAY,EAAE,2BAA2B,IAAI,CAAC;IACjF,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;GAC3C,CAAC;EACH,CAAC;CACH;CAEA,OAAO;AACT;AAEA,eAAe,gCACb,QACA,cACwB;CACxB,IAAI;EACF,MAAM,aAAa,MAAM,WAAW,SAAS,YAAY;EACzD,MAAM,yBAAyB;GAAE,GAAG;GAAQ;EAAa,CAAC;EAC1D,OAAO;CACT,SAAS,KAAK;EACZ,MAAM,gCAAgC,GAAG;CAC3C;AACF;AAEA,SAAS,gCAAgC,KAAqB;CAC5D,IAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,kCAAkC,GACnF,OAAO;CAET,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC/D,IAAI,QAAQ,SAAS,oBAAoB,GACvC,uBAAO,IAAI,MAAM,sDAAsD;CAEzE,IAAI,QAAQ,SAAS,SAAS,KAAK,QAAQ,SAAS,UAAU,GAC5D,uBAAO,IAAI,MAAM,kCAAkC;CAErD,uBAAO,IAAI,MAAM,qCAAqC,oBAAoB,GAAG,GAAG;AAClF;AAEA,SAAS,cAAc,QAA6C;CAClE,OAAO,QAAQ,SAAS,UAAU,OAAO,OAAO;AAClD;AAEA,SAAS,kBAAkB,QAAoD;CAC7E,IAAI,QAAQ,SAAS,MAAM,OAAO,KAAA;CAClC,MAAM,YAAa,OAAwB;CAC3C,OAAO,OAAO,cAAc,WAAW,YAAY,KAAA;AACrD;AAEA,SAAS,2BAA2B,MAAgB,QAAkC;CACpF,MAAM,CAAC,UAAU;CACjB,IAAI,OAAO,OAAO,SAAS,QAAQ,WAAW,QAAQ,CAAC,aAAa,MAAM,GAAG;CAC7E,MAAM,eAAe,kBAAkB,OAAO,MAAM;CACpD,IAAI,iBAAiB,KAAA,GAAW;CAChC,2BAA2B,cAAc,QAAQ,MAAM;AACzD;AAEA,SAAS,sBAAsB,QAA+C;CAC5E,MAAM,WAAqB,CAAC;CAC5B,MAAM,eAAe,kBAAkB,OAAO,MAAM;CACpD,IAAI,OAAO,OAAO,SAAS,MAAM,SAAS,KAAK,gBAAgB,EAAE;CAEjE,MAAM,WAAW;CACjB,IAAI,OAAO,KAAK,SAAS,MACvB,SAAS,KAAK,SAAS,UAAU,kBAAkB,OAAO,IAAI,KAAK,EAAE;CAGvE,OAAO,CAAC,GAAG,IAAI,IAAI,SAAS,KAAK,WAAW,iBAAiB,MAAM,CAAC,CAAC,CAAC;AACxE;AAEA,SAAS,8BACP,UACA,MACA,WACQ;CACR,IAAI,6BAAa,IAAI,MAAM,eAAe,UAAU,WAAW,KAAK,cAAc;CAClF,KAAK,MAAM,UAAU,UACnB,IAAI;EACF,OAAO,2BAA2B,QAAQ,MAAM,SAAS;CAC3D,SAAS,KAAK;EACZ,IAAI,eAAe,OAAO,aAAa;CACzC;CAEF,MAAM;AACR;AAEA,SAAS,2BACP,QACA,MACA,YAAY,UACJ;CACR,MAAM,WAAW,KAAK,gBAAgB;CACtC,IAAI,CAAC,SAAS,WAAW,MAAM,GAC7B,MAAM,IAAI,MACR,eAAe,UAAU,qCAAqC,KAAK,cACrE;CAIF,IADqB,+BAA+B,QAAQ,QACxD,MAAiB,KAAK,cACxB,MAAM,IAAI,MACR,eAAe,UAAU,oCAAoC,KAAK,cACpE;CAGF,OAAO;AACT;AAEA,SAAS,aAAa,MAAoC;CACxD,OAAO,qBAAqB;AAC9B;AAEA,SAAS,eAAe,QAAuC;CAC7D,IAAI,QAAQ,YAAY,MACtB,MAAM,OAAO,UAAU,IAAI,aAAa,WAAW,YAAY;AAEnE;AAEA,eAAe,yBACb,MACA,QACe;CACf,IAAI,KAAK,QAAQ;CACjB,IAAI;EACF,MAAM,KAAK,OAAO,MAAM;CAC1B,QAAQ,CAER;AACF;AAEA,eAAe,8BACb,SACA,cACA,SACe;CACf,IAAI,QAAQ,aAAa,KAAA,GAAW;CAEpC,MAAM,EAAE,OAAO,UAAU,SAAS,MAAM,OAAO;CAC/C,IAAI;CACJ,IAAI;EACF,MAAM,gBAAgB,MAAM,MAAM,QAAQ,IAAI;EAC9C,IAAI,CAAC,QAAQ,oBAAoB,cAAc,eAAe,GAC5D,MAAM,IAAI,MAAM,iDAAiD,cAAc;EAEjF,kBAAkB,MAAM,SAAS,QAAQ,IAAI;CAC/C,SAAS,KAAK;EACZ,IAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,8BAA8B,GAAG,MAAM;EAC1F,MAAM,IAAI,MAAM,qDAAqD,cAAc;CACrF;CAEA,IAAI,oBAAoB,QAAQ,UAC9B,MAAM,IAAI,MAAM,qDAAqD,cAAc;CAGrF,IAAI;CACJ,IAAI;EACF,eAAe,MAAM,KAAK,QAAQ,QAAQ;CAC5C,QAAQ;EACN,MAAM,IAAI,MAAM,qDAAqD,cAAc;CACrF;CAEA,IACE,CAAC,aAAa,YAAY,KAC1B,aAAa,QAAQ,QAAQ,SAAS,YACtC,aAAa,QAAQ,QAAQ,SAAS,OAEtC,MAAM,IAAI,MAAM,qDAAqD,cAAc;AAEvF;AAEA,eAAe,6BAA6B,MAAc,cAAqC;CAC7F,IAAI,SAAS,IACX,MAAM,IAAI,MAAM,kDAAkD;CAGpE,MAAM,EAAE,OAAO,UAAU,MAAM,OAAO;CACtC,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,MAAM,WAAW,QAAQ,IAAI;CAE7B,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,QAAQ;EAClC,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,iDAAiD,cAAc;EAEjF,IAAI,CAAC,MAAM,YAAY,GACrB,MAAM,IAAI,MAAM,uCAAuC,cAAc;EAEvE;CACF,SAAS,OAAO;EACd,IAAI,CAAC,gBAAgB,KAAK,GAAG,MAAM;CACrC;CAEA,MAAM,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;CACzC,MAAM,4BAA4B,UAAU,YAAY;AAC1D;AAEA,SAAS,gBACP,QACA,OACA,WACA,UACM;CACN,IAAI,MAAM,SAAS,UAAU,MAAM,WAAW,oBAC5C,OAAO,gCAAgC,MAAM;CAE/C,IAAI,mCAAmC,OAAO,WAAW,QAAQ,GAC/D,OAAO,qCAAqC,iCAAiC,SAAS;CAExF,IAAI,OAAO,OAAO,SAAS,0BACzB,OAAO,OAAO,KAAK,KAAK;MAExB,OAAO;AAEX;AAEA,UAAU,gBAAgB,QAA+C;CACvE,OAAO,OAAO,OAAO,SAAS,GAAG;EAC/B,MAAM,QAAQ,OAAO,OAAO,MAAM;EAClC,IAAI,OAAO,MAAM;CACnB;CAEA,IAAI,OAAO,UAAU,GAAG;EACtB,MAAM;GACJ,MAAM;GACN,MAAM;GACN,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,OAAO,QAAQ,4CAA4C,yBAAyB;EAClG;EACA,OAAO,UAAU;CACnB;AACF;AAEA,SAAS,uBAAuB,YAAsC;CACpE,OAAO,WAAW,gCAAgC,KAAA;AACpD;AAEA,SAAS,0BAA0B,YAAsC;CACvE,OAAO,WAAW,qCAAqC,KAAA;AACzD;AAEA,SAAS,oBAAoB,YAAgD;CAC3E,OAAO,WAAW,gCAAgC,KAAA,IAC9C,KAAA,IACA,IAAI,MAAM,WAAW,2BAA2B;AACtD;AAEA,SAAS,mCACP,OACA,WACA,UACwB;CACxB,IAAI,aAAa,YAAY,MAAM,SAAS,QAAQ,OAAO;CAE3D,IAAI,cAAc,eAChB,OACE,MAAM,WAAW,iBACjB,MAAM,WAAW,4BACjB,MAAM,WAAW;CAIrB,IAAI,cAAc,iBAAiB,cAAc,YAC/C,OACE,MAAM,WAAW,iBACjB,MAAM,WAAW,uBACjB,MAAM,WAAW,6BACjB,MAAM,WAAW,0BACjB,MAAM,WAAW;CAIrB,OAAO;AACT;AAEA,SAAS,iCAAiC,WAAkC;CAC1E,OAAO,cAAc,gBACjB,4DACA;AACN;AAEA,SAAS,yBAAyB,KAAuB;CACvD,IAAI,EAAE,eAAe,QAAQ,OAAO;CACpC,OACE,IAAI,YAAY,sDAChB,IAAI,QAAQ,WAAW,oDAAoD,KAC3E,IAAI,QAAQ,WAAW,cAAc,KACrC,IAAI,QAAQ,WAAW,sCAAsC,KAC7D,IAAI,QAAQ,WAAW,4BAA4B;AAEvD;AAEA,eAAe,0BACb,MACA,cACA,cACiB;CACjB,IAAI,SAAS,IACX,MAAM,IAAI,MAAM,kDAAkD;CAGpE,MAAM,EAAE,YAAY,UAAU,SAAS,QAAQ,MAAM,OAAO;CAC5D,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,SACJ,iBAAiB,KAAA,IAAY,QAAQ,UAAU,YAAY,IAAI,QAAQ,YAAY;CACrF,MAAM,eAAe,SAAS,UAAU,MAAM;;CAK9C,IAHE,iBAAiB,QAAQ,aAAa,WAAW,KAAK,KAAK,KAAK,WAAW,YAAY,GAIvF,MAAM,IAAI,MAAM,8CAA8C,cAAc;CAG9E,MAAM,4BAA4B,UAAU,YAAY;CACxD,MAAM,iCAAiC,UAAU,cAAc,YAAY;CAE3E,OAAO;AACT;AAEA,eAAe,4BAA4B,UAAkB,cAAqC;CAChG,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,IAAI;EAEF,KAAI,MADgB,MAAM,QAAQ,EAAA,CACxB,eAAe,GACvB,MAAM,IAAI,MAAM,iDAAiD,cAAc;CAEnF,SAAS,OAAO;EACd,IAAI,gBAAgB,KAAK,GAAG;EAC5B,MAAM;CACR;AACF;AAEA,eAAe,iCACb,UACA,cACA,cACe;CACf,IAAI,iBAAiB,IAAI;CAEzB,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,MAAM,EAAE,MAAM,QAAQ,MAAM,OAAO;CACnC,IAAI,UAAU;CAEd,KAAK,MAAM,WAAW,aAAa,MAAM,GAAG,GAAG;EAC7C,UAAU,KAAK,SAAS,OAAO;EAC/B,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,MAAM,OAAO;EAC7B,SAAS,OAAO;GACd,IAAI,gBAAgB,KAAK,GAAG;GAC5B,MAAM;EACR;EACA,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,4CAA4C,cAAc;CAE9E;AACF;AAEA,SAAS,gBAAgB,OAAyB;CAChD,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAAsC,SAAS;AAEpD"}

package/dist/types/auth.cjs

@@ -51,6 +51,10 @@ var Capability = {
 	ReadBucketLogging: "readBucketLogging",
 	/** Modify bucket logging settings. */
 	WriteBucketLogging: "writeBucketLogging",
+	/** Read bucket lifecycle rule settings. */
+	ReadBucketLifecycleRules: "readBucketLifecycleRules",
+	/** Modify bucket lifecycle rule settings. */
+	WriteBucketLifecycleRules: "writeBucketLifecycleRules",
 	/** List file names and versions. */
 	ListFiles: "listFiles",
 	/** Download files. */

package/dist/types/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.cjs","names":[],"sources":["../../src/types/auth.ts"],"sourcesContent":["import type { AccountId, AuthToken, BucketId } from './ids.ts'\n\n/**\n * Named constants for the B2 API capabilities that can be granted to an\n * application key. Each capability controls access to a specific set of\n * API operations.\n *\n * Use these when constructing the `capabilities` array for an application\n * key request, or when checking required capabilities via\n * `B2Client.hasCapabilities`.\n *\n * @example\n * ```ts\n * const check = client.hasCapabilities([Capability.WriteFiles, Capability.ReadFiles])\n * if (!check.ok) throw new Error(`missing: ${check.missing.join(', ')}`)\n * ```\n */\nexport const Capability = {\n  /** List application keys. */\n  ListKeys: 'listKeys',\n  /** Create new application keys. */\n  WriteKeys: 'writeKeys',\n  /** Delete application keys. */\n  DeleteKeys: 'deleteKeys',\n  /** List buckets (subject to key restrictions). */\n  ListBuckets: 'listBuckets',\n  /** List bucket names without other metadata. */\n  ListAllBucketNames: 'listAllBucketNames',\n  /** Read bucket settings. */\n  ReadBuckets: 'readBuckets',\n  /** Create and update buckets. */\n  WriteBuckets: 'writeBuckets',\n  /** Remove existing buckets from the account. */\n  DeleteBuckets: 'deleteBuckets',\n  /** Read bucket-level Object Lock retention settings. */\n  ReadBucketRetentions: 'readBucketRetentions',\n  /** Modify bucket-level Object Lock retention settings. */\n  WriteBucketRetentions: 'writeBucketRetentions',\n  /** Read default bucket encryption settings. */\n  ReadBucketEncryption: 'readBucketEncryption',\n  /** Modify default bucket encryption settings. */\n  WriteBucketEncryption: 'writeBucketEncryption',\n  /** Read bucket replication configuration. */\n  ReadBucketReplications: 'readBucketReplications',\n  /** Modify bucket replication configuration. */\n  WriteBucketReplications: 'writeBucketReplications',\n  /** Read bucket event-notification rules. */\n  ReadBucketNotifications: 'readBucketNotifications',\n  /** Modify bucket event-notification rules. */\n  WriteBucketNotifications: 'writeBucketNotifications',\n  /** Read bucket logging settings. */\n  ReadBucketLogging: 'readBucketLogging',\n  /** Modify bucket logging settings. */\n  WriteBucketLogging: 'writeBucketLogging',\n  /** List file names and versions. */\n  ListFiles: 'listFiles',\n  /** Download files. */\n  ReadFiles: 'readFiles',\n  /** Mint download authorisation tokens. */\n  ShareFiles: 'shareFiles',\n  /** Upload files. */\n  WriteFiles: 'writeFiles',\n  /** Delete file versions. */\n  DeleteFiles: 'deleteFiles',\n  /** Read per-file legal hold flags. */\n  ReadFileLegalHolds: 'readFileLegalHolds',\n  /** Modify per-file legal hold flags. */\n  WriteFileLegalHolds: 'writeFileLegalHolds',\n  /** Read per-file Object Lock retention settings. */\n  ReadFileRetentions: 'readFileRetentions',\n  /** Modify per-file Object Lock retention settings. */\n  WriteFileRetentions: 'writeFileRetentions',\n  /** Shorten governance-mode retention. */\n  BypassGovernance: 'bypassGovernance',\n} as const\n\n/**\n * A B2 API capability that can be granted to an application key. Derived\n * from {@link Capability}.\n */\nexport type Capability = (typeof Capability)[keyof typeof Capability]\n\n/** Bucket restriction entry returned by v4 `b2_authorize_account`. */\nexport interface AllowedBucket {\n  /** Bucket ID the key can access. */\n  readonly id: BucketId\n  /** Bucket name when available, or null when B2 does not include it. */\n  readonly name: string | null\n}\n\n/** Describes the capabilities and scope restrictions of an authorized application key. */\nexport interface AllowedInfo {\n  /** List of capabilities granted to this key. */\n  readonly capabilities: readonly Capability[]\n  /** Bucket restrictions for v4 authorization, or null if unrestricted. */\n  readonly buckets: readonly AllowedBucket[] | null\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** File name prefix this key is restricted to, or null if unrestricted. */\n  readonly namePrefix: string | null\n}\n\n/** Configuration for the B2 Cloud Storage API returned during authorization. */\nexport interface StorageApiInfo {\n  /** Minimum allowed part size for large file uploads, in bytes. */\n  readonly absoluteMinimumPartSize: number\n  /** Base URL for B2 API calls. */\n  readonly apiUrl: string\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** Base URL for file downloads. */\n  readonly downloadUrl: string\n  /**\n   * Discriminator indicating this is storage API info. Always `'storageApi'`.\n   *\n   * @deprecated Removed from the v4 wire shape but normalized by the SDK for\n   * compatibility.\n   */\n  readonly infoType: 'storageApi'\n  /**\n   * File name prefix this key is restricted to, or null if unrestricted.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.namePrefix`; use `allowed.namePrefix` instead.\n   */\n  readonly namePrefix: string | null\n  /** Recommended part size for large file uploads, in bytes. */\n  readonly recommendedPartSize: number\n  /** Base URL for the S3-compatible API. */\n  readonly s3ApiUrl: string\n  /** Capabilities and scope of the authorized key. */\n  readonly allowed: AllowedInfo\n}\n\n/** Configuration for the B2 Groups API returned during authorization. */\nexport interface GroupsApiInfo {\n  /** Base URL for Groups API calls. */\n  readonly groupsApiUrl: string\n  /** Discriminator indicating this is groups API info. Always `'groupsApi'`. */\n  readonly infoType: 'groupsApi'\n}\n\n/** Container for all API-specific configuration returned by `b2_authorize_account`. */\nexport interface ApiInfo {\n  /** Storage API configuration (always present). */\n  readonly storageApi: StorageApiInfo\n  /** Groups API configuration (present only when the account has groups enabled). */\n  readonly groupsApi?: GroupsApiInfo\n}\n\n/**\n * Normalized SDK-facing response from the `b2_authorize_account` API call.\n * The SDK uses the v4 endpoint and preserves deprecated v3 compatibility\n * aliases such as `storageApi.bucketId` and `allowed.bucketId`.\n */\nexport interface AuthorizeAccountResponse {\n  /** The account ID for the authorized account. */\n  readonly accountId: AccountId\n  /** Authorization token to use in subsequent API calls. */\n  readonly authorizationToken: AuthToken\n  /** API-specific configuration including endpoint URLs and key scope. */\n  readonly apiInfo: ApiInfo\n  /** Expiration timestamp of the application key in milliseconds, or null if the key does not expire. */\n  readonly applicationKeyExpirationTimestamp: number | null\n}\n\n/**\n * Request parameters for the `b2_authorize_account` API call.\n * Credentials are sent via HTTP Basic auth in the raw API, but represented here as fields.\n */\nexport interface AuthorizeAccountRequest {\n  /** The application key ID (account ID or app key ID). */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /**\n   * Optional realm override. Accepts a known realm-map key (`\"production\"` or\n   * `\"staging\"`) or a direct base URL. Custom HTTPS hosts are trusted with the\n   * application key during authorize, so never derive this value from untrusted\n   * input. URL values must use HTTPS, or loopback IP literal HTTP for local\n   * testing only; application-key credentials are sent unencrypted over\n   * loopback HTTP. Unsupported schemes, malformed URLs, non-URL strings,\n   * plaintext HTTP hostnames such as `localhost`, and non-loopback plaintext\n   * HTTP are rejected before credentials are sent. URL values must not include\n   * userinfo, query strings, or fragments. Defaults to production.\n   */\n  readonly realm?: string\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,IAAa,aAAa;;CAExB,UAAU;;CAEV,WAAW;;CAEX,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,aAAa;;CAEb,cAAc;;CAEd,eAAe;;CAEf,sBAAsB;;CAEtB,uBAAuB;;CAEvB,sBAAsB;;CAEtB,uBAAuB;;CAEvB,wBAAwB;;CAExB,yBAAyB;;CAEzB,yBAAyB;;CAEzB,0BAA0B;;CAE1B,mBAAmB;;CAEnB,oBAAoB;;CAEpB,WAAW;;CAEX,WAAW;;CAEX,YAAY;;CAEZ,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,qBAAqB;;CAErB,oBAAoB;;CAEpB,qBAAqB;;CAErB,kBAAkB;AACpB"}
+{"version":3,"file":"auth.cjs","names":[],"sources":["../../src/types/auth.ts"],"sourcesContent":["import type { AccountId, AuthToken, BucketId } from './ids.ts'\n\n/**\n * Named constants for the B2 API capabilities that can be granted to an\n * application key. Each capability controls access to a specific set of\n * API operations.\n *\n * Use these when constructing the `capabilities` array for an application\n * key request, or when checking required capabilities via\n * `B2Client.hasCapabilities`.\n *\n * @example\n * ```ts\n * const check = client.hasCapabilities([Capability.WriteFiles, Capability.ReadFiles])\n * if (!check.ok) throw new Error(`missing: ${check.missing.join(', ')}`)\n * ```\n */\nexport const Capability = {\n  /** List application keys. */\n  ListKeys: 'listKeys',\n  /** Create new application keys. */\n  WriteKeys: 'writeKeys',\n  /** Delete application keys. */\n  DeleteKeys: 'deleteKeys',\n  /** List buckets (subject to key restrictions). */\n  ListBuckets: 'listBuckets',\n  /** List bucket names without other metadata. */\n  ListAllBucketNames: 'listAllBucketNames',\n  /** Read bucket settings. */\n  ReadBuckets: 'readBuckets',\n  /** Create and update buckets. */\n  WriteBuckets: 'writeBuckets',\n  /** Remove existing buckets from the account. */\n  DeleteBuckets: 'deleteBuckets',\n  /** Read bucket-level Object Lock retention settings. */\n  ReadBucketRetentions: 'readBucketRetentions',\n  /** Modify bucket-level Object Lock retention settings. */\n  WriteBucketRetentions: 'writeBucketRetentions',\n  /** Read default bucket encryption settings. */\n  ReadBucketEncryption: 'readBucketEncryption',\n  /** Modify default bucket encryption settings. */\n  WriteBucketEncryption: 'writeBucketEncryption',\n  /** Read bucket replication configuration. */\n  ReadBucketReplications: 'readBucketReplications',\n  /** Modify bucket replication configuration. */\n  WriteBucketReplications: 'writeBucketReplications',\n  /** Read bucket event-notification rules. */\n  ReadBucketNotifications: 'readBucketNotifications',\n  /** Modify bucket event-notification rules. */\n  WriteBucketNotifications: 'writeBucketNotifications',\n  /** Read bucket logging settings. */\n  ReadBucketLogging: 'readBucketLogging',\n  /** Modify bucket logging settings. */\n  WriteBucketLogging: 'writeBucketLogging',\n  /** Read bucket lifecycle rule settings. */\n  ReadBucketLifecycleRules: 'readBucketLifecycleRules',\n  /** Modify bucket lifecycle rule settings. */\n  WriteBucketLifecycleRules: 'writeBucketLifecycleRules',\n  /** List file names and versions. */\n  ListFiles: 'listFiles',\n  /** Download files. */\n  ReadFiles: 'readFiles',\n  /** Mint download authorisation tokens. */\n  ShareFiles: 'shareFiles',\n  /** Upload files. */\n  WriteFiles: 'writeFiles',\n  /** Delete file versions. */\n  DeleteFiles: 'deleteFiles',\n  /** Read per-file legal hold flags. */\n  ReadFileLegalHolds: 'readFileLegalHolds',\n  /** Modify per-file legal hold flags. */\n  WriteFileLegalHolds: 'writeFileLegalHolds',\n  /** Read per-file Object Lock retention settings. */\n  ReadFileRetentions: 'readFileRetentions',\n  /** Modify per-file Object Lock retention settings. */\n  WriteFileRetentions: 'writeFileRetentions',\n  /** Shorten governance-mode retention. */\n  BypassGovernance: 'bypassGovernance',\n} as const\n\n/**\n * A B2 API capability that can be granted to an application key. Derived\n * from {@link Capability}.\n */\nexport type Capability = (typeof Capability)[keyof typeof Capability]\n\n/** Bucket restriction entry returned by v4 `b2_authorize_account`. */\nexport interface AllowedBucket {\n  /** Bucket ID the key can access. */\n  readonly id: BucketId\n  /** Bucket name when available, or null when B2 does not include it. */\n  readonly name: string | null\n}\n\n/** Describes the capabilities and scope restrictions of an authorized application key. */\nexport interface AllowedInfo {\n  /** List of capabilities granted to this key. */\n  readonly capabilities: readonly Capability[]\n  /** Bucket restrictions for v4 authorization, or null if unrestricted. */\n  readonly buckets: readonly AllowedBucket[] | null\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** File name prefix this key is restricted to, or null if unrestricted. */\n  readonly namePrefix: string | null\n}\n\n/** Configuration for the B2 Cloud Storage API returned during authorization. */\nexport interface StorageApiInfo {\n  /** Minimum allowed part size for large file uploads, in bytes. */\n  readonly absoluteMinimumPartSize: number\n  /** Base URL for B2 API calls. */\n  readonly apiUrl: string\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** Base URL for file downloads. */\n  readonly downloadUrl: string\n  /**\n   * Discriminator indicating this is storage API info. Always `'storageApi'`.\n   *\n   * @deprecated Removed from the v4 wire shape but normalized by the SDK for\n   * compatibility.\n   */\n  readonly infoType: 'storageApi'\n  /**\n   * File name prefix this key is restricted to, or null if unrestricted.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.namePrefix`; use `allowed.namePrefix` instead.\n   */\n  readonly namePrefix: string | null\n  /** Recommended part size for large file uploads, in bytes. */\n  readonly recommendedPartSize: number\n  /** Base URL for the S3-compatible API. */\n  readonly s3ApiUrl: string\n  /** Capabilities and scope of the authorized key. */\n  readonly allowed: AllowedInfo\n}\n\n/** Configuration for the B2 Groups API returned during authorization. */\nexport interface GroupsApiInfo {\n  /** Base URL for Groups API calls. */\n  readonly groupsApiUrl: string\n  /** Discriminator indicating this is groups API info. Always `'groupsApi'`. */\n  readonly infoType: 'groupsApi'\n}\n\n/** Container for all API-specific configuration returned by `b2_authorize_account`. */\nexport interface ApiInfo {\n  /** Storage API configuration (always present). */\n  readonly storageApi: StorageApiInfo\n  /** Groups API configuration (present only when the account has groups enabled). */\n  readonly groupsApi?: GroupsApiInfo\n}\n\n/**\n * Normalized SDK-facing response from the `b2_authorize_account` API call.\n * The SDK uses the v4 endpoint and preserves deprecated v3 compatibility\n * aliases such as `storageApi.bucketId` and `allowed.bucketId`.\n */\nexport interface AuthorizeAccountResponse {\n  /** The account ID for the authorized account. */\n  readonly accountId: AccountId\n  /** Authorization token to use in subsequent API calls. */\n  readonly authorizationToken: AuthToken\n  /** API-specific configuration including endpoint URLs and key scope. */\n  readonly apiInfo: ApiInfo\n  /** Expiration timestamp of the application key in milliseconds, or null if the key does not expire. */\n  readonly applicationKeyExpirationTimestamp: number | null\n}\n\n/**\n * Request parameters for the `b2_authorize_account` API call.\n * Credentials are sent via HTTP Basic auth in the raw API, but represented here as fields.\n */\nexport interface AuthorizeAccountRequest {\n  /** The application key ID (account ID or app key ID). */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /**\n   * Optional realm override. Accepts a known realm-map key (`\"production\"` or\n   * `\"staging\"`) or a direct base URL. Custom HTTPS hosts are trusted with the\n   * application key during authorize, so never derive this value from untrusted\n   * input. URL values must use HTTPS, or loopback IP literal HTTP for local\n   * testing only; application-key credentials are sent unencrypted over\n   * loopback HTTP. Unsupported schemes, malformed URLs, non-URL strings,\n   * plaintext HTTP hostnames such as `localhost`, and non-loopback plaintext\n   * HTTP are rejected before credentials are sent. URL values must not include\n   * userinfo, query strings, or fragments. Defaults to production.\n   */\n  readonly realm?: string\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,IAAa,aAAa;;CAExB,UAAU;;CAEV,WAAW;;CAEX,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,aAAa;;CAEb,cAAc;;CAEd,eAAe;;CAEf,sBAAsB;;CAEtB,uBAAuB;;CAEvB,sBAAsB;;CAEtB,uBAAuB;;CAEvB,wBAAwB;;CAExB,yBAAyB;;CAEzB,yBAAyB;;CAEzB,0BAA0B;;CAE1B,mBAAmB;;CAEnB,oBAAoB;;CAEpB,0BAA0B;;CAE1B,2BAA2B;;CAE3B,WAAW;;CAEX,WAAW;;CAEX,YAAY;;CAEZ,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,qBAAqB;;CAErB,oBAAoB;;CAEpB,qBAAqB;;CAErB,kBAAkB;AACpB"}

package/dist/types/auth.d.cts

@@ -51,6 +51,10 @@ export declare const Capability: {
     readonly ReadBucketLogging: "readBucketLogging";
     /** Modify bucket logging settings. */
     readonly WriteBucketLogging: "writeBucketLogging";
+    /** Read bucket lifecycle rule settings. */
+    readonly ReadBucketLifecycleRules: "readBucketLifecycleRules";
+    /** Modify bucket lifecycle rule settings. */
+    readonly WriteBucketLifecycleRules: "writeBucketLifecycleRules";
     /** List file names and versions. */
     readonly ListFiles: "listFiles";
     /** Download files. */

package/dist/types/auth.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/types/auth.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAE9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU;IACrB,6BAA6B;;IAE7B,mCAAmC;;IAEnC,+BAA+B;;IAE/B,kDAAkD;;IAElD,gDAAgD;;IAEhD,4BAA4B;;IAE5B,iCAAiC;;IAEjC,gDAAgD;;IAEhD,wDAAwD;;IAExD,0DAA0D;;IAE1D,+CAA+C;;IAE/C,iDAAiD;;IAEjD,6CAA6C;;IAE7C,+CAA+C;;IAE/C,4CAA4C;;IAE5C,8CAA8C;;IAE9C,oCAAoC;;IAEpC,sCAAsC;;IAEtC,oCAAoC;;IAEpC,sBAAsB;;IAEtB,0CAA0C;;IAE1C,oBAAoB;;IAEpB,4BAA4B;;IAE5B,sCAAsC;;IAEtC,wCAAwC;;IAExC,oDAAoD;;IAEpD,sDAAsD;;IAEtD,yCAAyC;;CAEjC,CAAA;AAEV;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAErE,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;IAC5C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAAA;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAA;CAC/B;AAED,uFAAuF;AACvF,MAAM,WAAW,OAAO;IACtB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,uGAAuG;IACvG,QAAQ,CAAC,iCAAiC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1D;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/types/auth.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAE9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU;IACrB,6BAA6B;;IAE7B,mCAAmC;;IAEnC,+BAA+B;;IAE/B,kDAAkD;;IAElD,gDAAgD;;IAEhD,4BAA4B;;IAE5B,iCAAiC;;IAEjC,gDAAgD;;IAEhD,wDAAwD;;IAExD,0DAA0D;;IAE1D,+CAA+C;;IAE/C,iDAAiD;;IAEjD,6CAA6C;;IAE7C,+CAA+C;;IAE/C,4CAA4C;;IAE5C,8CAA8C;;IAE9C,oCAAoC;;IAEpC,sCAAsC;;IAEtC,2CAA2C;;IAE3C,6CAA6C;;IAE7C,oCAAoC;;IAEpC,sBAAsB;;IAEtB,0CAA0C;;IAE1C,oBAAoB;;IAEpB,4BAA4B;;IAE5B,sCAAsC;;IAEtC,wCAAwC;;IAExC,oDAAoD;;IAEpD,sDAAsD;;IAEtD,yCAAyC;;CAEjC,CAAA;AAEV;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAErE,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;IAC5C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAAA;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAA;CAC/B;AAED,uFAAuF;AACvF,MAAM,WAAW,OAAO;IACtB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,uGAAuG;IACvG,QAAQ,CAAC,iCAAiC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1D;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB"}

package/dist/types/auth.d.ts

@@ -51,6 +51,10 @@ export declare const Capability: {
     readonly ReadBucketLogging: "readBucketLogging";
     /** Modify bucket logging settings. */
     readonly WriteBucketLogging: "writeBucketLogging";
+    /** Read bucket lifecycle rule settings. */
+    readonly ReadBucketLifecycleRules: "readBucketLifecycleRules";
+    /** Modify bucket lifecycle rule settings. */
+    readonly WriteBucketLifecycleRules: "writeBucketLifecycleRules";
     /** List file names and versions. */
     readonly ListFiles: "listFiles";
     /** Download files. */

package/dist/types/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/types/auth.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAE9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU;IACrB,6BAA6B;;IAE7B,mCAAmC;;IAEnC,+BAA+B;;IAE/B,kDAAkD;;IAElD,gDAAgD;;IAEhD,4BAA4B;;IAE5B,iCAAiC;;IAEjC,gDAAgD;;IAEhD,wDAAwD;;IAExD,0DAA0D;;IAE1D,+CAA+C;;IAE/C,iDAAiD;;IAEjD,6CAA6C;;IAE7C,+CAA+C;;IAE/C,4CAA4C;;IAE5C,8CAA8C;;IAE9C,oCAAoC;;IAEpC,sCAAsC;;IAEtC,oCAAoC;;IAEpC,sBAAsB;;IAEtB,0CAA0C;;IAE1C,oBAAoB;;IAEpB,4BAA4B;;IAE5B,sCAAsC;;IAEtC,wCAAwC;;IAExC,oDAAoD;;IAEpD,sDAAsD;;IAEtD,yCAAyC;;CAEjC,CAAA;AAEV;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAErE,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;IAC5C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAAA;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAA;CAC/B;AAED,uFAAuF;AACvF,MAAM,WAAW,OAAO;IACtB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,uGAAuG;IACvG,QAAQ,CAAC,iCAAiC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1D;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/types/auth.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAE9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU;IACrB,6BAA6B;;IAE7B,mCAAmC;;IAEnC,+BAA+B;;IAE/B,kDAAkD;;IAElD,gDAAgD;;IAEhD,4BAA4B;;IAE5B,iCAAiC;;IAEjC,gDAAgD;;IAEhD,wDAAwD;;IAExD,0DAA0D;;IAE1D,+CAA+C;;IAE/C,iDAAiD;;IAEjD,6CAA6C;;IAE7C,+CAA+C;;IAE/C,4CAA4C;;IAE5C,8CAA8C;;IAE9C,oCAAoC;;IAEpC,sCAAsC;;IAEtC,2CAA2C;;IAE3C,6CAA6C;;IAE7C,oCAAoC;;IAEpC,sBAAsB;;IAEtB,0CAA0C;;IAE1C,oBAAoB;;IAEpB,4BAA4B;;IAE5B,sCAAsC;;IAEtC,wCAAwC;;IAExC,oDAAoD;;IAEpD,sDAAsD;;IAEtD,yCAAyC;;CAEjC,CAAA;AAEV;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAErE,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAA;IAC5C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAAA;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAA;CAC/B;AAED,uFAAuF;AACvF,MAAM,WAAW,OAAO;IACtB,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAA;IACtC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,uGAAuG;IACvG,QAAQ,CAAC,iCAAiC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1D;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB"}

package/dist/types/auth.js

@@ -51,6 +51,10 @@ var Capability = {
 	ReadBucketLogging: "readBucketLogging",
 	/** Modify bucket logging settings. */
 	WriteBucketLogging: "writeBucketLogging",
+	/** Read bucket lifecycle rule settings. */
+	ReadBucketLifecycleRules: "readBucketLifecycleRules",
+	/** Modify bucket lifecycle rule settings. */
+	WriteBucketLifecycleRules: "writeBucketLifecycleRules",
 	/** List file names and versions. */
 	ListFiles: "listFiles",
 	/** Download files. */

package/dist/types/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../src/types/auth.ts"],"sourcesContent":["import type { AccountId, AuthToken, BucketId } from './ids.ts'\n\n/**\n * Named constants for the B2 API capabilities that can be granted to an\n * application key. Each capability controls access to a specific set of\n * API operations.\n *\n * Use these when constructing the `capabilities` array for an application\n * key request, or when checking required capabilities via\n * `B2Client.hasCapabilities`.\n *\n * @example\n * ```ts\n * const check = client.hasCapabilities([Capability.WriteFiles, Capability.ReadFiles])\n * if (!check.ok) throw new Error(`missing: ${check.missing.join(', ')}`)\n * ```\n */\nexport const Capability = {\n  /** List application keys. */\n  ListKeys: 'listKeys',\n  /** Create new application keys. */\n  WriteKeys: 'writeKeys',\n  /** Delete application keys. */\n  DeleteKeys: 'deleteKeys',\n  /** List buckets (subject to key restrictions). */\n  ListBuckets: 'listBuckets',\n  /** List bucket names without other metadata. */\n  ListAllBucketNames: 'listAllBucketNames',\n  /** Read bucket settings. */\n  ReadBuckets: 'readBuckets',\n  /** Create and update buckets. */\n  WriteBuckets: 'writeBuckets',\n  /** Remove existing buckets from the account. */\n  DeleteBuckets: 'deleteBuckets',\n  /** Read bucket-level Object Lock retention settings. */\n  ReadBucketRetentions: 'readBucketRetentions',\n  /** Modify bucket-level Object Lock retention settings. */\n  WriteBucketRetentions: 'writeBucketRetentions',\n  /** Read default bucket encryption settings. */\n  ReadBucketEncryption: 'readBucketEncryption',\n  /** Modify default bucket encryption settings. */\n  WriteBucketEncryption: 'writeBucketEncryption',\n  /** Read bucket replication configuration. */\n  ReadBucketReplications: 'readBucketReplications',\n  /** Modify bucket replication configuration. */\n  WriteBucketReplications: 'writeBucketReplications',\n  /** Read bucket event-notification rules. */\n  ReadBucketNotifications: 'readBucketNotifications',\n  /** Modify bucket event-notification rules. */\n  WriteBucketNotifications: 'writeBucketNotifications',\n  /** Read bucket logging settings. */\n  ReadBucketLogging: 'readBucketLogging',\n  /** Modify bucket logging settings. */\n  WriteBucketLogging: 'writeBucketLogging',\n  /** List file names and versions. */\n  ListFiles: 'listFiles',\n  /** Download files. */\n  ReadFiles: 'readFiles',\n  /** Mint download authorisation tokens. */\n  ShareFiles: 'shareFiles',\n  /** Upload files. */\n  WriteFiles: 'writeFiles',\n  /** Delete file versions. */\n  DeleteFiles: 'deleteFiles',\n  /** Read per-file legal hold flags. */\n  ReadFileLegalHolds: 'readFileLegalHolds',\n  /** Modify per-file legal hold flags. */\n  WriteFileLegalHolds: 'writeFileLegalHolds',\n  /** Read per-file Object Lock retention settings. */\n  ReadFileRetentions: 'readFileRetentions',\n  /** Modify per-file Object Lock retention settings. */\n  WriteFileRetentions: 'writeFileRetentions',\n  /** Shorten governance-mode retention. */\n  BypassGovernance: 'bypassGovernance',\n} as const\n\n/**\n * A B2 API capability that can be granted to an application key. Derived\n * from {@link Capability}.\n */\nexport type Capability = (typeof Capability)[keyof typeof Capability]\n\n/** Bucket restriction entry returned by v4 `b2_authorize_account`. */\nexport interface AllowedBucket {\n  /** Bucket ID the key can access. */\n  readonly id: BucketId\n  /** Bucket name when available, or null when B2 does not include it. */\n  readonly name: string | null\n}\n\n/** Describes the capabilities and scope restrictions of an authorized application key. */\nexport interface AllowedInfo {\n  /** List of capabilities granted to this key. */\n  readonly capabilities: readonly Capability[]\n  /** Bucket restrictions for v4 authorization, or null if unrestricted. */\n  readonly buckets: readonly AllowedBucket[] | null\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** File name prefix this key is restricted to, or null if unrestricted. */\n  readonly namePrefix: string | null\n}\n\n/** Configuration for the B2 Cloud Storage API returned during authorization. */\nexport interface StorageApiInfo {\n  /** Minimum allowed part size for large file uploads, in bytes. */\n  readonly absoluteMinimumPartSize: number\n  /** Base URL for B2 API calls. */\n  readonly apiUrl: string\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** Base URL for file downloads. */\n  readonly downloadUrl: string\n  /**\n   * Discriminator indicating this is storage API info. Always `'storageApi'`.\n   *\n   * @deprecated Removed from the v4 wire shape but normalized by the SDK for\n   * compatibility.\n   */\n  readonly infoType: 'storageApi'\n  /**\n   * File name prefix this key is restricted to, or null if unrestricted.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.namePrefix`; use `allowed.namePrefix` instead.\n   */\n  readonly namePrefix: string | null\n  /** Recommended part size for large file uploads, in bytes. */\n  readonly recommendedPartSize: number\n  /** Base URL for the S3-compatible API. */\n  readonly s3ApiUrl: string\n  /** Capabilities and scope of the authorized key. */\n  readonly allowed: AllowedInfo\n}\n\n/** Configuration for the B2 Groups API returned during authorization. */\nexport interface GroupsApiInfo {\n  /** Base URL for Groups API calls. */\n  readonly groupsApiUrl: string\n  /** Discriminator indicating this is groups API info. Always `'groupsApi'`. */\n  readonly infoType: 'groupsApi'\n}\n\n/** Container for all API-specific configuration returned by `b2_authorize_account`. */\nexport interface ApiInfo {\n  /** Storage API configuration (always present). */\n  readonly storageApi: StorageApiInfo\n  /** Groups API configuration (present only when the account has groups enabled). */\n  readonly groupsApi?: GroupsApiInfo\n}\n\n/**\n * Normalized SDK-facing response from the `b2_authorize_account` API call.\n * The SDK uses the v4 endpoint and preserves deprecated v3 compatibility\n * aliases such as `storageApi.bucketId` and `allowed.bucketId`.\n */\nexport interface AuthorizeAccountResponse {\n  /** The account ID for the authorized account. */\n  readonly accountId: AccountId\n  /** Authorization token to use in subsequent API calls. */\n  readonly authorizationToken: AuthToken\n  /** API-specific configuration including endpoint URLs and key scope. */\n  readonly apiInfo: ApiInfo\n  /** Expiration timestamp of the application key in milliseconds, or null if the key does not expire. */\n  readonly applicationKeyExpirationTimestamp: number | null\n}\n\n/**\n * Request parameters for the `b2_authorize_account` API call.\n * Credentials are sent via HTTP Basic auth in the raw API, but represented here as fields.\n */\nexport interface AuthorizeAccountRequest {\n  /** The application key ID (account ID or app key ID). */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /**\n   * Optional realm override. Accepts a known realm-map key (`\"production\"` or\n   * `\"staging\"`) or a direct base URL. Custom HTTPS hosts are trusted with the\n   * application key during authorize, so never derive this value from untrusted\n   * input. URL values must use HTTPS, or loopback IP literal HTTP for local\n   * testing only; application-key credentials are sent unencrypted over\n   * loopback HTTP. Unsupported schemes, malformed URLs, non-URL strings,\n   * plaintext HTTP hostnames such as `localhost`, and non-loopback plaintext\n   * HTTP are rejected before credentials are sent. URL values must not include\n   * userinfo, query strings, or fragments. Defaults to production.\n   */\n  readonly realm?: string\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,IAAa,aAAa;;CAExB,UAAU;;CAEV,WAAW;;CAEX,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,aAAa;;CAEb,cAAc;;CAEd,eAAe;;CAEf,sBAAsB;;CAEtB,uBAAuB;;CAEvB,sBAAsB;;CAEtB,uBAAuB;;CAEvB,wBAAwB;;CAExB,yBAAyB;;CAEzB,yBAAyB;;CAEzB,0BAA0B;;CAE1B,mBAAmB;;CAEnB,oBAAoB;;CAEpB,WAAW;;CAEX,WAAW;;CAEX,YAAY;;CAEZ,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,qBAAqB;;CAErB,oBAAoB;;CAEpB,qBAAqB;;CAErB,kBAAkB;AACpB"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../src/types/auth.ts"],"sourcesContent":["import type { AccountId, AuthToken, BucketId } from './ids.ts'\n\n/**\n * Named constants for the B2 API capabilities that can be granted to an\n * application key. Each capability controls access to a specific set of\n * API operations.\n *\n * Use these when constructing the `capabilities` array for an application\n * key request, or when checking required capabilities via\n * `B2Client.hasCapabilities`.\n *\n * @example\n * ```ts\n * const check = client.hasCapabilities([Capability.WriteFiles, Capability.ReadFiles])\n * if (!check.ok) throw new Error(`missing: ${check.missing.join(', ')}`)\n * ```\n */\nexport const Capability = {\n  /** List application keys. */\n  ListKeys: 'listKeys',\n  /** Create new application keys. */\n  WriteKeys: 'writeKeys',\n  /** Delete application keys. */\n  DeleteKeys: 'deleteKeys',\n  /** List buckets (subject to key restrictions). */\n  ListBuckets: 'listBuckets',\n  /** List bucket names without other metadata. */\n  ListAllBucketNames: 'listAllBucketNames',\n  /** Read bucket settings. */\n  ReadBuckets: 'readBuckets',\n  /** Create and update buckets. */\n  WriteBuckets: 'writeBuckets',\n  /** Remove existing buckets from the account. */\n  DeleteBuckets: 'deleteBuckets',\n  /** Read bucket-level Object Lock retention settings. */\n  ReadBucketRetentions: 'readBucketRetentions',\n  /** Modify bucket-level Object Lock retention settings. */\n  WriteBucketRetentions: 'writeBucketRetentions',\n  /** Read default bucket encryption settings. */\n  ReadBucketEncryption: 'readBucketEncryption',\n  /** Modify default bucket encryption settings. */\n  WriteBucketEncryption: 'writeBucketEncryption',\n  /** Read bucket replication configuration. */\n  ReadBucketReplications: 'readBucketReplications',\n  /** Modify bucket replication configuration. */\n  WriteBucketReplications: 'writeBucketReplications',\n  /** Read bucket event-notification rules. */\n  ReadBucketNotifications: 'readBucketNotifications',\n  /** Modify bucket event-notification rules. */\n  WriteBucketNotifications: 'writeBucketNotifications',\n  /** Read bucket logging settings. */\n  ReadBucketLogging: 'readBucketLogging',\n  /** Modify bucket logging settings. */\n  WriteBucketLogging: 'writeBucketLogging',\n  /** Read bucket lifecycle rule settings. */\n  ReadBucketLifecycleRules: 'readBucketLifecycleRules',\n  /** Modify bucket lifecycle rule settings. */\n  WriteBucketLifecycleRules: 'writeBucketLifecycleRules',\n  /** List file names and versions. */\n  ListFiles: 'listFiles',\n  /** Download files. */\n  ReadFiles: 'readFiles',\n  /** Mint download authorisation tokens. */\n  ShareFiles: 'shareFiles',\n  /** Upload files. */\n  WriteFiles: 'writeFiles',\n  /** Delete file versions. */\n  DeleteFiles: 'deleteFiles',\n  /** Read per-file legal hold flags. */\n  ReadFileLegalHolds: 'readFileLegalHolds',\n  /** Modify per-file legal hold flags. */\n  WriteFileLegalHolds: 'writeFileLegalHolds',\n  /** Read per-file Object Lock retention settings. */\n  ReadFileRetentions: 'readFileRetentions',\n  /** Modify per-file Object Lock retention settings. */\n  WriteFileRetentions: 'writeFileRetentions',\n  /** Shorten governance-mode retention. */\n  BypassGovernance: 'bypassGovernance',\n} as const\n\n/**\n * A B2 API capability that can be granted to an application key. Derived\n * from {@link Capability}.\n */\nexport type Capability = (typeof Capability)[keyof typeof Capability]\n\n/** Bucket restriction entry returned by v4 `b2_authorize_account`. */\nexport interface AllowedBucket {\n  /** Bucket ID the key can access. */\n  readonly id: BucketId\n  /** Bucket name when available, or null when B2 does not include it. */\n  readonly name: string | null\n}\n\n/** Describes the capabilities and scope restrictions of an authorized application key. */\nexport interface AllowedInfo {\n  /** List of capabilities granted to this key. */\n  readonly capabilities: readonly Capability[]\n  /** Bucket restrictions for v4 authorization, or null if unrestricted. */\n  readonly buckets: readonly AllowedBucket[] | null\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `buckets`; use `buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** File name prefix this key is restricted to, or null if unrestricted. */\n  readonly namePrefix: string | null\n}\n\n/** Configuration for the B2 Cloud Storage API returned during authorization. */\nexport interface StorageApiInfo {\n  /** Minimum allowed part size for large file uploads, in bytes. */\n  readonly absoluteMinimumPartSize: number\n  /** Base URL for B2 API calls. */\n  readonly apiUrl: string\n  /**\n   * Bucket ID this key is restricted to when it has exactly one bucket, or null\n   * if unrestricted or multi-bucket.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketId: BucketId | null\n  /**\n   * Bucket name this key is restricted to when it has exactly one bucket, or\n   * null if unrestricted, multi-bucket, or unknown.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.buckets`; use `allowed.buckets` instead.\n   */\n  readonly bucketName: string | null\n  /** Base URL for file downloads. */\n  readonly downloadUrl: string\n  /**\n   * Discriminator indicating this is storage API info. Always `'storageApi'`.\n   *\n   * @deprecated Removed from the v4 wire shape but normalized by the SDK for\n   * compatibility.\n   */\n  readonly infoType: 'storageApi'\n  /**\n   * File name prefix this key is restricted to, or null if unrestricted.\n   *\n   * @deprecated The SDK normalizes this compatibility alias from v4\n   * `allowed.namePrefix`; use `allowed.namePrefix` instead.\n   */\n  readonly namePrefix: string | null\n  /** Recommended part size for large file uploads, in bytes. */\n  readonly recommendedPartSize: number\n  /** Base URL for the S3-compatible API. */\n  readonly s3ApiUrl: string\n  /** Capabilities and scope of the authorized key. */\n  readonly allowed: AllowedInfo\n}\n\n/** Configuration for the B2 Groups API returned during authorization. */\nexport interface GroupsApiInfo {\n  /** Base URL for Groups API calls. */\n  readonly groupsApiUrl: string\n  /** Discriminator indicating this is groups API info. Always `'groupsApi'`. */\n  readonly infoType: 'groupsApi'\n}\n\n/** Container for all API-specific configuration returned by `b2_authorize_account`. */\nexport interface ApiInfo {\n  /** Storage API configuration (always present). */\n  readonly storageApi: StorageApiInfo\n  /** Groups API configuration (present only when the account has groups enabled). */\n  readonly groupsApi?: GroupsApiInfo\n}\n\n/**\n * Normalized SDK-facing response from the `b2_authorize_account` API call.\n * The SDK uses the v4 endpoint and preserves deprecated v3 compatibility\n * aliases such as `storageApi.bucketId` and `allowed.bucketId`.\n */\nexport interface AuthorizeAccountResponse {\n  /** The account ID for the authorized account. */\n  readonly accountId: AccountId\n  /** Authorization token to use in subsequent API calls. */\n  readonly authorizationToken: AuthToken\n  /** API-specific configuration including endpoint URLs and key scope. */\n  readonly apiInfo: ApiInfo\n  /** Expiration timestamp of the application key in milliseconds, or null if the key does not expire. */\n  readonly applicationKeyExpirationTimestamp: number | null\n}\n\n/**\n * Request parameters for the `b2_authorize_account` API call.\n * Credentials are sent via HTTP Basic auth in the raw API, but represented here as fields.\n */\nexport interface AuthorizeAccountRequest {\n  /** The application key ID (account ID or app key ID). */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /**\n   * Optional realm override. Accepts a known realm-map key (`\"production\"` or\n   * `\"staging\"`) or a direct base URL. Custom HTTPS hosts are trusted with the\n   * application key during authorize, so never derive this value from untrusted\n   * input. URL values must use HTTPS, or loopback IP literal HTTP for local\n   * testing only; application-key credentials are sent unencrypted over\n   * loopback HTTP. Unsupported schemes, malformed URLs, non-URL strings,\n   * plaintext HTTP hostnames such as `localhost`, and non-loopback plaintext\n   * HTTP are rejected before credentials are sent. URL values must not include\n   * userinfo, query strings, or fragments. Defaults to production.\n   */\n  readonly realm?: string\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,IAAa,aAAa;;CAExB,UAAU;;CAEV,WAAW;;CAEX,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,aAAa;;CAEb,cAAc;;CAEd,eAAe;;CAEf,sBAAsB;;CAEtB,uBAAuB;;CAEvB,sBAAsB;;CAEtB,uBAAuB;;CAEvB,wBAAwB;;CAExB,yBAAyB;;CAEzB,yBAAyB;;CAEzB,0BAA0B;;CAE1B,mBAAmB;;CAEnB,oBAAoB;;CAEpB,0BAA0B;;CAE1B,2BAA2B;;CAE3B,WAAW;;CAEX,WAAW;;CAEX,YAAY;;CAEZ,YAAY;;CAEZ,aAAa;;CAEb,oBAAoB;;CAEpB,qBAAqB;;CAErB,oBAAoB;;CAEpB,qBAAqB;;CAErB,kBAAkB;AACpB"}

package/dist/types/backup.d.cts

@@ -0,0 +1,80 @@
+import { AccountId, ComputerId } from './ids.js';
+/**
+ * Request parameters for `bz_list_computers`.
+ *
+ * @experimental Computer Backup API surface; shape may change as the Backup API docs evolve.
+ */
+export interface ListComputersRequest {
+    /** Account ID whose active computer backups should be listed. */
+    readonly accountId: AccountId;
+    /** Computer ID to start listing from for pagination. */
+    readonly startComputerId?: ComputerId;
+    /** Maximum number of computers to return. The documented range is 1 through 500. */
+    readonly maxComputerCount?: number;
+}
+/**
+ * Computer Backup record returned by list and delete operations.
+ *
+ * @experimental Computer Backup API surface; shape may change as the Backup API docs evolve.
+ */
+export interface ComputerBackup {
+    /** Unique identifier for the computer backup. */
+    readonly computerId: ComputerId;
+    /** Name of the computer backup. */
+    readonly computerName: string;
+    /** Timestamp in milliseconds of the last file uploaded by the backup client. */
+    readonly lastFileUploadedTimestamp: number;
+}
+/**
+ * Result object returned by `bz_list_computers`.
+ *
+ * @experimental Computer Backup API surface; shape may change as the Backup API docs evolve.
+ */
+export interface ListComputersResult {
+    /** Next computer ID to use for pagination, or null if all computers have been listed. */
+    readonly nextComputerId: ComputerId | null;
+    /** Active computer backups matching the request. */
+    readonly computers: readonly ComputerBackup[];
+}
+/**
+ * Wire response from `bz_list_computers`.
+ *
+ * The `bz_list_computers` wire response is a single JSON object containing a
+ * pagination cursor and the list of computers.
+ *
+ * @experimental Computer Backup API surface; shape may change as the Backup API docs evolve.
+ */
+export type ListComputersResponse = ListComputersResult;
+/**
+ * Request parameters for `bz_delete_computer`.
+ *
+ * @experimental Computer Backup API surface; shape may change as the Backup API docs evolve.
+ */
+export interface DeleteComputerRequest {
+    /** Account ID that owns the computer backup. */
+    readonly accountId: AccountId;
+    /** Computer ID of the backup to delete. */
+    readonly computerId: ComputerId;
+}
+/**
+ * Single result element returned by `bz_delete_computer`.
+ *
+ * The `bz_delete_computer` wire response is a JSON array of these objects.
+ *
+ * @experimental Computer Backup API surface; shape may change as the Backup API docs evolve.
+ */
+export interface DeleteComputerResult {
+    /** Unique identifier for the deleted computer backup. */
+    readonly computerId: ComputerId;
+    /** Name of the deleted computer backup. */
+    readonly computerName: string;
+    /** Timestamp in milliseconds of the last file uploaded by the backup client. */
+    readonly lastFileUploadedTimestamp: number;
+}
+/**
+ * Array-shaped wire response from `bz_delete_computer`.
+ *
+ * @experimental Computer Backup API surface; shape may change as the Backup API docs evolve.
+ */
+export type DeleteComputerResponse = readonly DeleteComputerResult[];
+//# sourceMappingURL=backup.d.ts.map

package/dist/types/backup.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/types/backup.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAErD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAA;IACrC,oFAAoF;IACpF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAA;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,QAAQ,CAAC,cAAc,EAAE,UAAU,GAAG,IAAI,CAAA;IAC1C,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;CAC9C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,CAAA;AAEvD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,2CAA2C;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAA;CAC3C;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,SAAS,oBAAoB,EAAE,CAAA"}