@backblaze-labs/b2-sdk 0.3.0 → 0.4.0

package/dist/client.d.cts

@@ -5,8 +5,7 @@ import { HttpTransport } from './http/transport.js';
 import { UrlGuard } from './http/url-guard.js';
 import { RawClient } from './raw/index.js';
 import { AuthorizeAccountResponse, Capability } from './types/auth.js';
-import { BucketInfo, BucketRetentionPolicy, BucketType, CorsRule, LifecycleRule } from './types/bucket.js';
-import { EncryptionSetting } from './types/encryption.js';
+import { BucketDefaultServerSideEncryptionSetting, BucketInfo, BucketRetentionPolicy, BucketType, BucketTypesFilter, CorsRule, LifecycleRule } from './types/bucket.js';
 import { ApplicationKeyId, BucketId } from './types/ids.js';
 import { ApplicationKey, CreateKeyOptions, FullApplicationKey, ListKeysResponse } from './types/key.js';
 import { ReplicationConfiguration } from './types/replication.js';
@@ -64,6 +63,11 @@ export interface B2ClientOptions {
      */
     readonly followSameOriginRedirects?: boolean;
 }
+/** Options for {@link B2Client.authorize}. */
+export interface B2ClientAuthorizeOptions {
+    /** Abort signal for cancelling the authorize request. */
+    readonly signal?: AbortSignal;
+}
 /**
  * High-level B2 client providing ergonomic access to buckets, files, and keys.
  *
@@ -93,6 +97,7 @@ export declare class B2Client {
     private readonly realmUrl;
     private readonly userAllowedSuffixes;
     private readonly resolvedUploadRetryOptions;
+    private readonly reauthCoalescer;
     /**
      * Creates a new B2Client. Call {@link authorize} before making API requests.
      * @param options - Configuration including credentials, realm, and transport settings.
@@ -101,18 +106,23 @@ export declare class B2Client {
     /**
      * Authenticates with B2 and stores the authorization state. Must be called before other methods.
      *
+     * @param options - Optional request controls.
+     *
      * @returns The authorization response containing tokens, URLs, and capabilities.
      */
-    authorize(): Promise<AuthorizeAccountResponse>;
+    authorize(options?: B2ClientAuthorizeOptions): Promise<AuthorizeAccountResponse>;
     private lockUrlGuard;
     /**
      * Refresh credentials after a 401. Returns the fresh auth token so
      * {@link RetryTransport} can rewrite the in-flight request's
      * Authorization header before retrying.
      *
+     * @param signal - Optional abort signal for the request that triggered reauthorization.
+     *
      * @returns The fresh authorization token.
      */
     private reauthorize;
+    private doReauthorize;
     /**
      * Creates a new B2 bucket.
      * @param options - Bucket configuration including name, type, and optional settings.
@@ -124,12 +134,23 @@ export declare class B2Client {
         bucketName: string;
         /** Access level: `"allPrivate"` or `"allPublic"`. */
         bucketType: BucketType;
-        /** Custom key-value metadata stored with the bucket. */
+        /**
+         * Custom key-value metadata stored with the bucket. Keys must be 1-50
+         * UTF-8 bytes, must not start with `b2-`, and all values together must be
+         * at most 10,000 UTF-8 bytes. Keys must match
+         * {@link BUCKET_INFO_KEY_PATTERN}. There is no bucketInfo pair-count cap.
+         */
         bucketInfo?: Record<string, string>;
-        /** CORS rules for browser-based access. */
+        /**
+         * CORS rules for browser-based access. A bucket may have at most 100
+         * rules; rule names must be unique, 6-63 characters, match
+         * `[A-Za-z0-9-]`, and not start with `b2-`. Each rule must be less than
+         * 1,000 UTF-8 bytes across its name, origins, operations, allowed headers,
+         * and exposed headers. `maxAgeSeconds` must be at most 86,400.
+         */
         corsRules?: CorsRule[];
         /** Default server-side encryption for new files. */
-        defaultServerSideEncryption?: EncryptionSetting;
+        defaultServerSideEncryption?: BucketDefaultServerSideEncryptionSetting;
         /** Default retention policy for new files (requires file lock). */
         defaultRetention?: BucketRetentionPolicy;
         /** Enable file lock (Object Lock) on the bucket. Cannot be disabled once set. */
@@ -150,8 +171,8 @@ export declare class B2Client {
         bucketId?: BucketId;
         /** Filter to a specific bucket by name. */
         bucketName?: string;
-        /** Filter by bucket types (e.g., `["allPrivate"]`). */
-        bucketTypes?: BucketType[];
+        /** Filter by bucket types (e.g., `["allPrivate"]`, `["shared"]`, or `["all"]`). */
+        bucketTypes?: BucketTypesFilter;
     }): Promise<Bucket[]>;
     /**
      * Looks up a single bucket by name.
@@ -186,7 +207,7 @@ export declare class B2Client {
          * raw API's `maxKeyCount` parameter.
          */
         pageSize?: number;
-        /** Start listing after this key ID (for pagination). */
+        /** Start listing at this key ID, usually from `nextApplicationKeyId`. */
         startApplicationKeyId?: ApplicationKeyId;
     }): Promise<ListKeysResponse>;
     /**

package/dist/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAGzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,OAAO,EAAyB,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EACV,UAAU,EACV,qBAAqB,EACrB,UAAU,EACV,QAAQ,EAER,aAAa,EACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAEtE,OAAO,EAAE,KAAK,gBAAgB,EAAiB,MAAM,qBAAqB,CAAA;AAE1E,kDAAkD;AAClD,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAC7C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAQ;IACnB,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;IACvB,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA+B;IACnE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAc;IAEzD;;;OAGG;gBACS,OAAO,EAAE,eAAe;IAqCpC;;;;OAIG;IACG,SAAS,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAWpD,OAAO,CAAC,YAAY;IAapB;;;;;;OAMG;YACW,WAAW;IAMzB;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,mFAAmF;QACnF,UAAU,EAAE,MAAM,CAAA;QAClB,qDAAqD;QACrD,UAAU,EAAE,UAAU,CAAA;QACtB,wDAAwD;QACxD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACnC,2CAA2C;QAC3C,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;QACtB,oDAAoD;QACpD,2BAA2B,CAAC,EAAE,iBAAiB,CAAA;QAC/C,mEAAmE;QACnE,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;QACxC,iFAAiF;QACjF,eAAe,CAAC,EAAE,OAAO,CAAA;QACzB,6DAA6D;QAC7D,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;QAChC,8CAA8C;QAC9C,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;KACpD,GAAG,OAAO,CAAC,MAAM,CAAC;IAanB;;;;;OAKG;IACG,WAAW,CAAC,OAAO,CAAC,EAAE;QAC1B,yCAAyC;QACzC,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,2CAA2C;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,uDAAuD;QACvD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAA;KAC3B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYrB;;;;;OAKG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;;OAKG;IACG,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAOrD;;;;;OAKG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOvE;;;;;OAKG;IACG,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,wDAAwD;QACxD,qBAAqB,CAAC,EAAE,gBAAgB,CAAA;KACzC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU7B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAC,cAAc,CAAC;IAc/E;;;;;OAKG;IACG,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAM5E;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,qBAAqB;CAOtE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,OAAO,EAAyB,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EACV,wCAAwC,EACxC,UAAU,EACV,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,QAAQ,EAER,aAAa,EACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAGtE,OAAO,EAAE,KAAK,gBAAgB,EAAiB,MAAM,qBAAqB,CAAA;AAE1E,kDAAkD;AAClD,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAC7C;AAED,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAQ;IACnB,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;IACvB,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA+B;IACnE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAc;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;IAEzD;;;OAGG;gBACS,OAAO,EAAE,eAAe;IAsCpC;;;;;;OAMG;IACG,SAAS,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IActF,OAAO,CAAC,YAAY;IAapB;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;YAIL,aAAa;IAK3B;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,mFAAmF;QACnF,UAAU,EAAE,MAAM,CAAA;QAClB,qDAAqD;QACrD,UAAU,EAAE,UAAU,CAAA;QACtB;;;;;WAKG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACnC;;;;;;WAMG;QACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;QACtB,oDAAoD;QACpD,2BAA2B,CAAC,EAAE,wCAAwC,CAAA;QACtE,mEAAmE;QACnE,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;QACxC,iFAAiF;QACjF,eAAe,CAAC,EAAE,OAAO,CAAA;QACzB,6DAA6D;QAC7D,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;QAChC,8CAA8C;QAC9C,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;KACpD,GAAG,OAAO,CAAC,MAAM,CAAC;IAgCnB;;;;;OAKG;IACG,WAAW,CAAC,OAAO,CAAC,EAAE;QAC1B,yCAAyC;QACzC,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,2CAA2C;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,mFAAmF;QACnF,WAAW,CAAC,EAAE,iBAAiB,CAAA;KAChC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYrB;;;;;OAKG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;;OAKG;IACG,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAOrD;;;;;OAKG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOvE;;;;;OAKG;IACG,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yEAAyE;QACzE,qBAAqB,CAAC,EAAE,gBAAgB,CAAA;KACzC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU7B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAC,cAAc,CAAC;IAc/E;;;;;OAKG;IACG,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAM5E;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,qBAAqB;CAOtE"}

package/dist/client.d.ts

@@ -5,8 +5,7 @@ import { HttpTransport } from './http/transport.js';
 import { UrlGuard } from './http/url-guard.js';
 import { RawClient } from './raw/index.js';
 import { AuthorizeAccountResponse, Capability } from './types/auth.js';
-import { BucketInfo, BucketRetentionPolicy, BucketType, CorsRule, LifecycleRule } from './types/bucket.js';
-import { EncryptionSetting } from './types/encryption.js';
+import { BucketDefaultServerSideEncryptionSetting, BucketInfo, BucketRetentionPolicy, BucketType, BucketTypesFilter, CorsRule, LifecycleRule } from './types/bucket.js';
 import { ApplicationKeyId, BucketId } from './types/ids.js';
 import { ApplicationKey, CreateKeyOptions, FullApplicationKey, ListKeysResponse } from './types/key.js';
 import { ReplicationConfiguration } from './types/replication.js';
@@ -64,6 +63,11 @@ export interface B2ClientOptions {
      */
     readonly followSameOriginRedirects?: boolean;
 }
+/** Options for {@link B2Client.authorize}. */
+export interface B2ClientAuthorizeOptions {
+    /** Abort signal for cancelling the authorize request. */
+    readonly signal?: AbortSignal;
+}
 /**
  * High-level B2 client providing ergonomic access to buckets, files, and keys.
  *
@@ -93,6 +97,7 @@ export declare class B2Client {
     private readonly realmUrl;
     private readonly userAllowedSuffixes;
     private readonly resolvedUploadRetryOptions;
+    private readonly reauthCoalescer;
     /**
      * Creates a new B2Client. Call {@link authorize} before making API requests.
      * @param options - Configuration including credentials, realm, and transport settings.
@@ -101,18 +106,23 @@ export declare class B2Client {
     /**
      * Authenticates with B2 and stores the authorization state. Must be called before other methods.
      *
+     * @param options - Optional request controls.
+     *
      * @returns The authorization response containing tokens, URLs, and capabilities.
      */
-    authorize(): Promise<AuthorizeAccountResponse>;
+    authorize(options?: B2ClientAuthorizeOptions): Promise<AuthorizeAccountResponse>;
     private lockUrlGuard;
     /**
      * Refresh credentials after a 401. Returns the fresh auth token so
      * {@link RetryTransport} can rewrite the in-flight request's
      * Authorization header before retrying.
      *
+     * @param signal - Optional abort signal for the request that triggered reauthorization.
+     *
      * @returns The fresh authorization token.
      */
     private reauthorize;
+    private doReauthorize;
     /**
      * Creates a new B2 bucket.
      * @param options - Bucket configuration including name, type, and optional settings.
@@ -124,12 +134,23 @@ export declare class B2Client {
         bucketName: string;
         /** Access level: `"allPrivate"` or `"allPublic"`. */
         bucketType: BucketType;
-        /** Custom key-value metadata stored with the bucket. */
+        /**
+         * Custom key-value metadata stored with the bucket. Keys must be 1-50
+         * UTF-8 bytes, must not start with `b2-`, and all values together must be
+         * at most 10,000 UTF-8 bytes. Keys must match
+         * {@link BUCKET_INFO_KEY_PATTERN}. There is no bucketInfo pair-count cap.
+         */
         bucketInfo?: Record<string, string>;
-        /** CORS rules for browser-based access. */
+        /**
+         * CORS rules for browser-based access. A bucket may have at most 100
+         * rules; rule names must be unique, 6-63 characters, match
+         * `[A-Za-z0-9-]`, and not start with `b2-`. Each rule must be less than
+         * 1,000 UTF-8 bytes across its name, origins, operations, allowed headers,
+         * and exposed headers. `maxAgeSeconds` must be at most 86,400.
+         */
         corsRules?: CorsRule[];
         /** Default server-side encryption for new files. */
-        defaultServerSideEncryption?: EncryptionSetting;
+        defaultServerSideEncryption?: BucketDefaultServerSideEncryptionSetting;
         /** Default retention policy for new files (requires file lock). */
         defaultRetention?: BucketRetentionPolicy;
         /** Enable file lock (Object Lock) on the bucket. Cannot be disabled once set. */
@@ -150,8 +171,8 @@ export declare class B2Client {
         bucketId?: BucketId;
         /** Filter to a specific bucket by name. */
         bucketName?: string;
-        /** Filter by bucket types (e.g., `["allPrivate"]`). */
-        bucketTypes?: BucketType[];
+        /** Filter by bucket types (e.g., `["allPrivate"]`, `["shared"]`, or `["all"]`). */
+        bucketTypes?: BucketTypesFilter;
     }): Promise<Bucket[]>;
     /**
      * Looks up a single bucket by name.
@@ -186,7 +207,7 @@ export declare class B2Client {
          * raw API's `maxKeyCount` parameter.
          */
         pageSize?: number;
-        /** Start listing after this key ID (for pagination). */
+        /** Start listing at this key ID, usually from `nextApplicationKeyId`. */
         startApplicationKeyId?: ApplicationKeyId;
     }): Promise<ListKeysResponse>;
     /**

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAGzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,OAAO,EAAyB,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EACV,UAAU,EACV,qBAAqB,EACrB,UAAU,EACV,QAAQ,EAER,aAAa,EACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAEtE,OAAO,EAAE,KAAK,gBAAgB,EAAiB,MAAM,qBAAqB,CAAA;AAE1E,kDAAkD;AAClD,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAC7C;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAQ;IACnB,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;IACvB,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA+B;IACnE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAc;IAEzD;;;OAGG;gBACS,OAAO,EAAE,eAAe;IAqCpC;;;;OAIG;IACG,SAAS,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAWpD,OAAO,CAAC,YAAY;IAapB;;;;;;OAMG;YACW,WAAW;IAMzB;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,mFAAmF;QACnF,UAAU,EAAE,MAAM,CAAA;QAClB,qDAAqD;QACrD,UAAU,EAAE,UAAU,CAAA;QACtB,wDAAwD;QACxD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACnC,2CAA2C;QAC3C,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;QACtB,oDAAoD;QACpD,2BAA2B,CAAC,EAAE,iBAAiB,CAAA;QAC/C,mEAAmE;QACnE,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;QACxC,iFAAiF;QACjF,eAAe,CAAC,EAAE,OAAO,CAAA;QACzB,6DAA6D;QAC7D,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;QAChC,8CAA8C;QAC9C,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;KACpD,GAAG,OAAO,CAAC,MAAM,CAAC;IAanB;;;;;OAKG;IACG,WAAW,CAAC,OAAO,CAAC,EAAE;QAC1B,yCAAyC;QACzC,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,2CAA2C;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,uDAAuD;QACvD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAA;KAC3B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYrB;;;;;OAKG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;;OAKG;IACG,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAOrD;;;;;OAKG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOvE;;;;;OAKG;IACG,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,wDAAwD;QACxD,qBAAqB,CAAC,EAAE,gBAAgB,CAAA;KACzC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU7B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAC,cAAc,CAAC;IAc/E;;;;;OAKG;IACG,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAM5E;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,qBAAqB;CAOtE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,OAAO,EAAyB,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EACV,wCAAwC,EACxC,UAAU,EACV,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,QAAQ,EAER,aAAa,EACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAGtE,OAAO,EAAE,KAAK,gBAAgB,EAAiB,MAAM,qBAAqB,CAAA;AAE1E,kDAAkD;AAClD,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAA;CACxC;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAC7C;AAED,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAQ;IACnB,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;IACvB,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA+B;IACnE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAc;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;IAEzD;;;OAGG;gBACS,OAAO,EAAE,eAAe;IAsCpC;;;;;;OAMG;IACG,SAAS,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IActF,OAAO,CAAC,YAAY;IAapB;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;YAIL,aAAa;IAK3B;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,mFAAmF;QACnF,UAAU,EAAE,MAAM,CAAA;QAClB,qDAAqD;QACrD,UAAU,EAAE,UAAU,CAAA;QACtB;;;;;WAKG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACnC;;;;;;WAMG;QACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;QACtB,oDAAoD;QACpD,2BAA2B,CAAC,EAAE,wCAAwC,CAAA;QACtE,mEAAmE;QACnE,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;QACxC,iFAAiF;QACjF,eAAe,CAAC,EAAE,OAAO,CAAA;QACzB,6DAA6D;QAC7D,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;QAChC,8CAA8C;QAC9C,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;KACpD,GAAG,OAAO,CAAC,MAAM,CAAC;IAgCnB;;;;;OAKG;IACG,WAAW,CAAC,OAAO,CAAC,EAAE;QAC1B,yCAAyC;QACzC,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,2CAA2C;QAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,mFAAmF;QACnF,WAAW,CAAC,EAAE,iBAAiB,CAAA;KAChC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYrB;;;;;OAKG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;;OAKG;IACG,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAOrD;;;;;OAKG;IACG,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOvE;;;;;OAKG;IACG,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yEAAyE;QACzE,qBAAqB,CAAC,EAAE,gBAAgB,CAAA;KACzC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU7B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAC,cAAc,CAAC;IAc/E;;;;;OAKG;IACG,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAM5E;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,qBAAqB;CAOtE"}

package/dist/client.js

@@ -1,10 +1,12 @@
 import { InMemoryAccountInfo } from "./auth/in-memory.js";
 import { accountId } from "./types/ids.js";
+import { throwIfSignalAborted } from "./util/abort.js";
 import "./util/defaults.js";
 import { DEFAULT_RETRY_OPTIONS } from "./http/retry.js";
 import { paginateItems } from "./util/paginator.js";
 import { Bucket } from "./bucket.js";
 import { getRealmUrl } from "./auth/realms.js";
+import { ReauthCoalescer } from "./auth/reauth-coalescer.js";
 import { UrlGuard, deriveAllowedSuffixes } from "./http/url-guard.js";
 import { FetchTransport, RetryTransport } from "./http/transport.js";
 import { RawClient } from "./raw/index.js";
@@ -38,6 +40,7 @@ var B2Client = class {
 	realmUrl;
 	userAllowedSuffixes;
 	resolvedUploadRetryOptions;
+	reauthCoalescer;
 	/**
 	* Creates a new B2Client. Call {@link authorize} before making API requests.
 	* @param options - Configuration including credentials, realm, and transport settings.
@@ -53,6 +56,7 @@ var B2Client = class {
 			...DEFAULT_RETRY_OPTIONS,
 			...options.retry
 		};
+		this.reauthCoalescer = new ReauthCoalescer((signal) => this.doReauthorize(signal));
 		let baseTransport;
 		if (options.transport !== void 0) {
 			baseTransport = options.transport;
@@ -69,7 +73,7 @@ var B2Client = class {
 		const retryTransport = new RetryTransport({
 			transport: baseTransport,
 			retry: this.resolvedUploadRetryOptions,
-			onReauth: () => this.reauthorize()
+			onReauth: (signal) => this.reauthorize(signal)
 		});
 		const cachedAuth = this.accountInfo.getAuth();
 		if (cachedAuth !== null) this.lockUrlGuard(cachedAuth);
@@ -78,10 +82,14 @@ var B2Client = class {
 	/**
 	* Authenticates with B2 and stores the authorization state. Must be called before other methods.
 	*
+	* @param options - Optional request controls.
+	*
 	* @returns The authorization response containing tokens, URLs, and capabilities.
 	*/
-	async authorize() {
-		const auth = await this.raw.authorizeAccount(this.applicationKeyId, this.applicationKey, this.realmUrl);
+	async authorize(options) {
+		throwIfSignalAborted(options?.signal);
+		const auth = await this.raw.authorizeAccount(this.applicationKeyId, this.applicationKey, this.realmUrl, options?.signal !== void 0 ? { signal: options.signal } : void 0);
+		throwIfSignalAborted(options?.signal);
 		this.accountInfo.setAuth(auth);
 		this.lockUrlGuard(auth);
 		return auth;
@@ -98,11 +106,15 @@ var B2Client = class {
 	* {@link RetryTransport} can rewrite the in-flight request's
 	* Authorization header before retrying.
 	*
+	* @param signal - Optional abort signal for the request that triggered reauthorization.
+	*
 	* @returns The fresh authorization token.
 	*/
-	async reauthorize() {
-		this.accountInfo.clear();
-		return (await this.authorize()).authorizationToken;
+	reauthorize(signal) {
+		return this.reauthCoalescer.run(signal);
+	}
+	async doReauthorize(signal) {
+		return (await this.authorize({ signal })).authorizationToken;
 	}
 	/**
 	* Creates a new B2 bucket.
@@ -111,9 +123,18 @@ var B2Client = class {
 	* @returns A {@link Bucket} handle for the newly created bucket.
 	*/
 	async createBucket(options) {
+		const { bucketInfo, bucketName, bucketType, corsRules, defaultRetention, defaultServerSideEncryption, fileLockEnabled, lifecycleRules, replicationConfiguration } = options;
 		const request = {
-			accountId: accountId(this.accountInfo.getAccountId()),
-			...options
+			...bucketInfo !== void 0 ? { bucketInfo } : {},
+			bucketName,
+			bucketType,
+			...corsRules !== void 0 ? { corsRules } : {},
+			...defaultServerSideEncryption !== void 0 ? { defaultServerSideEncryption } : {},
+			...defaultRetention !== void 0 ? { defaultRetention } : {},
+			...fileLockEnabled !== void 0 ? { fileLockEnabled } : {},
+			...lifecycleRules !== void 0 ? { lifecycleRules } : {},
+			...replicationConfiguration !== void 0 ? { replicationConfiguration } : {},
+			accountId: accountId(this.accountInfo.getAccountId())
 		};
 		const info = await this.raw.createBucket(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), request);
 		return new Bucket(this, info, this.resolvedUploadRetryOptions);

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type { AccountInfo } from './auth/account-info.ts'\nimport { InMemoryAccountInfo } from './auth/in-memory.ts'\nimport { getRealmUrl } from './auth/realms.ts'\nimport { Bucket } from './bucket.ts'\nimport { DEFAULT_RETRY_OPTIONS, type RetryOptions } from './http/retry.ts'\nimport type { HttpTransport } from './http/transport.ts'\nimport { FetchTransport, RetryTransport } from './http/transport.ts'\nimport { deriveAllowedSuffixes, UrlGuard } from './http/url-guard.ts'\nimport { RawClient } from './raw/index.ts'\nimport type { AuthorizeAccountResponse, Capability } from './types/auth.ts'\nimport type {\n  BucketInfo,\n  BucketRetentionPolicy,\n  BucketType,\n  CorsRule,\n  CreateBucketRequest,\n  LifecycleRule,\n} from './types/bucket.ts'\nimport type { EncryptionSetting } from './types/encryption.ts'\nimport type { ApplicationKeyId, BucketId } from './types/ids.ts'\nimport { accountId } from './types/ids.ts'\nimport type {\n  ApplicationKey,\n  CreateKeyOptions,\n  FullApplicationKey,\n  ListKeysResponse,\n} from './types/key.ts'\nimport type { ReplicationConfiguration } from './types/replication.ts'\nimport { DEFAULT_PAGE_SIZE } from './util/defaults.ts'\nimport { type PaginatorOptions, paginateItems } from './util/paginator.ts'\n\n/** Result of {@link B2Client.hasCapabilities}. */\nexport interface CapabilityCheckResult {\n  /** `true` when the key carries every requested capability. */\n  readonly ok: boolean\n  /** Capabilities the call requested that the current key does not hold. Empty when `ok` is `true`. */\n  readonly missing: readonly Capability[]\n}\n\n/** Configuration options for creating a {@link B2Client}. */\nexport interface B2ClientOptions {\n  /** The application key ID from the B2 dashboard or `b2_create_key`. */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /**\n   * B2 realm to authenticate against. Accepts a known realm-map key\n   * (`\"production\"` or `\"staging\"`) or a direct base URL. Custom HTTPS hosts\n   * are trusted with the application key during authorize, so never derive\n   * `realm` from untrusted input. URL values must use HTTPS, or loopback IP\n   * literal HTTP for local testing only; application-key credentials are sent\n   * unencrypted over loopback HTTP. Unsupported schemes, malformed URLs,\n   * non-URL strings, plaintext HTTP hostnames such as `localhost`, and\n   * non-loopback plaintext HTTP are rejected before credentials are sent. URL\n   * values must not include userinfo, query strings, or fragments. Defaults to\n   * `\"production\"`.\n   */\n  readonly realm?: string\n  /** Storage backend for authorization state. Defaults to {@link InMemoryAccountInfo}. */\n  readonly accountInfo?: AccountInfo\n  /** Custom HTTP transport. Defaults to {@link FetchTransport}. Wrapped by {@link RetryTransport}. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior (max retries, backoff, and per-attempt timeout). */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /**\n   * Override the SSRF allow-list. By default the SDK locks the\n   * {@link FetchTransport} to host suffixes derived from the realm's authorize\n   * response (e.g. `backblazeb2.com`, `backblaze.com`) so a compromised B2\n   * endpoint cannot redirect the SDK to internal services. Pass an explicit\n   * list to add hosts (e.g. when testing against a self-hosted proxy) or set\n   * to an empty array to disable the guard entirely (not recommended).\n   *\n   * Only consulted when {@link B2ClientOptions.transport} is unset; a custom\n   * transport is the user's responsibility to harden.\n   */\n  readonly allowedHostSuffixes?: readonly string[]\n  /**\n   * Follow same-origin GET/HEAD redirects in the default fetch transport after\n   * checking each target with the SSRF guard. POST redirects remain blocked.\n   * Defaults to true.\n   */\n  readonly followSameOriginRedirects?: boolean\n}\n\n/**\n * High-level B2 client providing ergonomic access to buckets, files, and keys.\n *\n * @example\n * ```ts\n * const client = new B2Client({\n *   applicationKeyId: process.env.B2_APPLICATION_KEY_ID,\n *   applicationKey: process.env.B2_APPLICATION_KEY,\n * })\n * await client.authorize()\n * const buckets = await client.listBuckets()\n * ```\n */\nexport class B2Client {\n  /** Low-level client for direct B2 API calls. */\n  readonly raw: RawClient\n  /** Authorization state storage (tokens, URLs, capabilities). */\n  readonly accountInfo: AccountInfo\n  /**\n   * SSRF allow-list applied by the default {@link FetchTransport}. `null` when\n   * a custom transport was supplied — in that case the SDK does not own the\n   * guard. Locked down by {@link B2Client.authorize}.\n   */\n  readonly urlGuard: UrlGuard | null\n  private readonly applicationKeyId: string\n  private readonly applicationKey: string\n  private readonly realmUrl: string\n  private readonly userAllowedSuffixes: readonly string[] | undefined\n  private readonly resolvedUploadRetryOptions: RetryOptions\n\n  /**\n   * Creates a new B2Client. Call {@link authorize} before making API requests.\n   * @param options - Configuration including credentials, realm, and transport settings.\n   */\n  constructor(options: B2ClientOptions) {\n    this.applicationKeyId = options.applicationKeyId\n    this.applicationKey = options.applicationKey\n    this.realmUrl = getRealmUrl(options.realm ?? 'production')\n    this.accountInfo = options.accountInfo ?? new InMemoryAccountInfo()\n    bindAccountInfoAuthContext(this.accountInfo, this.realmUrl, this.applicationKeyId)\n    this.userAllowedSuffixes = options.allowedHostSuffixes\n    this.resolvedUploadRetryOptions = { ...DEFAULT_RETRY_OPTIONS, ...options.retry }\n\n    let baseTransport: HttpTransport\n    if (options.transport !== undefined) {\n      baseTransport = options.transport\n      this.urlGuard = null\n    } else {\n      const urlGuard = new UrlGuard()\n      baseTransport = new FetchTransport({\n        urlGuard,\n        ...(options.userAgent !== undefined ? { userAgent: options.userAgent } : {}),\n        ...(options.followSameOriginRedirects !== undefined\n          ? { followSameOriginRedirects: options.followSameOriginRedirects }\n          : {}),\n      })\n      this.urlGuard = urlGuard\n    }\n\n    const retryTransport = new RetryTransport({\n      transport: baseTransport,\n      retry: this.resolvedUploadRetryOptions,\n      onReauth: () => this.reauthorize(),\n    })\n\n    const cachedAuth = this.accountInfo.getAuth()\n    if (cachedAuth !== null) this.lockUrlGuard(cachedAuth)\n\n    this.raw = new RawClient({ transport: retryTransport })\n  }\n\n  /**\n   * Authenticates with B2 and stores the authorization state. Must be called before other methods.\n   *\n   * @returns The authorization response containing tokens, URLs, and capabilities.\n   */\n  async authorize(): Promise<AuthorizeAccountResponse> {\n    const auth = await this.raw.authorizeAccount(\n      this.applicationKeyId,\n      this.applicationKey,\n      this.realmUrl,\n    )\n    this.accountInfo.setAuth(auth)\n    this.lockUrlGuard(auth)\n    return auth\n  }\n\n  private lockUrlGuard(auth: AuthorizeAccountResponse): void {\n    if (this.urlGuard !== null) {\n      const derived = deriveAllowedSuffixes(auth.apiInfo.storageApi)\n      const merged =\n        this.userAllowedSuffixes !== undefined\n          ? this.userAllowedSuffixes.length === 0\n            ? []\n            : Array.from(new Set([...derived, ...this.userAllowedSuffixes]))\n          : derived\n      this.urlGuard.setAllowedSuffixes(merged)\n    }\n  }\n\n  /**\n   * Refresh credentials after a 401. Returns the fresh auth token so\n   * {@link RetryTransport} can rewrite the in-flight request's\n   * Authorization header before retrying.\n   *\n   * @returns The fresh authorization token.\n   */\n  private async reauthorize(): Promise<string> {\n    this.accountInfo.clear()\n    const auth = await this.authorize()\n    return auth.authorizationToken\n  }\n\n  /**\n   * Creates a new B2 bucket.\n   * @param options - Bucket configuration including name, type, and optional settings.\n   *\n   * @returns A {@link Bucket} handle for the newly created bucket.\n   */\n  async createBucket(options: {\n    /** Globally unique bucket name (6-63 chars; letters, digits, hyphens, periods). */\n    bucketName: string\n    /** Access level: `\"allPrivate\"` or `\"allPublic\"`. */\n    bucketType: BucketType\n    /** Custom key-value metadata stored with the bucket. */\n    bucketInfo?: Record<string, string>\n    /** CORS rules for browser-based access. */\n    corsRules?: CorsRule[]\n    /** Default server-side encryption for new files. */\n    defaultServerSideEncryption?: EncryptionSetting\n    /** Default retention policy for new files (requires file lock). */\n    defaultRetention?: BucketRetentionPolicy\n    /** Enable file lock (Object Lock) on the bucket. Cannot be disabled once set. */\n    fileLockEnabled?: boolean\n    /** Lifecycle rules for automatic file deletion or hiding. */\n    lifecycleRules?: LifecycleRule[]\n    /** Cross-region replication configuration. */\n    replicationConfiguration?: ReplicationConfiguration\n  }): Promise<Bucket> {\n    const request: CreateBucketRequest = {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...options,\n    }\n    const info = await this.raw.createBucket(\n      this.accountInfo.getApiUrl(),\n      this.accountInfo.getAuthToken(),\n      request,\n    )\n    return new Bucket(this, info, this.resolvedUploadRetryOptions)\n  }\n\n  /**\n   * Lists buckets in the account, optionally filtered by ID, name, or type.\n   * @param options - Optional filters for bucket ID, name, or type.\n   *\n   * @returns An array of {@link Bucket} handles.\n   */\n  async listBuckets(options?: {\n    /** Filter to a specific bucket by ID. */\n    bucketId?: BucketId\n    /** Filter to a specific bucket by name. */\n    bucketName?: string\n    /** Filter by bucket types (e.g., `[\"allPrivate\"]`). */\n    bucketTypes?: BucketType[]\n  }): Promise<Bucket[]> {\n    const resp = await this.raw.listBuckets(\n      this.accountInfo.getApiUrl(),\n      this.accountInfo.getAuthToken(),\n      {\n        accountId: accountId(this.accountInfo.getAccountId()),\n        ...options,\n      },\n    )\n    return resp.buckets.map((info) => new Bucket(this, info, this.resolvedUploadRetryOptions))\n  }\n\n  /**\n   * Looks up a single bucket by name.\n   * @param bucketName - The name of the bucket to find.\n   *\n   * @returns The {@link Bucket} handle, or `null` if not found.\n   */\n  async getBucket(bucketName: string): Promise<Bucket | null> {\n    const buckets = await this.listBuckets({ bucketName })\n    const filteredMatch = buckets[0]\n    if (filteredMatch !== undefined) return filteredMatch\n\n    const unfilteredBuckets = await this.listBuckets()\n    return unfilteredBuckets.find((bucket) => bucket.name === bucketName) ?? null\n  }\n\n  /**\n   * Permanently deletes a bucket. The bucket must be empty.\n   * @param id - The unique identifier of the bucket to delete.\n   *\n   * @returns The deleted bucket metadata.\n   */\n  async deleteBucket(id: BucketId): Promise<BucketInfo> {\n    return this.raw.deleteBucket(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      bucketId: id,\n    })\n  }\n\n  /**\n   * Creates a new application key with the specified capabilities.\n   * @param options - Key configuration including capabilities, name, and optional restrictions.\n   *\n   * @returns The full key including the secret (only returned at creation time).\n   */\n  async createKey(options: CreateKeyOptions): Promise<FullApplicationKey> {\n    return this.raw.createKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...options,\n    })\n  }\n\n  /**\n   * Lists application keys in the account.\n   * @param options - Optional pagination settings.\n   *\n   * @returns A page of application keys with an optional continuation token.\n   */\n  async listKeys(options?: {\n    /**\n     * Maximum number of keys to return per request. Forwarded to the\n     * raw API's `maxKeyCount` parameter.\n     */\n    pageSize?: number\n    /** Start listing after this key ID (for pagination). */\n    startApplicationKeyId?: ApplicationKeyId\n  }): Promise<ListKeysResponse> {\n    return this.raw.listKeys(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...(options?.pageSize !== undefined ? { maxKeyCount: options.pageSize } : {}),\n      ...(options?.startApplicationKeyId !== undefined\n        ? { startApplicationKeyId: options.startApplicationKeyId }\n        : {}),\n    })\n  }\n\n  /**\n   * Async iterator that yields every application key on the account,\n   * automatically handling pagination via `listKeys`.\n   *\n   * @param options - Pagination + abort options. `pageSize` is forwarded\n   *   to `maxKeyCount`; the default is 1000.\n   *\n   * @returns An async iterable of {@link ApplicationKey} entries.\n   *\n   * @example\n   * ```ts\n   * for await (const key of client.paginateKeys()) {\n   *   console.log(key.keyName, key.capabilities)\n   * }\n   * ```\n   */\n  paginateKeys(options?: PaginatorOptions): AsyncIterableIterator<ApplicationKey> {\n    return paginateItems(\n      async (cursor: ApplicationKeyId | undefined) => {\n        const resp = await this.listKeys({\n          pageSize: options?.pageSize ?? DEFAULT_PAGE_SIZE,\n          ...(cursor !== undefined ? { startApplicationKeyId: cursor } : {}),\n        })\n        return { page: resp, nextCursor: resp.nextApplicationKeyId ?? undefined }\n      },\n      (page) => page.keys,\n      options?.signal,\n    )\n  }\n\n  /**\n   * Permanently deletes an application key.\n   * @param applicationKeyId - The unique identifier of the key to delete.\n   *\n   * @returns The deleted application key metadata.\n   */\n  async deleteKey(applicationKeyId: ApplicationKeyId): Promise<ApplicationKey> {\n    return this.raw.deleteKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      applicationKeyId,\n    })\n  }\n\n  /**\n   * Checks whether the authorized application key carries every capability in\n   * `needed`. Returns the missing capabilities so callers can fail fast with a\n   * clear error instead of a generic 401/403 from the server.\n   *\n   * @param needed - The capabilities required by the planned operation.\n   *\n   * @returns An object with `ok: true` when every needed capability is\n   *   present, otherwise `{ ok: false, missing: [...] }`.\n   *\n   * @throws If {@link authorize} has not been called yet.\n   */\n  hasCapabilities(needed: readonly Capability[]): CapabilityCheckResult {\n    const auth = this.accountInfo.getAuth()\n    if (!auth) throw new Error('Not authorized. Call authorize() first.')\n    const available = new Set<string>(auth.apiInfo.storageApi.allowed.capabilities)\n    const missing = needed.filter((cap) => !available.has(cap as string))\n    return { ok: missing.length === 0, missing }\n  }\n}\n\nfunction bindAccountInfoAuthContext(\n  accountInfo: AccountInfo,\n  realmUrl: string,\n  applicationKeyId: string,\n): void {\n  accountInfo.setApplicationKeyId?.(applicationKeyId)\n  accountInfo.setRealmUrl?.(realmUrl)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmGA,IAAa,WAAb,MAAsB;;CAEpB;;CAEA;;;;;;CAMA;CACA;CACA;CACA;CACA;CACA;;;;;CAMA,YAAY,SAA0B;EACpC,KAAK,mBAAmB,QAAQ;EAChC,KAAK,iBAAiB,QAAQ;EAC9B,KAAK,WAAW,YAAY,QAAQ,SAAS,YAAY;EACzD,KAAK,cAAc,QAAQ,eAAe,IAAI,oBAAoB;EAClE,2BAA2B,KAAK,aAAa,KAAK,UAAU,KAAK,gBAAgB;EACjF,KAAK,sBAAsB,QAAQ;EACnC,KAAK,6BAA6B;GAAE,GAAG;GAAuB,GAAG,QAAQ;EAAM;EAE/E,IAAI;EACJ,IAAI,QAAQ,cAAc,KAAA,GAAW;GACnC,gBAAgB,QAAQ;GACxB,KAAK,WAAW;EAClB,OAAO;GACL,MAAM,WAAW,IAAI,SAAS;GAC9B,gBAAgB,IAAI,eAAe;IACjC;IACA,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC1E,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;GACP,CAAC;GACD,KAAK,WAAW;EAClB;EAEA,MAAM,iBAAiB,IAAI,eAAe;GACxC,WAAW;GACX,OAAO,KAAK;GACZ,gBAAgB,KAAK,YAAY;EACnC,CAAC;EAED,MAAM,aAAa,KAAK,YAAY,QAAQ;EAC5C,IAAI,eAAe,MAAM,KAAK,aAAa,UAAU;EAErD,KAAK,MAAM,IAAI,UAAU,EAAE,WAAW,eAAe,CAAC;CACxD;;;;;;CAOA,MAAM,YAA+C;EACnD,MAAM,OAAO,MAAM,KAAK,IAAI,iBAC1B,KAAK,kBACL,KAAK,gBACL,KAAK,QACP;EACA,KAAK,YAAY,QAAQ,IAAI;EAC7B,KAAK,aAAa,IAAI;EACtB,OAAO;CACT;CAEA,aAAqB,MAAsC;EACzD,IAAI,KAAK,aAAa,MAAM;GAC1B,MAAM,UAAU,sBAAsB,KAAK,QAAQ,UAAU;GAC7D,MAAM,SACJ,KAAK,wBAAwB,KAAA,IACzB,KAAK,oBAAoB,WAAW,IAClC,CAAC,IACD,MAAM,qBAAK,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK,mBAAmB,CAAC,CAAC,IAC/D;GACN,KAAK,SAAS,mBAAmB,MAAM;EACzC;CACF;;;;;;;;CASA,MAAc,cAA+B;EAC3C,KAAK,YAAY,MAAM;EAEvB,QAAO,MADY,KAAK,UAAU,EAAA,CACtB;CACd;;;;;;;CAQA,MAAM,aAAa,SAmBC;EAClB,MAAM,UAA+B;GACnC,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAG;EACL;EACA,MAAM,OAAO,MAAM,KAAK,IAAI,aAC1B,KAAK,YAAY,UAAU,GAC3B,KAAK,YAAY,aAAa,GAC9B,OACF;EACA,OAAO,IAAI,OAAO,MAAM,MAAM,KAAK,0BAA0B;CAC/D;;;;;;;CAQA,MAAM,YAAY,SAOI;EASpB,QAAO,MARY,KAAK,IAAI,YAC1B,KAAK,YAAY,UAAU,GAC3B,KAAK,YAAY,aAAa,GAC9B;GACE,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAG;EACL,CACF,EAAA,CACY,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,MAAM,KAAK,0BAA0B,CAAC;CAC3F;;;;;;;CAQA,MAAM,UAAU,YAA4C;EAE1D,MAAM,iBAAgB,MADA,KAAK,YAAY,EAAE,WAAW,CAAC,EAAA,CACvB;EAC9B,IAAI,kBAAkB,KAAA,GAAW,OAAO;EAGxC,QAAO,MADyB,KAAK,YAAY,EAAA,CACxB,MAAM,WAAW,OAAO,SAAS,UAAU,KAAK;CAC3E;;;;;;;CAQA,MAAM,aAAa,IAAmC;EACpD,OAAO,KAAK,IAAI,aAAa,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GAC1F,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,UAAU;EACZ,CAAC;CACH;;;;;;;CAQA,MAAM,UAAU,SAAwD;EACtE,OAAO,KAAK,IAAI,UAAU,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GACvF,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAG;EACL,CAAC;CACH;;;;;;;CAQA,MAAM,SAAS,SAQe;EAC5B,OAAO,KAAK,IAAI,SAAS,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GACtF,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAI,SAAS,aAAa,KAAA,IAAY,EAAE,aAAa,QAAQ,SAAS,IAAI,CAAC;GAC3E,GAAI,SAAS,0BAA0B,KAAA,IACnC,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;EACP,CAAC;CACH;;;;;;;;;;;;;;;;;CAkBA,aAAa,SAAmE;EAC9E,OAAO,cACL,OAAO,WAAyC;GAC9C,MAAM,OAAO,MAAM,KAAK,SAAS;IAC/B,UAAU,SAAS,YAAA;IACnB,GAAI,WAAW,KAAA,IAAY,EAAE,uBAAuB,OAAO,IAAI,CAAC;GAClE,CAAC;GACD,OAAO;IAAE,MAAM;IAAM,YAAY,KAAK,wBAAwB,KAAA;GAAU;EAC1E,IACC,SAAS,KAAK,MACf,SAAS,MACX;CACF;;;;;;;CAQA,MAAM,UAAU,kBAA6D;EAC3E,OAAO,KAAK,IAAI,UAAU,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG,EACvF,iBACF,CAAC;CACH;;;;;;;;;;;;;CAcA,gBAAgB,QAAsD;EACpE,MAAM,OAAO,KAAK,YAAY,QAAQ;EACtC,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,yCAAyC;EACpE,MAAM,YAAY,IAAI,IAAY,KAAK,QAAQ,WAAW,QAAQ,YAAY;EAC9E,MAAM,UAAU,OAAO,QAAQ,QAAQ,CAAC,UAAU,IAAI,GAAa,CAAC;EACpE,OAAO;GAAE,IAAI,QAAQ,WAAW;GAAG;EAAQ;CAC7C;AACF;AAEA,SAAS,2BACP,aACA,UACA,kBACM;CACN,YAAY,sBAAsB,gBAAgB;CAClD,YAAY,cAAc,QAAQ;AACpC"}
+{"version":3,"file":"client.js","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type { AccountInfo } from './auth/account-info.ts'\nimport { InMemoryAccountInfo } from './auth/in-memory.ts'\nimport { getRealmUrl } from './auth/realms.ts'\nimport { ReauthCoalescer } from './auth/reauth-coalescer.ts'\nimport { Bucket } from './bucket.ts'\nimport { DEFAULT_RETRY_OPTIONS, type RetryOptions } from './http/retry.ts'\nimport type { HttpTransport } from './http/transport.ts'\nimport { FetchTransport, RetryTransport } from './http/transport.ts'\nimport { deriveAllowedSuffixes, UrlGuard } from './http/url-guard.ts'\nimport { RawClient } from './raw/index.ts'\nimport type { AuthorizeAccountResponse, Capability } from './types/auth.ts'\nimport type {\n  BucketDefaultServerSideEncryptionSetting,\n  BucketInfo,\n  BucketRetentionPolicy,\n  BucketType,\n  BucketTypesFilter,\n  CorsRule,\n  CreateBucketRequest,\n  LifecycleRule,\n} from './types/bucket.ts'\nimport type { ApplicationKeyId, BucketId } from './types/ids.ts'\nimport { accountId } from './types/ids.ts'\nimport type {\n  ApplicationKey,\n  CreateKeyOptions,\n  FullApplicationKey,\n  ListKeysResponse,\n} from './types/key.ts'\nimport type { ReplicationConfiguration } from './types/replication.ts'\nimport { throwIfSignalAborted } from './util/abort.ts'\nimport { DEFAULT_PAGE_SIZE } from './util/defaults.ts'\nimport { type PaginatorOptions, paginateItems } from './util/paginator.ts'\n\n/** Result of {@link B2Client.hasCapabilities}. */\nexport interface CapabilityCheckResult {\n  /** `true` when the key carries every requested capability. */\n  readonly ok: boolean\n  /** Capabilities the call requested that the current key does not hold. Empty when `ok` is `true`. */\n  readonly missing: readonly Capability[]\n}\n\n/** Configuration options for creating a {@link B2Client}. */\nexport interface B2ClientOptions {\n  /** The application key ID from the B2 dashboard or `b2_create_key`. */\n  readonly applicationKeyId: string\n  /** The application key secret. */\n  readonly applicationKey: string\n  /**\n   * B2 realm to authenticate against. Accepts a known realm-map key\n   * (`\"production\"` or `\"staging\"`) or a direct base URL. Custom HTTPS hosts\n   * are trusted with the application key during authorize, so never derive\n   * `realm` from untrusted input. URL values must use HTTPS, or loopback IP\n   * literal HTTP for local testing only; application-key credentials are sent\n   * unencrypted over loopback HTTP. Unsupported schemes, malformed URLs,\n   * non-URL strings, plaintext HTTP hostnames such as `localhost`, and\n   * non-loopback plaintext HTTP are rejected before credentials are sent. URL\n   * values must not include userinfo, query strings, or fragments. Defaults to\n   * `\"production\"`.\n   */\n  readonly realm?: string\n  /** Storage backend for authorization state. Defaults to {@link InMemoryAccountInfo}. */\n  readonly accountInfo?: AccountInfo\n  /** Custom HTTP transport. Defaults to {@link FetchTransport}. Wrapped by {@link RetryTransport}. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior (max retries, backoff, and per-attempt timeout). */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /**\n   * Override the SSRF allow-list. By default the SDK locks the\n   * {@link FetchTransport} to host suffixes derived from the realm's authorize\n   * response (e.g. `backblazeb2.com`, `backblaze.com`) so a compromised B2\n   * endpoint cannot redirect the SDK to internal services. Pass an explicit\n   * list to add hosts (e.g. when testing against a self-hosted proxy) or set\n   * to an empty array to disable the guard entirely (not recommended).\n   *\n   * Only consulted when {@link B2ClientOptions.transport} is unset; a custom\n   * transport is the user's responsibility to harden.\n   */\n  readonly allowedHostSuffixes?: readonly string[]\n  /**\n   * Follow same-origin GET/HEAD redirects in the default fetch transport after\n   * checking each target with the SSRF guard. POST redirects remain blocked.\n   * Defaults to true.\n   */\n  readonly followSameOriginRedirects?: boolean\n}\n\n/** Options for {@link B2Client.authorize}. */\nexport interface B2ClientAuthorizeOptions {\n  /** Abort signal for cancelling the authorize request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * High-level B2 client providing ergonomic access to buckets, files, and keys.\n *\n * @example\n * ```ts\n * const client = new B2Client({\n *   applicationKeyId: process.env.B2_APPLICATION_KEY_ID,\n *   applicationKey: process.env.B2_APPLICATION_KEY,\n * })\n * await client.authorize()\n * const buckets = await client.listBuckets()\n * ```\n */\nexport class B2Client {\n  /** Low-level client for direct B2 API calls. */\n  readonly raw: RawClient\n  /** Authorization state storage (tokens, URLs, capabilities). */\n  readonly accountInfo: AccountInfo\n  /**\n   * SSRF allow-list applied by the default {@link FetchTransport}. `null` when\n   * a custom transport was supplied — in that case the SDK does not own the\n   * guard. Locked down by {@link B2Client.authorize}.\n   */\n  readonly urlGuard: UrlGuard | null\n  private readonly applicationKeyId: string\n  private readonly applicationKey: string\n  private readonly realmUrl: string\n  private readonly userAllowedSuffixes: readonly string[] | undefined\n  private readonly resolvedUploadRetryOptions: RetryOptions\n  private readonly reauthCoalescer: ReauthCoalescer<string>\n\n  /**\n   * Creates a new B2Client. Call {@link authorize} before making API requests.\n   * @param options - Configuration including credentials, realm, and transport settings.\n   */\n  constructor(options: B2ClientOptions) {\n    this.applicationKeyId = options.applicationKeyId\n    this.applicationKey = options.applicationKey\n    this.realmUrl = getRealmUrl(options.realm ?? 'production')\n    this.accountInfo = options.accountInfo ?? new InMemoryAccountInfo()\n    bindAccountInfoAuthContext(this.accountInfo, this.realmUrl, this.applicationKeyId)\n    this.userAllowedSuffixes = options.allowedHostSuffixes\n    this.resolvedUploadRetryOptions = { ...DEFAULT_RETRY_OPTIONS, ...options.retry }\n    this.reauthCoalescer = new ReauthCoalescer((signal) => this.doReauthorize(signal))\n\n    let baseTransport: HttpTransport\n    if (options.transport !== undefined) {\n      baseTransport = options.transport\n      this.urlGuard = null\n    } else {\n      const urlGuard = new UrlGuard()\n      baseTransport = new FetchTransport({\n        urlGuard,\n        ...(options.userAgent !== undefined ? { userAgent: options.userAgent } : {}),\n        ...(options.followSameOriginRedirects !== undefined\n          ? { followSameOriginRedirects: options.followSameOriginRedirects }\n          : {}),\n      })\n      this.urlGuard = urlGuard\n    }\n\n    const retryTransport = new RetryTransport({\n      transport: baseTransport,\n      retry: this.resolvedUploadRetryOptions,\n      onReauth: (signal) => this.reauthorize(signal),\n    })\n\n    const cachedAuth = this.accountInfo.getAuth()\n    if (cachedAuth !== null) this.lockUrlGuard(cachedAuth)\n\n    this.raw = new RawClient({ transport: retryTransport })\n  }\n\n  /**\n   * Authenticates with B2 and stores the authorization state. Must be called before other methods.\n   *\n   * @param options - Optional request controls.\n   *\n   * @returns The authorization response containing tokens, URLs, and capabilities.\n   */\n  async authorize(options?: B2ClientAuthorizeOptions): Promise<AuthorizeAccountResponse> {\n    throwIfSignalAborted(options?.signal)\n    const auth = await this.raw.authorizeAccount(\n      this.applicationKeyId,\n      this.applicationKey,\n      this.realmUrl,\n      options?.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n    throwIfSignalAborted(options?.signal)\n    this.accountInfo.setAuth(auth)\n    this.lockUrlGuard(auth)\n    return auth\n  }\n\n  private lockUrlGuard(auth: AuthorizeAccountResponse): void {\n    if (this.urlGuard !== null) {\n      const derived = deriveAllowedSuffixes(auth.apiInfo.storageApi)\n      const merged =\n        this.userAllowedSuffixes !== undefined\n          ? this.userAllowedSuffixes.length === 0\n            ? []\n            : Array.from(new Set([...derived, ...this.userAllowedSuffixes]))\n          : derived\n      this.urlGuard.setAllowedSuffixes(merged)\n    }\n  }\n\n  /**\n   * Refresh credentials after a 401. Returns the fresh auth token so\n   * {@link RetryTransport} can rewrite the in-flight request's\n   * Authorization header before retrying.\n   *\n   * @param signal - Optional abort signal for the request that triggered reauthorization.\n   *\n   * @returns The fresh authorization token.\n   */\n  private reauthorize(signal: AbortSignal | undefined): Promise<string> {\n    return this.reauthCoalescer.run(signal)\n  }\n\n  private async doReauthorize(signal: AbortSignal): Promise<string> {\n    const auth = await this.authorize({ signal })\n    return auth.authorizationToken\n  }\n\n  /**\n   * Creates a new B2 bucket.\n   * @param options - Bucket configuration including name, type, and optional settings.\n   *\n   * @returns A {@link Bucket} handle for the newly created bucket.\n   */\n  async createBucket(options: {\n    /** Globally unique bucket name (6-63 chars; letters, digits, hyphens, periods). */\n    bucketName: string\n    /** Access level: `\"allPrivate\"` or `\"allPublic\"`. */\n    bucketType: BucketType\n    /**\n     * Custom key-value metadata stored with the bucket. Keys must be 1-50\n     * UTF-8 bytes, must not start with `b2-`, and all values together must be\n     * at most 10,000 UTF-8 bytes. Keys must match\n     * {@link BUCKET_INFO_KEY_PATTERN}. There is no bucketInfo pair-count cap.\n     */\n    bucketInfo?: Record<string, string>\n    /**\n     * CORS rules for browser-based access. A bucket may have at most 100\n     * rules; rule names must be unique, 6-63 characters, match\n     * `[A-Za-z0-9-]`, and not start with `b2-`. Each rule must be less than\n     * 1,000 UTF-8 bytes across its name, origins, operations, allowed headers,\n     * and exposed headers. `maxAgeSeconds` must be at most 86,400.\n     */\n    corsRules?: CorsRule[]\n    /** Default server-side encryption for new files. */\n    defaultServerSideEncryption?: BucketDefaultServerSideEncryptionSetting\n    /** Default retention policy for new files (requires file lock). */\n    defaultRetention?: BucketRetentionPolicy\n    /** Enable file lock (Object Lock) on the bucket. Cannot be disabled once set. */\n    fileLockEnabled?: boolean\n    /** Lifecycle rules for automatic file deletion or hiding. */\n    lifecycleRules?: LifecycleRule[]\n    /** Cross-region replication configuration. */\n    replicationConfiguration?: ReplicationConfiguration\n  }): Promise<Bucket> {\n    const {\n      bucketInfo,\n      bucketName,\n      bucketType,\n      corsRules,\n      defaultRetention,\n      defaultServerSideEncryption,\n      fileLockEnabled,\n      lifecycleRules,\n      replicationConfiguration,\n    } = options\n    const request: CreateBucketRequest = {\n      ...(bucketInfo !== undefined ? { bucketInfo } : {}),\n      bucketName,\n      bucketType,\n      ...(corsRules !== undefined ? { corsRules } : {}),\n      ...(defaultServerSideEncryption !== undefined ? { defaultServerSideEncryption } : {}),\n      ...(defaultRetention !== undefined ? { defaultRetention } : {}),\n      ...(fileLockEnabled !== undefined ? { fileLockEnabled } : {}),\n      ...(lifecycleRules !== undefined ? { lifecycleRules } : {}),\n      ...(replicationConfiguration !== undefined ? { replicationConfiguration } : {}),\n      accountId: accountId(this.accountInfo.getAccountId()),\n    }\n    const info = await this.raw.createBucket(\n      this.accountInfo.getApiUrl(),\n      this.accountInfo.getAuthToken(),\n      request,\n    )\n    return new Bucket(this, info, this.resolvedUploadRetryOptions)\n  }\n\n  /**\n   * Lists buckets in the account, optionally filtered by ID, name, or type.\n   * @param options - Optional filters for bucket ID, name, or type.\n   *\n   * @returns An array of {@link Bucket} handles.\n   */\n  async listBuckets(options?: {\n    /** Filter to a specific bucket by ID. */\n    bucketId?: BucketId\n    /** Filter to a specific bucket by name. */\n    bucketName?: string\n    /** Filter by bucket types (e.g., `[\"allPrivate\"]`, `[\"shared\"]`, or `[\"all\"]`). */\n    bucketTypes?: BucketTypesFilter\n  }): Promise<Bucket[]> {\n    const resp = await this.raw.listBuckets(\n      this.accountInfo.getApiUrl(),\n      this.accountInfo.getAuthToken(),\n      {\n        accountId: accountId(this.accountInfo.getAccountId()),\n        ...options,\n      },\n    )\n    return resp.buckets.map((info) => new Bucket(this, info, this.resolvedUploadRetryOptions))\n  }\n\n  /**\n   * Looks up a single bucket by name.\n   * @param bucketName - The name of the bucket to find.\n   *\n   * @returns The {@link Bucket} handle, or `null` if not found.\n   */\n  async getBucket(bucketName: string): Promise<Bucket | null> {\n    const buckets = await this.listBuckets({ bucketName })\n    const filteredMatch = buckets[0]\n    if (filteredMatch !== undefined) return filteredMatch\n\n    const unfilteredBuckets = await this.listBuckets()\n    return unfilteredBuckets.find((bucket) => bucket.name === bucketName) ?? null\n  }\n\n  /**\n   * Permanently deletes a bucket. The bucket must be empty.\n   * @param id - The unique identifier of the bucket to delete.\n   *\n   * @returns The deleted bucket metadata.\n   */\n  async deleteBucket(id: BucketId): Promise<BucketInfo> {\n    return this.raw.deleteBucket(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      bucketId: id,\n    })\n  }\n\n  /**\n   * Creates a new application key with the specified capabilities.\n   * @param options - Key configuration including capabilities, name, and optional restrictions.\n   *\n   * @returns The full key including the secret (only returned at creation time).\n   */\n  async createKey(options: CreateKeyOptions): Promise<FullApplicationKey> {\n    return this.raw.createKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...options,\n    })\n  }\n\n  /**\n   * Lists application keys in the account.\n   * @param options - Optional pagination settings.\n   *\n   * @returns A page of application keys with an optional continuation token.\n   */\n  async listKeys(options?: {\n    /**\n     * Maximum number of keys to return per request. Forwarded to the\n     * raw API's `maxKeyCount` parameter.\n     */\n    pageSize?: number\n    /** Start listing at this key ID, usually from `nextApplicationKeyId`. */\n    startApplicationKeyId?: ApplicationKeyId\n  }): Promise<ListKeysResponse> {\n    return this.raw.listKeys(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      accountId: accountId(this.accountInfo.getAccountId()),\n      ...(options?.pageSize !== undefined ? { maxKeyCount: options.pageSize } : {}),\n      ...(options?.startApplicationKeyId !== undefined\n        ? { startApplicationKeyId: options.startApplicationKeyId }\n        : {}),\n    })\n  }\n\n  /**\n   * Async iterator that yields every application key on the account,\n   * automatically handling pagination via `listKeys`.\n   *\n   * @param options - Pagination + abort options. `pageSize` is forwarded\n   *   to `maxKeyCount`; the default is 1000.\n   *\n   * @returns An async iterable of {@link ApplicationKey} entries.\n   *\n   * @example\n   * ```ts\n   * for await (const key of client.paginateKeys()) {\n   *   console.log(key.keyName, key.capabilities)\n   * }\n   * ```\n   */\n  paginateKeys(options?: PaginatorOptions): AsyncIterableIterator<ApplicationKey> {\n    return paginateItems(\n      async (cursor: ApplicationKeyId | undefined) => {\n        const resp = await this.listKeys({\n          pageSize: options?.pageSize ?? DEFAULT_PAGE_SIZE,\n          ...(cursor !== undefined ? { startApplicationKeyId: cursor } : {}),\n        })\n        return { page: resp, nextCursor: resp.nextApplicationKeyId ?? undefined }\n      },\n      (page) => page.keys,\n      options?.signal,\n    )\n  }\n\n  /**\n   * Permanently deletes an application key.\n   * @param applicationKeyId - The unique identifier of the key to delete.\n   *\n   * @returns The deleted application key metadata.\n   */\n  async deleteKey(applicationKeyId: ApplicationKeyId): Promise<ApplicationKey> {\n    return this.raw.deleteKey(this.accountInfo.getApiUrl(), this.accountInfo.getAuthToken(), {\n      applicationKeyId,\n    })\n  }\n\n  /**\n   * Checks whether the authorized application key carries every capability in\n   * `needed`. Returns the missing capabilities so callers can fail fast with a\n   * clear error instead of a generic 401/403 from the server.\n   *\n   * @param needed - The capabilities required by the planned operation.\n   *\n   * @returns An object with `ok: true` when every needed capability is\n   *   present, otherwise `{ ok: false, missing: [...] }`.\n   *\n   * @throws If {@link authorize} has not been called yet.\n   */\n  hasCapabilities(needed: readonly Capability[]): CapabilityCheckResult {\n    const auth = this.accountInfo.getAuth()\n    if (!auth) throw new Error('Not authorized. Call authorize() first.')\n    const available = new Set<string>(auth.apiInfo.storageApi.allowed.capabilities)\n    const missing = needed.filter((cap) => !available.has(cap as string))\n    return { ok: missing.length === 0, missing }\n  }\n}\n\nfunction bindAccountInfoAuthContext(\n  accountInfo: AccountInfo,\n  realmUrl: string,\n  applicationKeyId: string,\n): void {\n  accountInfo.setApplicationKeyId?.(applicationKeyId)\n  accountInfo.setRealmUrl?.(realmUrl)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4GA,IAAa,WAAb,MAAsB;;CAEpB;;CAEA;;;;;;CAMA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;CAMA,YAAY,SAA0B;EACpC,KAAK,mBAAmB,QAAQ;EAChC,KAAK,iBAAiB,QAAQ;EAC9B,KAAK,WAAW,YAAY,QAAQ,SAAS,YAAY;EACzD,KAAK,cAAc,QAAQ,eAAe,IAAI,oBAAoB;EAClE,2BAA2B,KAAK,aAAa,KAAK,UAAU,KAAK,gBAAgB;EACjF,KAAK,sBAAsB,QAAQ;EACnC,KAAK,6BAA6B;GAAE,GAAG;GAAuB,GAAG,QAAQ;EAAM;EAC/E,KAAK,kBAAkB,IAAI,iBAAiB,WAAW,KAAK,cAAc,MAAM,CAAC;EAEjF,IAAI;EACJ,IAAI,QAAQ,cAAc,KAAA,GAAW;GACnC,gBAAgB,QAAQ;GACxB,KAAK,WAAW;EAClB,OAAO;GACL,MAAM,WAAW,IAAI,SAAS;GAC9B,gBAAgB,IAAI,eAAe;IACjC;IACA,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC1E,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;GACP,CAAC;GACD,KAAK,WAAW;EAClB;EAEA,MAAM,iBAAiB,IAAI,eAAe;GACxC,WAAW;GACX,OAAO,KAAK;GACZ,WAAW,WAAW,KAAK,YAAY,MAAM;EAC/C,CAAC;EAED,MAAM,aAAa,KAAK,YAAY,QAAQ;EAC5C,IAAI,eAAe,MAAM,KAAK,aAAa,UAAU;EAErD,KAAK,MAAM,IAAI,UAAU,EAAE,WAAW,eAAe,CAAC;CACxD;;;;;;;;CASA,MAAM,UAAU,SAAuE;EACrF,qBAAqB,SAAS,MAAM;EACpC,MAAM,OAAO,MAAM,KAAK,IAAI,iBAC1B,KAAK,kBACL,KAAK,gBACL,KAAK,UACL,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC/D;EACA,qBAAqB,SAAS,MAAM;EACpC,KAAK,YAAY,QAAQ,IAAI;EAC7B,KAAK,aAAa,IAAI;EACtB,OAAO;CACT;CAEA,aAAqB,MAAsC;EACzD,IAAI,KAAK,aAAa,MAAM;GAC1B,MAAM,UAAU,sBAAsB,KAAK,QAAQ,UAAU;GAC7D,MAAM,SACJ,KAAK,wBAAwB,KAAA,IACzB,KAAK,oBAAoB,WAAW,IAClC,CAAC,IACD,MAAM,qBAAK,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK,mBAAmB,CAAC,CAAC,IAC/D;GACN,KAAK,SAAS,mBAAmB,MAAM;EACzC;CACF;;;;;;;;;;CAWA,YAAoB,QAAkD;EACpE,OAAO,KAAK,gBAAgB,IAAI,MAAM;CACxC;CAEA,MAAc,cAAc,QAAsC;EAEhE,QAAO,MADY,KAAK,UAAU,EAAE,OAAO,CAAC,EAAA,CAChC;CACd;;;;;;;CAQA,MAAM,aAAa,SA8BC;EAClB,MAAM,EACJ,YACA,YACA,YACA,WACA,kBACA,6BACA,iBACA,gBACA,6BACE;EACJ,MAAM,UAA+B;GACnC,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;GACjD;GACA;GACA,GAAI,cAAc,KAAA,IAAY,EAAE,UAAU,IAAI,CAAC;GAC/C,GAAI,gCAAgC,KAAA,IAAY,EAAE,4BAA4B,IAAI,CAAC;GACnF,GAAI,qBAAqB,KAAA,IAAY,EAAE,iBAAiB,IAAI,CAAC;GAC7D,GAAI,oBAAoB,KAAA,IAAY,EAAE,gBAAgB,IAAI,CAAC;GAC3D,GAAI,mBAAmB,KAAA,IAAY,EAAE,eAAe,IAAI,CAAC;GACzD,GAAI,6BAA6B,KAAA,IAAY,EAAE,yBAAyB,IAAI,CAAC;GAC7E,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;EACtD;EACA,MAAM,OAAO,MAAM,KAAK,IAAI,aAC1B,KAAK,YAAY,UAAU,GAC3B,KAAK,YAAY,aAAa,GAC9B,OACF;EACA,OAAO,IAAI,OAAO,MAAM,MAAM,KAAK,0BAA0B;CAC/D;;;;;;;CAQA,MAAM,YAAY,SAOI;EASpB,QAAO,MARY,KAAK,IAAI,YAC1B,KAAK,YAAY,UAAU,GAC3B,KAAK,YAAY,aAAa,GAC9B;GACE,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAG;EACL,CACF,EAAA,CACY,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,MAAM,KAAK,0BAA0B,CAAC;CAC3F;;;;;;;CAQA,MAAM,UAAU,YAA4C;EAE1D,MAAM,iBAAgB,MADA,KAAK,YAAY,EAAE,WAAW,CAAC,EAAA,CACvB;EAC9B,IAAI,kBAAkB,KAAA,GAAW,OAAO;EAGxC,QAAO,MADyB,KAAK,YAAY,EAAA,CACxB,MAAM,WAAW,OAAO,SAAS,UAAU,KAAK;CAC3E;;;;;;;CAQA,MAAM,aAAa,IAAmC;EACpD,OAAO,KAAK,IAAI,aAAa,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GAC1F,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,UAAU;EACZ,CAAC;CACH;;;;;;;CAQA,MAAM,UAAU,SAAwD;EACtE,OAAO,KAAK,IAAI,UAAU,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GACvF,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAG;EACL,CAAC;CACH;;;;;;;CAQA,MAAM,SAAS,SAQe;EAC5B,OAAO,KAAK,IAAI,SAAS,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG;GACtF,WAAW,UAAU,KAAK,YAAY,aAAa,CAAC;GACpD,GAAI,SAAS,aAAa,KAAA,IAAY,EAAE,aAAa,QAAQ,SAAS,IAAI,CAAC;GAC3E,GAAI,SAAS,0BAA0B,KAAA,IACnC,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;EACP,CAAC;CACH;;;;;;;;;;;;;;;;;CAkBA,aAAa,SAAmE;EAC9E,OAAO,cACL,OAAO,WAAyC;GAC9C,MAAM,OAAO,MAAM,KAAK,SAAS;IAC/B,UAAU,SAAS,YAAA;IACnB,GAAI,WAAW,KAAA,IAAY,EAAE,uBAAuB,OAAO,IAAI,CAAC;GAClE,CAAC;GACD,OAAO;IAAE,MAAM;IAAM,YAAY,KAAK,wBAAwB,KAAA;GAAU;EAC1E,IACC,SAAS,KAAK,MACf,SAAS,MACX;CACF;;;;;;;CAQA,MAAM,UAAU,kBAA6D;EAC3E,OAAO,KAAK,IAAI,UAAU,KAAK,YAAY,UAAU,GAAG,KAAK,YAAY,aAAa,GAAG,EACvF,iBACF,CAAC;CACH;;;;;;;;;;;;;CAcA,gBAAgB,QAAsD;EACpE,MAAM,OAAO,KAAK,YAAY,QAAQ;EACtC,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,yCAAyC;EACpE,MAAM,YAAY,IAAI,IAAY,KAAK,QAAQ,WAAW,QAAQ,YAAY;EAC9E,MAAM,UAAU,OAAO,QAAQ,QAAQ,CAAC,UAAU,IAAI,GAAa,CAAC;EACpE,OAAO;GAAE,IAAI,QAAQ,WAAW;GAAG;EAAQ;CAC7C;AACF;AAEA,SAAS,2BACP,aACA,UACA,kBACM;CACN,YAAY,sBAAsB,gBAAgB;CAClD,YAAY,cAAc,QAAQ;AACpC"}

package/dist/download/single.cjs

@@ -154,12 +154,11 @@ function emptyStream() {
 * @returns A stream wrapped for checksum verification and progress reporting.
 */
 function prepareDownloadBody(body, headers, options) {
-	return instrumentProgress(options.method !== "HEAD" && options.range === void 0 ? require_checksum.verifyDownloadStream(body, headers.contentSha1) : body, headers.contentLength, options.onProgress);
+	return instrumentProgress(options.method !== "HEAD" && options.range === void 0 ? require_checksum.verifyDownloadStream(body, headers.contentSha1) : body, headers.contentLength, options.onProgress, options.progressIntervalMillis);
 }
 /**
-* Wraps a body stream with a `TransformStream` that increments a
-* {@link ProgressTracker} for each chunk and reports `partsCompleted: 1`
-* when the stream finishes.
+* Wraps a body stream so the SDK increments a {@link ProgressTracker} for
+* each chunk and reports `partsCompleted: 1` when the stream finishes.
 *
 * When `listener` is undefined the function short-circuits and returns
 * the original stream, so unobserved downloads pay no overhead.
@@ -167,22 +166,48 @@ function prepareDownloadBody(body, headers, options) {
 * @param body - The download response body to wrap.
 * @param totalBytes - Expected total bytes (response `Content-Length`).
 * @param listener - Caller-supplied progress callback, or undefined.
+* @param progressIntervalMillis - Optional byte-progress throttle interval.
 *
 * @returns A stream that emits the same bytes and reports progress.
 */
-function instrumentProgress(body, totalBytes, listener) {
+function instrumentProgress(body, totalBytes, listener, progressIntervalMillis) {
 	if (listener === void 0) return body;
-	const tracker = new require_progress.ProgressTracker(listener, totalBytes, 1);
-	const transform = new TransformStream({
-		transform(chunk, controller) {
-			tracker.addBytes(chunk.byteLength);
-			controller.enqueue(chunk);
+	const tracker = new require_progress.ProgressTracker(listener, totalBytes, 1, { ...progressIntervalMillis !== void 0 ? { minIntervalMs: progressIntervalMillis } : {} });
+	const reader = body.getReader();
+	let released = false;
+	function releaseReader() {
+		if (released) return;
+		released = true;
+		reader.releaseLock();
+	}
+	return new ReadableStream({
+		async pull(controller) {
+			try {
+				const { done, value } = await reader.read();
+				if (done) {
+					tracker.completePart();
+					tracker.dispose();
+					releaseReader();
+					controller.close();
+					return;
+				}
+				tracker.addBytes(value.byteLength);
+				controller.enqueue(value);
+			} catch (err) {
+				tracker.dispose();
+				releaseReader();
+				throw err;
+			}
 		},
-		flush() {
-			tracker.completePart();
+		async cancel(reason) {
+			tracker.dispose();
+			try {
+				await reader.cancel(reason);
+			} finally {
+				releaseReader();
+			}
 		}
 	});
-	return body.pipeThrough(transform);
 }
 /**
 * Extracts B2-specific download headers into a structured object.