@backblaze-labs/b2-sdk 0.1.0 → 0.3.0

package/dist/object.js.map

@@ -1 +1 @@
-{"version":3,"file":"object.js","sources":["../src/object.ts"],"sourcesContent":["import type { Bucket } from './bucket.ts'\nimport type { B2Client } from './client.ts'\nimport { createParallelDownloadStream } from './download/parallel.ts'\nimport { type DownloadResult, downloadByName } from './download/single.ts'\nimport { type HeadResult, downloadById, headById, headByName } from './download/single.ts'\nimport type { SseCDownloadKey } from './raw/index.ts'\nimport type { ProgressListener } from './streams/progress.ts'\nimport type { ContentSource } from './streams/source.ts'\nimport type { EncryptionSetting } from './types/encryption.ts'\nimport type { FileVersion } from './types/file.ts'\nimport type { FileId, LargeFileId } from './types/ids.ts'\nimport type { FileRetentionValue, LegalHoldValue } from './types/lock.ts'\nimport { uploadLargeFile } from './upload/large.ts'\nimport { uploadSmallFile } from './upload/single.ts'\nimport { type UploadWriteHandle, createWriteStream } from './upload/stream.ts'\n\n/** Options accepted by {@link B2Object.download} and {@link B2Object.downloadById}. */\nexport interface DownloadCallOptions {\n  /**\n   * HTTP method. Defaults to `'GET'`. Use `'HEAD'` to fetch only\n   * response headers. Prefer the dedicated {@link B2Object.head} /\n   * {@link Bucket.head} method over this option — those return a\n   * body-less result so callers never have to remember to drain the\n   * empty body of a HEAD response.\n   */\n  readonly method?: 'GET' | 'HEAD'\n  /** HTTP Range header value (e.g., `\"bytes=0-999\"`). */\n  readonly range?: string\n  /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */\n  readonly serverSideEncryption?: SseCDownloadKey\n  /** Override the response `Content-Disposition` header. */\n  readonly b2ContentDisposition?: string\n  /** Override the response `Content-Language` header. */\n  readonly b2ContentLanguage?: string\n  /** Override the response `Content-Encoding` header. */\n  readonly b2ContentEncoding?: string\n  /** Override the response `Content-Type` header. */\n  readonly b2ContentType?: string\n  /** Override the response `Cache-Control` header. */\n  readonly b2CacheControl?: string\n  /** Override the response `Expires` header. */\n  readonly b2Expires?: string\n  /** Abort signal for cancelling the download. */\n  readonly signal?: AbortSignal\n  /**\n   * Callback invoked as the response body is consumed.\n   *\n   * Progress is byte-driven, not request-driven: the callback fires per\n   * chunk as the caller reads the returned `body` stream, and the final\n   * `partsCompleted: 1` event only fires once the stream is read to\n   * completion. Downloads that are dropped or aborted partway through\n   * will NOT emit a `completePart()` event.\n   */\n  readonly onProgress?: ProgressListener\n}\n\n/**\n * Options accepted by {@link B2Object.head} / {@link Bucket.head}.\n * Same shape as {@link DownloadCallOptions} minus `method` (always\n * HEAD) and `onProgress` (no body to track).\n */\nexport type HeadCallOptions = Omit<DownloadCallOptions, 'method' | 'onProgress'>\n\n/**\n * Handle to a specific file (by name) within a B2 bucket.\n *\n * Provides file-scoped upload, download, and management operations.\n * Obtained via {@link Bucket.file}.\n *\n * @example\n * ```ts\n * const obj = bucket.file('photos/2026/sunset.jpg')\n * await obj.upload({ source: new BufferSource(data) })\n * const result = await obj.download()\n * ```\n */\nexport class B2Object {\n  /** The file name (path) within the bucket. */\n  readonly fileName: string\n  private readonly client: B2Client\n  private readonly bucket: Bucket\n\n  /**\n   * @param client - The parent B2Client instance.\n   * @param bucket - The parent Bucket this object belongs to.\n   * @param fileName - The file path within the bucket.\n   *\n   * @internal\n   */\n  constructor(client: B2Client, bucket: Bucket, fileName: string) {\n    this.client = client\n    this.bucket = bucket\n    this.fileName = fileName\n  }\n\n  /**\n   * Uploads data to this file name. Automatically uses multipart upload for large files.\n   * @param options - Upload configuration including data source and optional settings.\n   *\n   * @returns Metadata for the uploaded file version.\n   */\n  async upload(options: {\n    /** Data source to upload. */\n    source: ContentSource\n    /** MIME type. Defaults to auto-detection by B2. */\n    contentType?: string\n    /** Custom key-value metadata stored with the file. */\n    fileInfo?: Record<string, string>\n    /** Server-side encryption settings. */\n    serverSideEncryption?: EncryptionSetting\n    /** File retention policy (requires file lock). */\n    fileRetention?: FileRetentionValue\n    /** Legal hold status. */\n    legalHold?: LegalHoldValue\n    /** Last-modified timestamp in milliseconds since epoch. */\n    lastModifiedMillis?: number\n    /** Part size override for multipart uploads, in bytes. */\n    partSize?: number\n    /** Number of concurrent part uploads for large files. */\n    concurrency?: number\n    /** Callback invoked with upload progress events. */\n    onProgress?: ProgressListener\n    /** Abort signal for cancelling the upload. */\n    signal?: AbortSignal\n    /**\n     * Resume an unfinished multipart upload for this file name when one\n     * exists. Only meaningful on the large-file path. Ignored on the\n     * small-file path.\n     */\n    resume?: boolean\n    /**\n     * Resume into a specific large-file ID, bypassing discovery.\n     * Overrides the `resume` discovery path.\n     */\n    resumeFileId?: LargeFileId\n  }): Promise<FileVersion> {\n    const recommendedPartSize = this.client.accountInfo.getRecommendedPartSize()\n    const isLarge = options.source.size > recommendedPartSize\n\n    if (isLarge) {\n      return uploadLargeFile(this.client.raw, this.client.accountInfo, {\n        bucketId: this.bucket.id,\n        fileName: this.fileName,\n        ...options,\n      })\n    }\n\n    // Small-file path doesn't accept resume options.\n    const { resume: _resume, resumeFileId: _resumeFileId, ...smallOptions } = options\n    return uploadSmallFile(this.client.raw, this.client.accountInfo, {\n      bucketId: this.bucket.id,\n      fileName: this.fileName,\n      ...smallOptions,\n    })\n  }\n\n  /**\n   * Downloads this file by name. Pass `method: 'HEAD'` to fetch only the\n   * response headers (file metadata) without streaming the body.\n   * @param options - Optional method, range, SSE-C decryption, response-header overrides, and abort signal.\n   *\n   * @returns The download result with response headers and body stream.\n   */\n  async download(options?: DownloadCallOptions): Promise<DownloadResult> {\n    return downloadByName(this.client.raw, this.client.accountInfo, {\n      bucketName: this.bucket.name,\n      fileName: this.fileName,\n      ...options,\n    })\n  }\n\n  /**\n   * Fetches response headers for this file via HTTP HEAD. Returns a\n   * body-less result so callers never have to drain the (logically\n   * empty) HEAD body themselves.\n   *\n   * @param options - Optional range, SSE-C decryption, response-header\n   *   overrides, and abort signal. Same shape as {@link B2Object.download}'s\n   *   options minus `method` (always HEAD) and `onProgress` (no body).\n   *\n   * @returns Parsed download headers (content type, SHA-1, file info, etc.).\n   */\n  async head(options?: HeadCallOptions): Promise<HeadResult> {\n    return headByName(this.client.raw, this.client.accountInfo, {\n      bucketName: this.bucket.name,\n      fileName: this.fileName,\n      ...options,\n    })\n  }\n\n  /**\n   * Downloads a specific version of this file by ID. Pass `method: 'HEAD'`\n   * to fetch only the response headers (file metadata) without streaming the body.\n   * @param fileId - The file version ID to download.\n   * @param options - Optional method, range, SSE-C decryption, response-header overrides, and abort signal.\n   *\n   * @returns The download result with response headers and body stream.\n   */\n  async downloadById(fileId: FileId, options?: DownloadCallOptions): Promise<DownloadResult> {\n    return downloadById(this.client.raw, this.client.accountInfo, {\n      fileId,\n      ...options,\n    })\n  }\n\n  /**\n   * Fetches response headers for a specific version of this file by ID\n   * via HTTP HEAD. Returns a body-less result so callers never have to\n   * drain the (logically empty) HEAD body themselves.\n   *\n   * @param fileId - The file version ID to inspect.\n   * @param options - Optional range, SSE-C decryption, response-header\n   *   overrides, and abort signal.\n   *\n   * @returns Parsed download headers.\n   */\n  async headById(fileId: FileId, options?: HeadCallOptions): Promise<HeadResult> {\n    return headById(this.client.raw, this.client.accountInfo, {\n      fileId,\n      ...options,\n    })\n  }\n\n  /**\n   * Creates a parallel-download ReadableStream that fetches the file in concurrent ranged chunks.\n   * @param fileId - The file version ID to download.\n   * @param totalSize - Total file size in bytes (needed to compute range boundaries).\n   * @param options - Concurrency, range size, and abort signal.\n   *\n   * @returns A Web ReadableStream of file data in sequential order.\n   */\n  createReadStream(\n    fileId: FileId,\n    totalSize: number,\n    options?: {\n      /** Size of each ranged GET request in bytes. Defaults to 8 MB. */\n      rangeSize?: number\n      /** Number of concurrent range requests. Defaults to 4. */\n      concurrency?: number\n      /** Abort signal for cancelling the download. */\n      signal?: AbortSignal\n    },\n  ): ReadableStream<Uint8Array> {\n    return createParallelDownloadStream(this.client.raw, this.client.accountInfo, {\n      fileId,\n      totalSize,\n      ...options,\n    })\n  }\n\n  /**\n   * Creates a Web `WritableStream` that uploads streamed data into this file\n   * using the multipart protocol. Pipe a `ReadableStream<Uint8Array>` into the\n   * returned `writable` and await `done` to get the final {@link FileVersion}.\n   *\n   * Note: streaming uploads do not support resume because the size and per-part\n   * hashes are not known in advance. Use {@link upload} with a buffered source\n   * when resume is required.\n   *\n   * @param options - Streaming upload parameters (part size, concurrency, encryption).\n   *\n   * @returns A handle with the writable sink and a completion promise.\n   */\n  createWriteStream(options?: {\n    /** MIME type. Defaults to `b2/x-auto`. */\n    contentType?: string\n    /** Custom key-value metadata stored with the file. */\n    fileInfo?: Record<string, string>\n    /** Server-side encryption applied to each part. */\n    serverSideEncryption?: EncryptionSetting\n    /** Target part size in bytes. Defaults to the account's recommended part size. */\n    partSize?: number\n    /** Maximum number of parts uploaded in parallel. Defaults to 4. */\n    concurrency?: number\n    /** Callback invoked with upload progress events. */\n    onProgress?: ProgressListener\n    /** Abort signal that cancels the upload and the unfinished large file. */\n    signal?: AbortSignal\n  }): UploadWriteHandle {\n    return createWriteStream(this.client.raw, this.client.accountInfo, {\n      bucketId: this.bucket.id,\n      fileName: this.fileName,\n      ...(options ?? {}),\n    })\n  }\n\n  /**\n   * Retrieves metadata for a specific file version.\n   * @param fileId - The file version ID to look up.\n   *\n   * @returns The file version metadata.\n   */\n  async getFileInfo(fileId: FileId): Promise<FileVersion> {\n    return this.client.raw.getFileInfo(\n      this.client.accountInfo.getApiUrl(),\n      this.client.accountInfo.getAuthToken(),\n      { fileId },\n    )\n  }\n\n  /**\n   * Hides this file by creating a hide marker at this file name.\n   *\n   * @returns Metadata for the newly created hide marker.\n   */\n  async hide(): Promise<FileVersion> {\n    return this.bucket.hideFile(this.fileName)\n  }\n\n  /**\n   * Permanently deletes a specific version of this file.\n   * @param fileId - The unique identifier of the file version to delete.\n   */\n  async deleteVersion(fileId: FileId): Promise<void> {\n    await this.bucket.deleteFileVersion(this.fileName, fileId)\n  }\n\n  /**\n   * Sets or updates the Object Lock retention policy on a specific file\n   * version of this file.\n   *\n   * The bucket must have Object Lock enabled (`fileLockEnabled: true` at\n   * creation time). Governance-mode retention can be shortened or removed\n   * by passing `bypassGovernance: true` together with an application key\n   * that carries the `bypassGovernance` capability; compliance-mode\n   * retention cannot be shortened by anyone until the\n   * `retainUntilTimestamp` elapses.\n   *\n   * @param fileId - The file version to apply the policy to.\n   * @param retention - The retention policy to apply.\n   * @param options - Optional flag for shortening governance-mode retention.\n   *\n   * @returns Metadata for the updated file version.\n   */\n  async setRetention(\n    fileId: FileId,\n    retention: FileRetentionValue,\n    options?: { bypassGovernance?: boolean },\n  ) {\n    return this.bucket.updateFileRetention(this.fileName, fileId, retention, options)\n  }\n\n  /**\n   * Toggles the legal hold flag on a specific file version of this file.\n   *\n   * Legal hold is independent of retention: a file can be on legal hold\n   * without any retention policy, and vice versa. The bucket must have\n   * Object Lock enabled, and any caller must hold the `writeFileLegalHolds`\n   * capability.\n   *\n   * @param fileId - The file version to apply the flag to.\n   * @param legalHold - `'on'` to apply the hold, `'off'` to remove it.\n   *\n   * @returns Metadata for the updated file version.\n   */\n  async setLegalHold(fileId: FileId, legalHold: LegalHoldValue) {\n    return this.bucket.updateFileLegalHold(this.fileName, fileId, legalHold)\n  }\n}\n"],"names":[],"mappings":";;;;;AA4EO,MAAM,SAAS;AAAA;AAAA,EAEX;AAAA,EACQ;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjB,YAAY,QAAkB,QAAgB,UAAkB;AAC9D,SAAK,SAAS;AACd,SAAK,SAAS;AACd,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,SAkCY;AACvB,UAAM,sBAAsB,KAAK,OAAO,YAAY,uBAAA;AACpD,UAAM,UAAU,QAAQ,OAAO,OAAO;AAEtC,QAAI,SAAS;AACX,aAAO,gBAAgB,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;AAAA,QAC/D,UAAU,KAAK,OAAO;AAAA,QACtB,UAAU,KAAK;AAAA,QACf,GAAG;AAAA,MAAA,CACJ;AAAA,IACH;AAGA,UAAM,EAAE,QAAQ,SAAS,cAAc,eAAe,GAAG,iBAAiB;AAC1E,WAAO,gBAAgB,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;AAAA,MAC/D,UAAU,KAAK,OAAO;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,GAAG;AAAA,IAAA,CACJ;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,SAAS,SAAwD;AACrE,WAAO,eAAe,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;AAAA,MAC9D,YAAY,KAAK,OAAO;AAAA,MACxB,UAAU,KAAK;AAAA,MACf,GAAG;AAAA,IAAA,CACJ;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,KAAK,SAAgD;AACzD,WAAO,WAAW,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;AAAA,MAC1D,YAAY,KAAK,OAAO;AAAA,MACxB,UAAU,KAAK;AAAA,MACf,GAAG;AAAA,IAAA,CACJ;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAa,QAAgB,SAAwD;AACzF,WAAO,aAAa,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;AAAA,MAC5D;AAAA,MACA,GAAG;AAAA,IAAA,CACJ;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,SAAS,QAAgB,SAAgD;AAC7E,WAAO,SAAS,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;AAAA,MACxD;AAAA,MACA,GAAG;AAAA,IAAA,CACJ;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,iBACE,QACA,WACA,SAQ4B;AAC5B,WAAO,6BAA6B,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;AAAA,MAC5E;AAAA,MACA;AAAA,MACA,GAAG;AAAA,IAAA,CACJ;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,kBAAkB,SAeI;AACpB,WAAO,kBAAkB,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;AAAA,MACjE,UAAU,KAAK,OAAO;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,GAAI,WAAW,CAAA;AAAA,IAAC,CACjB;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAY,QAAsC;AACtD,WAAO,KAAK,OAAO,IAAI;AAAA,MACrB,KAAK,OAAO,YAAY,UAAA;AAAA,MACxB,KAAK,OAAO,YAAY,aAAA;AAAA,MACxB,EAAE,OAAA;AAAA,IAAO;AAAA,EAEb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAA6B;AACjC,WAAO,KAAK,OAAO,SAAS,KAAK,QAAQ;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,QAA+B;AACjD,UAAM,KAAK,OAAO,kBAAkB,KAAK,UAAU,MAAM;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,aACJ,QACA,WACA,SACA;AACA,WAAO,KAAK,OAAO,oBAAoB,KAAK,UAAU,QAAQ,WAAW,OAAO;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,aAAa,QAAgB,WAA2B;AAC5D,WAAO,KAAK,OAAO,oBAAoB,KAAK,UAAU,QAAQ,SAAS;AAAA,EACzE;AACF;"}
+{"version":3,"file":"object.js","names":[],"sources":["../src/object.ts"],"sourcesContent":["import type { Bucket } from './bucket.ts'\nimport type { B2Client } from './client.ts'\nimport { createParallelDownloadStream } from './download/parallel.ts'\nimport {\n  type DownloadResult,\n  downloadById,\n  downloadByName,\n  type HeadResult,\n  headById,\n  headByName,\n} from './download/single.ts'\nimport type { RetryOptions } from './http/retry.ts'\nimport { mergeUploadRetryOptions } from './internal/upload-retry-options.ts'\nimport type { SseCDownloadKey } from './raw/index.ts'\nimport type { ProgressListener } from './streams/progress.ts'\nimport type { BucketRetentionPolicy } from './types/bucket.ts'\nimport type { FileVersion } from './types/file.ts'\nimport type { FileId } from './types/ids.ts'\nimport type { FileRetentionValue, LegalHoldValue } from './types/lock.ts'\nimport { uploadLargeFile } from './upload/large.ts'\nimport {\n  type B2ObjectUploadOptions,\n  type B2ObjectWriteStreamOptions,\n  rejectSmallResumeFileId,\n  stripResumeOnlyOptions,\n} from './upload/options.ts'\nimport { uploadSmallFile } from './upload/single.ts'\nimport { createWriteStream, type UploadWriteHandle } from './upload/stream.ts'\n\ninterface BucketDefaultRetentionSnapshot {\n  readonly retention?: BucketRetentionPolicy\n  readonly unreadable: boolean\n}\n\nfunction bucketDefaultRetentionSnapshot(info: Bucket['info']): BucketDefaultRetentionSnapshot {\n  const fileLock = info.fileLockConfiguration\n  if (!fileLock.isClientAuthorizedToRead) return { unreadable: true }\n  if (fileLock.value === null) return { unreadable: false }\n  return { retention: fileLock.value.defaultRetention, unreadable: false }\n}\n\nfunction resumeNeedsFreshBucketDefaults(options: B2ObjectUploadOptions): boolean {\n  const resumeRequested = options.resume === true || options.resumeFileId !== undefined\n  return (\n    resumeRequested &&\n    (options.serverSideEncryption === undefined || options.fileRetention === undefined)\n  )\n}\n\n/** Options accepted by {@link B2Object.download} and {@link B2Object.downloadById}. */\nexport interface DownloadCallOptions {\n  /**\n   * HTTP method. Defaults to `'GET'`. Use `'HEAD'` to fetch only\n   * response headers. Prefer the dedicated {@link B2Object.head} /\n   * {@link Bucket.head} method over this option — those return a\n   * body-less result so callers never have to remember to drain the\n   * empty body of a HEAD response.\n   */\n  readonly method?: 'GET' | 'HEAD'\n  /** HTTP Range header value (e.g., `\"bytes=0-999\"`). */\n  readonly range?: string\n  /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */\n  readonly serverSideEncryption?: SseCDownloadKey\n  /** Override the response `Content-Disposition` header. */\n  readonly b2ContentDisposition?: string\n  /** Override the response `Content-Language` header. */\n  readonly b2ContentLanguage?: string\n  /** Override the response `Content-Encoding` header. */\n  readonly b2ContentEncoding?: string\n  /** Override the response `Content-Type` header. */\n  readonly b2ContentType?: string\n  /** Override the response `Cache-Control` header. */\n  readonly b2CacheControl?: string\n  /** Override the response `Expires` header. */\n  readonly b2Expires?: string\n  /** Abort signal for cancelling the download. */\n  readonly signal?: AbortSignal\n  /**\n   * Callback invoked as the response body is consumed.\n   *\n   * Progress is byte-driven, not request-driven: the callback fires per\n   * chunk as the caller reads the returned `body` stream, and the final\n   * `partsCompleted: 1` event only fires once the stream is read to\n   * completion. Downloads that are dropped or aborted partway through\n   * will NOT emit a `completePart()` event.\n   */\n  readonly onProgress?: ProgressListener\n}\n\n/**\n * Options accepted by {@link B2Object.head} / {@link Bucket.head}.\n * Same shape as {@link DownloadCallOptions} minus `method` (always\n * HEAD) and `onProgress` (no body to track).\n */\nexport type HeadCallOptions = Omit<DownloadCallOptions, 'method' | 'onProgress'>\n\n/**\n * Handle to a specific file (by name) within a B2 bucket.\n *\n * Provides file-scoped upload, download, and management operations.\n * Obtained via {@link Bucket.file}.\n *\n * @example\n * ```ts\n * const obj = bucket.file('photos/2026/sunset.jpg')\n * await obj.upload({ source: new BufferSource(data) })\n * const result = await obj.download()\n * ```\n */\nexport class B2Object {\n  /** The file name (path) within the bucket. */\n  readonly fileName: string\n  private readonly client: B2Client\n  private readonly bucket: Bucket\n  private readonly uploadRetryOptions: RetryOptions\n\n  /**\n   * @param client - The parent B2Client instance.\n   * @param bucket - The parent Bucket this object belongs to.\n   * @param fileName - The file path within the bucket.\n   * @param uploadRetryOptions - Resolved client upload retry defaults.\n   *\n   * @internal\n   */\n  constructor(\n    client: B2Client,\n    bucket: Bucket,\n    fileName: string,\n    uploadRetryOptions: RetryOptions,\n  ) {\n    this.client = client\n    this.bucket = bucket\n    this.fileName = fileName\n    this.uploadRetryOptions = uploadRetryOptions\n  }\n\n  /**\n   * Uploads data to this file name. Automatically uses multipart upload for large files.\n   * @param options - Upload configuration including data source and optional settings.\n   *\n   * @returns Metadata for the uploaded file version.\n   */\n  async upload(options: B2ObjectUploadOptions): Promise<FileVersion> {\n    const recommendedPartSize = this.client.accountInfo.getRecommendedPartSize()\n    const isLarge = options.source.size > recommendedPartSize\n    const uploadRetryOptions = mergeUploadRetryOptions(this.uploadRetryOptions, options.retry)\n\n    if (isLarge) {\n      const bucketInfo = resumeNeedsFreshBucketDefaults(options)\n        ? await this.fetchFreshBucketInfo()\n        : this.bucket.info\n      const bucketDefaultRetention = bucketDefaultRetentionSnapshot(bucketInfo)\n      return uploadLargeFile(this.client.raw, this.client.accountInfo, {\n        ...options,\n        bucketId: this.bucket.id,\n        fileName: this.fileName,\n        retry: uploadRetryOptions,\n        bucketDefaultServerSideEncryption: bucketInfo.defaultServerSideEncryption,\n        ...(bucketDefaultRetention.retention !== undefined\n          ? { bucketDefaultRetention: bucketDefaultRetention.retention }\n          : {}),\n        ...(bucketDefaultRetention.unreadable ? { bucketDefaultRetentionUnreadable: true } : {}),\n      })\n    }\n    rejectSmallResumeFileId(options, 'B2Object.upload')\n    const smallOptions = stripResumeOnlyOptions(options)\n    return uploadSmallFile(this.client.raw, this.client.accountInfo, {\n      ...smallOptions,\n      bucketId: this.bucket.id,\n      fileName: this.fileName,\n      retry: uploadRetryOptions,\n    })\n  }\n\n  private async fetchFreshBucketInfo(): Promise<Bucket['info']> {\n    const fresh = await this.client.listBuckets({ bucketId: this.bucket.id })\n    const found = fresh[0]\n    if (!found) throw new Error(`Bucket ${this.bucket.id} not found`)\n    return found.info\n  }\n\n  /**\n   * Downloads this file by name. Pass `method: 'HEAD'` to fetch only the\n   * response headers (file metadata) without streaming the body.\n   * @param options - Optional method, range, SSE-C decryption, response-header overrides, and abort signal.\n   *\n   * @returns The download result with response headers and body stream.\n   */\n  async download(options?: DownloadCallOptions): Promise<DownloadResult> {\n    return downloadByName(this.client.raw, this.client.accountInfo, {\n      bucketName: this.bucket.name,\n      fileName: this.fileName,\n      ...options,\n    })\n  }\n\n  /**\n   * Fetches response headers for this file via HTTP HEAD. Returns a\n   * body-less result so callers never have to drain the (logically\n   * empty) HEAD body themselves.\n   *\n   * @param options - Optional range, SSE-C decryption, response-header\n   *   overrides, and abort signal. Same shape as {@link B2Object.download}'s\n   *   options minus `method` (always HEAD) and `onProgress` (no body).\n   *\n   * @returns Parsed download headers (content type, SHA-1, file info, etc.).\n   */\n  async head(options?: HeadCallOptions): Promise<HeadResult> {\n    return headByName(this.client.raw, this.client.accountInfo, {\n      bucketName: this.bucket.name,\n      fileName: this.fileName,\n      ...options,\n    })\n  }\n\n  /**\n   * Downloads a specific version of this file by ID. Pass `method: 'HEAD'`\n   * to fetch only the response headers (file metadata) without streaming the body.\n   * @param fileId - The file version ID to download.\n   * @param options - Optional method, range, SSE-C decryption, response-header overrides, and abort signal.\n   *\n   * @returns The download result with response headers and body stream.\n   */\n  async downloadById(fileId: FileId, options?: DownloadCallOptions): Promise<DownloadResult> {\n    return downloadById(this.client.raw, this.client.accountInfo, {\n      fileId,\n      ...options,\n    })\n  }\n\n  /**\n   * Fetches response headers for a specific version of this file by ID\n   * via HTTP HEAD. Returns a body-less result so callers never have to\n   * drain the (logically empty) HEAD body themselves.\n   *\n   * @param fileId - The file version ID to inspect.\n   * @param options - Optional range, SSE-C decryption, response-header\n   *   overrides, and abort signal.\n   *\n   * @returns Parsed download headers.\n   */\n  async headById(fileId: FileId, options?: HeadCallOptions): Promise<HeadResult> {\n    return headById(this.client.raw, this.client.accountInfo, {\n      fileId,\n      ...options,\n    })\n  }\n\n  /**\n   * Creates a parallel-download ReadableStream that fetches the file in concurrent ranged chunks.\n   * @param fileId - The file version ID to download.\n   * @param totalSize - Total file size in bytes (needed to compute range boundaries).\n   * @param options - Concurrency, range size, SSE-C decryption, and abort signal.\n   *\n   * @returns A Web ReadableStream of file data in sequential order.\n   */\n  createReadStream(\n    fileId: FileId,\n    totalSize: number,\n    options?: {\n      /** Size of each ranged GET request in bytes. Defaults to 10 MB. */\n      rangeSize?: number\n      /** Number of concurrent range requests. Defaults to 4. */\n      concurrency?: number\n      /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */\n      serverSideEncryption?: SseCDownloadKey\n      /** Abort signal for cancelling the download. */\n      signal?: AbortSignal\n    },\n  ): ReadableStream<Uint8Array> {\n    return createParallelDownloadStream(this.client.raw, this.client.accountInfo, {\n      fileId,\n      totalSize,\n      ...options,\n    })\n  }\n\n  /**\n   * Creates a Web `WritableStream` that uploads streamed data into this file\n   * using the multipart protocol. Pipe a `ReadableStream<Uint8Array>` into the\n   * returned `writable` and await `done` to get the final {@link FileVersion}.\n   *\n   * Note: streaming uploads do not support resume because the size and per-part\n   * hashes are not known in advance. Use {@link upload} with a buffered source\n   * when resume is required.\n   *\n   * @param options - Streaming upload parameters (part size, concurrency, encryption).\n   *\n   * @returns A handle with the writable sink and a completion promise.\n   */\n  createWriteStream(options?: B2ObjectWriteStreamOptions): UploadWriteHandle {\n    const uploadRetryOptions = mergeUploadRetryOptions(this.uploadRetryOptions, options?.retry)\n    return createWriteStream(this.client.raw, this.client.accountInfo, {\n      ...(options ?? {}),\n      bucketId: this.bucket.id,\n      fileName: this.fileName,\n      retry: uploadRetryOptions,\n    })\n  }\n\n  /**\n   * Retrieves metadata for a specific file version.\n   * @param fileId - The file version ID to look up.\n   *\n   * @returns The file version metadata.\n   */\n  async getFileInfo(fileId: FileId): Promise<FileVersion> {\n    return this.client.raw.getFileInfo(\n      this.client.accountInfo.getApiUrl(),\n      this.client.accountInfo.getAuthToken(),\n      { fileId },\n    )\n  }\n\n  /**\n   * Hides this file by creating a hide marker at this file name.\n   *\n   * @returns Metadata for the newly created hide marker.\n   */\n  async hide(): Promise<FileVersion> {\n    return this.bucket.hideFile(this.fileName)\n  }\n\n  /**\n   * Permanently deletes a specific version of this file.\n   * @param fileId - The unique identifier of the file version to delete.\n   */\n  async deleteVersion(fileId: FileId): Promise<void> {\n    await this.bucket.deleteFileVersion(this.fileName, fileId)\n  }\n\n  /**\n   * Sets or updates the Object Lock retention policy on a specific file\n   * version of this file.\n   *\n   * The bucket must have Object Lock enabled (`fileLockEnabled: true` at\n   * creation time). Governance-mode retention can be shortened or removed\n   * by passing `bypassGovernance: true` together with an application key\n   * that carries the `bypassGovernance` capability; compliance-mode\n   * retention cannot be shortened by anyone until the\n   * `retainUntilTimestamp` elapses.\n   *\n   * @param fileId - The file version to apply the policy to.\n   * @param retention - The retention policy to apply.\n   * @param options - Optional flag for shortening governance-mode retention.\n   *\n   * @returns Metadata for the updated file version.\n   */\n  async setRetention(\n    fileId: FileId,\n    retention: FileRetentionValue,\n    options?: { bypassGovernance?: boolean },\n  ) {\n    return this.bucket.updateFileRetention(this.fileName, fileId, retention, options)\n  }\n\n  /**\n   * Toggles the legal hold flag on a specific file version of this file.\n   *\n   * Legal hold is independent of retention: a file can be on legal hold\n   * without any retention policy, and vice versa. The bucket must have\n   * Object Lock enabled, and any caller must hold the `writeFileLegalHolds`\n   * capability.\n   *\n   * @param fileId - The file version to apply the flag to.\n   * @param legalHold - `'on'` to apply the hold, `'off'` to remove it.\n   *\n   * @returns Metadata for the updated file version.\n   */\n  async setLegalHold(fileId: FileId, legalHold: LegalHoldValue) {\n    return this.bucket.updateFileLegalHold(this.fileName, fileId, legalHold)\n  }\n}\n"],"mappings":";;;;;;;;AAkCA,SAAS,+BAA+B,MAAsD;CAC5F,MAAM,WAAW,KAAK;CACtB,IAAI,CAAC,SAAS,0BAA0B,OAAO,EAAE,YAAY,KAAK;CAClE,IAAI,SAAS,UAAU,MAAM,OAAO,EAAE,YAAY,MAAM;CACxD,OAAO;EAAE,WAAW,SAAS,MAAM;EAAkB,YAAY;CAAM;AACzE;AAEA,SAAS,+BAA+B,SAAyC;CAE/E,QADwB,QAAQ,WAAW,QAAQ,QAAQ,iBAAiB,KAAA,OAGzE,QAAQ,yBAAyB,KAAA,KAAa,QAAQ,kBAAkB,KAAA;AAE7E;;;;;;;;;;;;;;AA8DA,IAAa,WAAb,MAAsB;;CAEpB;CACA;CACA;CACA;;;;;;;;;CAUA,YACE,QACA,QACA,UACA,oBACA;EACA,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,WAAW;EAChB,KAAK,qBAAqB;CAC5B;;;;;;;CAQA,MAAM,OAAO,SAAsD;EACjE,MAAM,sBAAsB,KAAK,OAAO,YAAY,uBAAuB;EAC3E,MAAM,UAAU,QAAQ,OAAO,OAAO;EACtC,MAAM,qBAAqB,wBAAwB,KAAK,oBAAoB,QAAQ,KAAK;EAEzF,IAAI,SAAS;GACX,MAAM,aAAa,+BAA+B,OAAO,IACrD,MAAM,KAAK,qBAAqB,IAChC,KAAK,OAAO;GAChB,MAAM,yBAAyB,+BAA+B,UAAU;GACxE,OAAO,gBAAgB,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;IAC/D,GAAG;IACH,UAAU,KAAK,OAAO;IACtB,UAAU,KAAK;IACf,OAAO;IACP,mCAAmC,WAAW;IAC9C,GAAI,uBAAuB,cAAc,KAAA,IACrC,EAAE,wBAAwB,uBAAuB,UAAU,IAC3D,CAAC;IACL,GAAI,uBAAuB,aAAa,EAAE,kCAAkC,KAAK,IAAI,CAAC;GACxF,CAAC;EACH;EACA,wBAAwB,SAAS,iBAAiB;EAClD,MAAM,eAAe,uBAAuB,OAAO;EACnD,OAAO,gBAAgB,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;GAC/D,GAAG;GACH,UAAU,KAAK,OAAO;GACtB,UAAU,KAAK;GACf,OAAO;EACT,CAAC;CACH;CAEA,MAAc,uBAAgD;EAE5D,MAAM,SAAQ,MADM,KAAK,OAAO,YAAY,EAAE,UAAU,KAAK,OAAO,GAAG,CAAC,EAAA,CACpD;EACpB,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,UAAU,KAAK,OAAO,GAAG,WAAW;EAChE,OAAO,MAAM;CACf;;;;;;;;CASA,MAAM,SAAS,SAAwD;EACrE,OAAO,eAAe,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;GAC9D,YAAY,KAAK,OAAO;GACxB,UAAU,KAAK;GACf,GAAG;EACL,CAAC;CACH;;;;;;;;;;;;CAaA,MAAM,KAAK,SAAgD;EACzD,OAAO,WAAW,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;GAC1D,YAAY,KAAK,OAAO;GACxB,UAAU,KAAK;GACf,GAAG;EACL,CAAC;CACH;;;;;;;;;CAUA,MAAM,aAAa,QAAgB,SAAwD;EACzF,OAAO,aAAa,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;GAC5D;GACA,GAAG;EACL,CAAC;CACH;;;;;;;;;;;;CAaA,MAAM,SAAS,QAAgB,SAAgD;EAC7E,OAAO,SAAS,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;GACxD;GACA,GAAG;EACL,CAAC;CACH;;;;;;;;;CAUA,iBACE,QACA,WACA,SAU4B;EAC5B,OAAO,6BAA6B,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;GAC5E;GACA;GACA,GAAG;EACL,CAAC;CACH;;;;;;;;;;;;;;CAeA,kBAAkB,SAAyD;EACzE,MAAM,qBAAqB,wBAAwB,KAAK,oBAAoB,SAAS,KAAK;EAC1F,OAAO,kBAAkB,KAAK,OAAO,KAAK,KAAK,OAAO,aAAa;GACjE,GAAI,WAAW,CAAC;GAChB,UAAU,KAAK,OAAO;GACtB,UAAU,KAAK;GACf,OAAO;EACT,CAAC;CACH;;;;;;;CAQA,MAAM,YAAY,QAAsC;EACtD,OAAO,KAAK,OAAO,IAAI,YACrB,KAAK,OAAO,YAAY,UAAU,GAClC,KAAK,OAAO,YAAY,aAAa,GACrC,EAAE,OAAO,CACX;CACF;;;;;;CAOA,MAAM,OAA6B;EACjC,OAAO,KAAK,OAAO,SAAS,KAAK,QAAQ;CAC3C;;;;;CAMA,MAAM,cAAc,QAA+B;EACjD,MAAM,KAAK,OAAO,kBAAkB,KAAK,UAAU,MAAM;CAC3D;;;;;;;;;;;;;;;;;;CAmBA,MAAM,aACJ,QACA,WACA,SACA;EACA,OAAO,KAAK,OAAO,oBAAoB,KAAK,UAAU,QAAQ,WAAW,OAAO;CAClF;;;;;;;;;;;;;;CAeA,MAAM,aAAa,QAAgB,WAA2B;EAC5D,OAAO,KAAK,OAAO,oBAAoB,KAAK,UAAU,QAAQ,SAAS;CACzE;AACF"}

package/dist/partner/account-info.d.cts

@@ -0,0 +1,43 @@
+import { AccountId, PartnerToken } from '../types/ids.js';
+import { PartnerAuthorizeResponse, PartnerCapability } from '../types/partner.js';
+/**
+ * Stores Partner API and Computer Backup authorization state between requests.
+ *
+ * Reauthorization follows the storage client's `RetryTransport.onReauth`
+ * contract: re-run `PartnerRawClient.authorizePartner` with the same Master
+ * Application Key credentials, store the fresh response with `setAuth`, then
+ * return `authorizationToken` to the retry transport.
+ *
+ * Partner authorize responses redact `authorizationToken` when passed to
+ * `JSON.stringify`, so do not persist `getAuth()` with direct JSON serialization.
+ * For trusted durable caches, serialize the output of
+ * `partnerAuthorizeResponseForPersistence(getAuth())` into encrypted or
+ * otherwise credential-grade storage, or store `authorizationToken` directly in
+ * secure storage with the rest of the authorize response metadata.
+ */
+export interface PartnerAccountInfo {
+    /** Store a fresh Partner authorization response, replacing any previous state. */
+    setAuth(auth: PartnerAuthorizeResponse): void;
+    /**
+     * Return the current Partner authorization response, or null if not authorized.
+     *
+     * The returned object remains directly reusable with `setAuth()`, but
+     * `JSON.stringify` redacts its token and is not a persistence format.
+     */
+    getAuth(): PartnerAuthorizeResponse | null;
+    /** Discard all cached Partner authorization state. */
+    clear(): void;
+    /** Current Partner/Backup authorization token. */
+    getPartnerToken(): PartnerToken;
+    /** Base URL for Partner API calls, or null when the suite is unavailable. */
+    getGroupsApiUrl(): string | null;
+    /** Base URL for Computer Backup API calls, or null when the suite is unavailable. */
+    getBackupApiUrl(): string | null;
+    /** The authorized partner administrator account ID. */
+    getAccountId(): AccountId;
+    /** Capabilities granted for Partner API calls, or null when the suite is unavailable. */
+    getGroupsCapabilities(): readonly PartnerCapability[] | null;
+    /** Capabilities granted for Computer Backup API calls, or null when the suite is unavailable. */
+    getBackupCapabilities(): readonly PartnerCapability[] | null;
+}
+//# sourceMappingURL=account-info.d.ts.map

package/dist/partner/account-info.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-info.d.ts","sourceRoot":"","sources":["../../src/partner/account-info.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC7C;;;;;OAKG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI,CAAA;IAC1C,sDAAsD;IACtD,KAAK,IAAI,IAAI,CAAA;IAEb,kDAAkD;IAClD,eAAe,IAAI,YAAY,CAAA;IAC/B,6EAA6E;IAC7E,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,qFAAqF;IACrF,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,uDAAuD;IACvD,YAAY,IAAI,SAAS,CAAA;IACzB,yFAAyF;IACzF,qBAAqB,IAAI,SAAS,iBAAiB,EAAE,GAAG,IAAI,CAAA;IAC5D,iGAAiG;IACjG,qBAAqB,IAAI,SAAS,iBAAiB,EAAE,GAAG,IAAI,CAAA;CAC7D"}

package/dist/partner/account-info.d.ts

@@ -0,0 +1,43 @@
+import { AccountId, PartnerToken } from '../types/ids.js';
+import { PartnerAuthorizeResponse, PartnerCapability } from '../types/partner.js';
+/**
+ * Stores Partner API and Computer Backup authorization state between requests.
+ *
+ * Reauthorization follows the storage client's `RetryTransport.onReauth`
+ * contract: re-run `PartnerRawClient.authorizePartner` with the same Master
+ * Application Key credentials, store the fresh response with `setAuth`, then
+ * return `authorizationToken` to the retry transport.
+ *
+ * Partner authorize responses redact `authorizationToken` when passed to
+ * `JSON.stringify`, so do not persist `getAuth()` with direct JSON serialization.
+ * For trusted durable caches, serialize the output of
+ * `partnerAuthorizeResponseForPersistence(getAuth())` into encrypted or
+ * otherwise credential-grade storage, or store `authorizationToken` directly in
+ * secure storage with the rest of the authorize response metadata.
+ */
+export interface PartnerAccountInfo {
+    /** Store a fresh Partner authorization response, replacing any previous state. */
+    setAuth(auth: PartnerAuthorizeResponse): void;
+    /**
+     * Return the current Partner authorization response, or null if not authorized.
+     *
+     * The returned object remains directly reusable with `setAuth()`, but
+     * `JSON.stringify` redacts its token and is not a persistence format.
+     */
+    getAuth(): PartnerAuthorizeResponse | null;
+    /** Discard all cached Partner authorization state. */
+    clear(): void;
+    /** Current Partner/Backup authorization token. */
+    getPartnerToken(): PartnerToken;
+    /** Base URL for Partner API calls, or null when the suite is unavailable. */
+    getGroupsApiUrl(): string | null;
+    /** Base URL for Computer Backup API calls, or null when the suite is unavailable. */
+    getBackupApiUrl(): string | null;
+    /** The authorized partner administrator account ID. */
+    getAccountId(): AccountId;
+    /** Capabilities granted for Partner API calls, or null when the suite is unavailable. */
+    getGroupsCapabilities(): readonly PartnerCapability[] | null;
+    /** Capabilities granted for Computer Backup API calls, or null when the suite is unavailable. */
+    getBackupCapabilities(): readonly PartnerCapability[] | null;
+}
+//# sourceMappingURL=account-info.d.ts.map

package/dist/partner/account-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-info.d.ts","sourceRoot":"","sources":["../../src/partner/account-info.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,OAAO,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC7C;;;;;OAKG;IACH,OAAO,IAAI,wBAAwB,GAAG,IAAI,CAAA;IAC1C,sDAAsD;IACtD,KAAK,IAAI,IAAI,CAAA;IAEb,kDAAkD;IAClD,eAAe,IAAI,YAAY,CAAA;IAC/B,6EAA6E;IAC7E,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,qFAAqF;IACrF,eAAe,IAAI,MAAM,GAAG,IAAI,CAAA;IAChC,uDAAuD;IACvD,YAAY,IAAI,SAAS,CAAA;IACzB,yFAAyF;IACzF,qBAAqB,IAAI,SAAS,iBAAiB,EAAE,GAAG,IAAI,CAAA;IAC5D,iGAAiG;IACjG,qBAAqB,IAAI,SAAS,iBAAiB,EAAE,GAAG,IAAI,CAAA;CAC7D"}

package/dist/partner/auth-clone.cjs

@@ -0,0 +1,64 @@
+const require_auth_shape = require("./auth-shape.cjs");
+//#region src/partner/auth-clone.ts
+/**
+* Returns a hook-free Partner authorize response copy.
+*
+* @param auth - Partner authorization response to clone.
+*
+* @returns A plain object preserving the live Partner token.
+*
+* @internal
+*/
+function clonePartnerAuthorizeResponse(auth) {
+	require_auth_shape.validatePartnerAuthorizeResponseShape(auth);
+	const storageApi = auth.apiInfo.storageApi;
+	const groupsApi = auth.apiInfo.groupsApi;
+	const backupApi = auth.apiInfo.backupApi;
+	return {
+		accountId: auth.accountId,
+		authorizationToken: auth.authorizationToken,
+		apiInfo: {
+			...storageApi !== void 0 ? { storageApi: {
+				...storageApi,
+				capabilities: [...storageApi.capabilities]
+			} } : {},
+			...groupsApi !== void 0 ? { groupsApi: {
+				...groupsApi,
+				capabilities: [...groupsApi.capabilities],
+				infoType: "groupsApi"
+			} } : {},
+			...backupApi !== void 0 ? { backupApi: {
+				...backupApi,
+				capabilities: [...backupApi.capabilities],
+				infoType: "backupApi"
+			} } : {}
+		},
+		...groupsApi !== void 0 ? { groupsApiUrl: groupsApi.groupsApiUrl } : {},
+		...backupApi !== void 0 ? { backupApiUrl: backupApi.backupApiUrl } : {},
+		...groupsApi !== void 0 ? { groupsCapabilities: [...groupsApi.capabilities] } : {},
+		...backupApi !== void 0 ? { backupCapabilities: [...backupApi.capabilities] } : {},
+		applicationKeyExpirationTimestamp: auth.applicationKeyExpirationTimestamp
+	};
+}
+/**
+* Returns a plain Partner authorize response copy for trusted auth-cache persistence.
+*
+* Unlike `JSON.stringify(auth)`, this preserves `authorizationToken` so the
+* result can be serialized, parsed, and passed back to
+* `PartnerAccountInfo.setAuth()`.
+*
+* The returned value is raw bearer-token material. Store it only in encrypted
+* or otherwise credential-grade durable storage, and never log it.
+*
+* @param auth - Partner authorization response to persist.
+*
+* @returns A plain object with the live Partner token preserved.
+*/
+function partnerAuthorizeResponseForPersistence(auth) {
+	return clonePartnerAuthorizeResponse(auth);
+}
+//#endregion
+exports.clonePartnerAuthorizeResponse = clonePartnerAuthorizeResponse;
+exports.partnerAuthorizeResponseForPersistence = partnerAuthorizeResponseForPersistence;
+
+//# sourceMappingURL=auth-clone.cjs.map

package/dist/partner/auth-clone.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-clone.cjs","names":[],"sources":["../../src/partner/auth-clone.ts"],"sourcesContent":["import type { PartnerAuthorizeResponse } from '../types/partner.ts'\nimport { validatePartnerAuthorizeResponseShape } from './auth-shape.ts'\n\n/**\n * Returns a hook-free Partner authorize response copy.\n *\n * @param auth - Partner authorization response to clone.\n *\n * @returns A plain object preserving the live Partner token.\n *\n * @internal\n */\nexport function clonePartnerAuthorizeResponse(\n  auth: PartnerAuthorizeResponse,\n): PartnerAuthorizeResponse {\n  validatePartnerAuthorizeResponseShape(auth)\n\n  const storageApi = auth.apiInfo.storageApi\n  const groupsApi = auth.apiInfo.groupsApi\n  const backupApi = auth.apiInfo.backupApi\n\n  return {\n    accountId: auth.accountId,\n    authorizationToken: auth.authorizationToken,\n    apiInfo: {\n      ...(storageApi !== undefined\n        ? {\n            storageApi: {\n              ...storageApi,\n              capabilities: [...storageApi.capabilities],\n            },\n          }\n        : {}),\n      ...(groupsApi !== undefined\n        ? {\n            groupsApi: {\n              ...groupsApi,\n              capabilities: [...groupsApi.capabilities],\n              infoType: 'groupsApi' as const,\n            },\n          }\n        : {}),\n      ...(backupApi !== undefined\n        ? {\n            backupApi: {\n              ...backupApi,\n              capabilities: [...backupApi.capabilities],\n              infoType: 'backupApi' as const,\n            },\n          }\n        : {}),\n    },\n    ...(groupsApi !== undefined ? { groupsApiUrl: groupsApi.groupsApiUrl } : {}),\n    ...(backupApi !== undefined ? { backupApiUrl: backupApi.backupApiUrl } : {}),\n    ...(groupsApi !== undefined ? { groupsCapabilities: [...groupsApi.capabilities] } : {}),\n    ...(backupApi !== undefined ? { backupCapabilities: [...backupApi.capabilities] } : {}),\n    applicationKeyExpirationTimestamp: auth.applicationKeyExpirationTimestamp,\n  }\n}\n\n/**\n * Returns a plain Partner authorize response copy for trusted auth-cache persistence.\n *\n * Unlike `JSON.stringify(auth)`, this preserves `authorizationToken` so the\n * result can be serialized, parsed, and passed back to\n * `PartnerAccountInfo.setAuth()`.\n *\n * The returned value is raw bearer-token material. Store it only in encrypted\n * or otherwise credential-grade durable storage, and never log it.\n *\n * @param auth - Partner authorization response to persist.\n *\n * @returns A plain object with the live Partner token preserved.\n */\nexport function partnerAuthorizeResponseForPersistence(\n  auth: PartnerAuthorizeResponse,\n): PartnerAuthorizeResponse {\n  return clonePartnerAuthorizeResponse(auth)\n}\n"],"mappings":";;;;;;;;;;;AAYA,SAAgB,8BACd,MAC0B;CAC1B,mBAAA,sCAAsC,IAAI;CAE1C,MAAM,aAAa,KAAK,QAAQ;CAChC,MAAM,YAAY,KAAK,QAAQ;CAC/B,MAAM,YAAY,KAAK,QAAQ;CAE/B,OAAO;EACL,WAAW,KAAK;EAChB,oBAAoB,KAAK;EACzB,SAAS;GACP,GAAI,eAAe,KAAA,IACf,EACE,YAAY;IACV,GAAG;IACH,cAAc,CAAC,GAAG,WAAW,YAAY;GAC3C,EACF,IACA,CAAC;GACL,GAAI,cAAc,KAAA,IACd,EACE,WAAW;IACT,GAAG;IACH,cAAc,CAAC,GAAG,UAAU,YAAY;IACxC,UAAU;GACZ,EACF,IACA,CAAC;GACL,GAAI,cAAc,KAAA,IACd,EACE,WAAW;IACT,GAAG;IACH,cAAc,CAAC,GAAG,UAAU,YAAY;IACxC,UAAU;GACZ,EACF,IACA,CAAC;EACP;EACA,GAAI,cAAc,KAAA,IAAY,EAAE,cAAc,UAAU,aAAa,IAAI,CAAC;EAC1E,GAAI,cAAc,KAAA,IAAY,EAAE,cAAc,UAAU,aAAa,IAAI,CAAC;EAC1E,GAAI,cAAc,KAAA,IAAY,EAAE,oBAAoB,CAAC,GAAG,UAAU,YAAY,EAAE,IAAI,CAAC;EACrF,GAAI,cAAc,KAAA,IAAY,EAAE,oBAAoB,CAAC,GAAG,UAAU,YAAY,EAAE,IAAI,CAAC;EACrF,mCAAmC,KAAK;CAC1C;AACF;;;;;;;;;;;;;;;AAgBA,SAAgB,uCACd,MAC0B;CAC1B,OAAO,8BAA8B,IAAI;AAC3C"}

package/dist/partner/auth-clone.d.cts

@@ -0,0 +1,27 @@
+import { PartnerAuthorizeResponse } from '../types/partner.js';
+/**
+ * Returns a hook-free Partner authorize response copy.
+ *
+ * @param auth - Partner authorization response to clone.
+ *
+ * @returns A plain object preserving the live Partner token.
+ *
+ * @internal
+ */
+export declare function clonePartnerAuthorizeResponse(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse;
+/**
+ * Returns a plain Partner authorize response copy for trusted auth-cache persistence.
+ *
+ * Unlike `JSON.stringify(auth)`, this preserves `authorizationToken` so the
+ * result can be serialized, parsed, and passed back to
+ * `PartnerAccountInfo.setAuth()`.
+ *
+ * The returned value is raw bearer-token material. Store it only in encrypted
+ * or otherwise credential-grade durable storage, and never log it.
+ *
+ * @param auth - Partner authorization response to persist.
+ *
+ * @returns A plain object with the live Partner token preserved.
+ */
+export declare function partnerAuthorizeResponseForPersistence(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse;
+//# sourceMappingURL=auth-clone.d.ts.map

package/dist/partner/auth-clone.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-clone.d.ts","sourceRoot":"","sources":["../../src/partner/auth-clone.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAGnE;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,wBAAwB,GAC7B,wBAAwB,CA4C1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,wBAAwB,GAC7B,wBAAwB,CAE1B"}

package/dist/partner/auth-clone.d.ts

@@ -0,0 +1,27 @@
+import { PartnerAuthorizeResponse } from '../types/partner.js';
+/**
+ * Returns a hook-free Partner authorize response copy.
+ *
+ * @param auth - Partner authorization response to clone.
+ *
+ * @returns A plain object preserving the live Partner token.
+ *
+ * @internal
+ */
+export declare function clonePartnerAuthorizeResponse(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse;
+/**
+ * Returns a plain Partner authorize response copy for trusted auth-cache persistence.
+ *
+ * Unlike `JSON.stringify(auth)`, this preserves `authorizationToken` so the
+ * result can be serialized, parsed, and passed back to
+ * `PartnerAccountInfo.setAuth()`.
+ *
+ * The returned value is raw bearer-token material. Store it only in encrypted
+ * or otherwise credential-grade durable storage, and never log it.
+ *
+ * @param auth - Partner authorization response to persist.
+ *
+ * @returns A plain object with the live Partner token preserved.
+ */
+export declare function partnerAuthorizeResponseForPersistence(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse;
+//# sourceMappingURL=auth-clone.d.ts.map

package/dist/partner/auth-clone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-clone.d.ts","sourceRoot":"","sources":["../../src/partner/auth-clone.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAGnE;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,wBAAwB,GAC7B,wBAAwB,CA4C1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,wBAAwB,GAC7B,wBAAwB,CAE1B"}

package/dist/partner/auth-clone.js

@@ -0,0 +1,63 @@
+import { validatePartnerAuthorizeResponseShape } from "./auth-shape.js";
+//#region src/partner/auth-clone.ts
+/**
+* Returns a hook-free Partner authorize response copy.
+*
+* @param auth - Partner authorization response to clone.
+*
+* @returns A plain object preserving the live Partner token.
+*
+* @internal
+*/
+function clonePartnerAuthorizeResponse(auth) {
+	validatePartnerAuthorizeResponseShape(auth);
+	const storageApi = auth.apiInfo.storageApi;
+	const groupsApi = auth.apiInfo.groupsApi;
+	const backupApi = auth.apiInfo.backupApi;
+	return {
+		accountId: auth.accountId,
+		authorizationToken: auth.authorizationToken,
+		apiInfo: {
+			...storageApi !== void 0 ? { storageApi: {
+				...storageApi,
+				capabilities: [...storageApi.capabilities]
+			} } : {},
+			...groupsApi !== void 0 ? { groupsApi: {
+				...groupsApi,
+				capabilities: [...groupsApi.capabilities],
+				infoType: "groupsApi"
+			} } : {},
+			...backupApi !== void 0 ? { backupApi: {
+				...backupApi,
+				capabilities: [...backupApi.capabilities],
+				infoType: "backupApi"
+			} } : {}
+		},
+		...groupsApi !== void 0 ? { groupsApiUrl: groupsApi.groupsApiUrl } : {},
+		...backupApi !== void 0 ? { backupApiUrl: backupApi.backupApiUrl } : {},
+		...groupsApi !== void 0 ? { groupsCapabilities: [...groupsApi.capabilities] } : {},
+		...backupApi !== void 0 ? { backupCapabilities: [...backupApi.capabilities] } : {},
+		applicationKeyExpirationTimestamp: auth.applicationKeyExpirationTimestamp
+	};
+}
+/**
+* Returns a plain Partner authorize response copy for trusted auth-cache persistence.
+*
+* Unlike `JSON.stringify(auth)`, this preserves `authorizationToken` so the
+* result can be serialized, parsed, and passed back to
+* `PartnerAccountInfo.setAuth()`.
+*
+* The returned value is raw bearer-token material. Store it only in encrypted
+* or otherwise credential-grade durable storage, and never log it.
+*
+* @param auth - Partner authorization response to persist.
+*
+* @returns A plain object with the live Partner token preserved.
+*/
+function partnerAuthorizeResponseForPersistence(auth) {
+	return clonePartnerAuthorizeResponse(auth);
+}
+//#endregion
+export { clonePartnerAuthorizeResponse, partnerAuthorizeResponseForPersistence };
+
+//# sourceMappingURL=auth-clone.js.map

package/dist/partner/auth-clone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-clone.js","names":[],"sources":["../../src/partner/auth-clone.ts"],"sourcesContent":["import type { PartnerAuthorizeResponse } from '../types/partner.ts'\nimport { validatePartnerAuthorizeResponseShape } from './auth-shape.ts'\n\n/**\n * Returns a hook-free Partner authorize response copy.\n *\n * @param auth - Partner authorization response to clone.\n *\n * @returns A plain object preserving the live Partner token.\n *\n * @internal\n */\nexport function clonePartnerAuthorizeResponse(\n  auth: PartnerAuthorizeResponse,\n): PartnerAuthorizeResponse {\n  validatePartnerAuthorizeResponseShape(auth)\n\n  const storageApi = auth.apiInfo.storageApi\n  const groupsApi = auth.apiInfo.groupsApi\n  const backupApi = auth.apiInfo.backupApi\n\n  return {\n    accountId: auth.accountId,\n    authorizationToken: auth.authorizationToken,\n    apiInfo: {\n      ...(storageApi !== undefined\n        ? {\n            storageApi: {\n              ...storageApi,\n              capabilities: [...storageApi.capabilities],\n            },\n          }\n        : {}),\n      ...(groupsApi !== undefined\n        ? {\n            groupsApi: {\n              ...groupsApi,\n              capabilities: [...groupsApi.capabilities],\n              infoType: 'groupsApi' as const,\n            },\n          }\n        : {}),\n      ...(backupApi !== undefined\n        ? {\n            backupApi: {\n              ...backupApi,\n              capabilities: [...backupApi.capabilities],\n              infoType: 'backupApi' as const,\n            },\n          }\n        : {}),\n    },\n    ...(groupsApi !== undefined ? { groupsApiUrl: groupsApi.groupsApiUrl } : {}),\n    ...(backupApi !== undefined ? { backupApiUrl: backupApi.backupApiUrl } : {}),\n    ...(groupsApi !== undefined ? { groupsCapabilities: [...groupsApi.capabilities] } : {}),\n    ...(backupApi !== undefined ? { backupCapabilities: [...backupApi.capabilities] } : {}),\n    applicationKeyExpirationTimestamp: auth.applicationKeyExpirationTimestamp,\n  }\n}\n\n/**\n * Returns a plain Partner authorize response copy for trusted auth-cache persistence.\n *\n * Unlike `JSON.stringify(auth)`, this preserves `authorizationToken` so the\n * result can be serialized, parsed, and passed back to\n * `PartnerAccountInfo.setAuth()`.\n *\n * The returned value is raw bearer-token material. Store it only in encrypted\n * or otherwise credential-grade durable storage, and never log it.\n *\n * @param auth - Partner authorization response to persist.\n *\n * @returns A plain object with the live Partner token preserved.\n */\nexport function partnerAuthorizeResponseForPersistence(\n  auth: PartnerAuthorizeResponse,\n): PartnerAuthorizeResponse {\n  return clonePartnerAuthorizeResponse(auth)\n}\n"],"mappings":";;;;;;;;;;;AAYA,SAAgB,8BACd,MAC0B;CAC1B,sCAAsC,IAAI;CAE1C,MAAM,aAAa,KAAK,QAAQ;CAChC,MAAM,YAAY,KAAK,QAAQ;CAC/B,MAAM,YAAY,KAAK,QAAQ;CAE/B,OAAO;EACL,WAAW,KAAK;EAChB,oBAAoB,KAAK;EACzB,SAAS;GACP,GAAI,eAAe,KAAA,IACf,EACE,YAAY;IACV,GAAG;IACH,cAAc,CAAC,GAAG,WAAW,YAAY;GAC3C,EACF,IACA,CAAC;GACL,GAAI,cAAc,KAAA,IACd,EACE,WAAW;IACT,GAAG;IACH,cAAc,CAAC,GAAG,UAAU,YAAY;IACxC,UAAU;GACZ,EACF,IACA,CAAC;GACL,GAAI,cAAc,KAAA,IACd,EACE,WAAW;IACT,GAAG;IACH,cAAc,CAAC,GAAG,UAAU,YAAY;IACxC,UAAU;GACZ,EACF,IACA,CAAC;EACP;EACA,GAAI,cAAc,KAAA,IAAY,EAAE,cAAc,UAAU,aAAa,IAAI,CAAC;EAC1E,GAAI,cAAc,KAAA,IAAY,EAAE,cAAc,UAAU,aAAa,IAAI,CAAC;EAC1E,GAAI,cAAc,KAAA,IAAY,EAAE,oBAAoB,CAAC,GAAG,UAAU,YAAY,EAAE,IAAI,CAAC;EACrF,GAAI,cAAc,KAAA,IAAY,EAAE,oBAAoB,CAAC,GAAG,UAAU,YAAY,EAAE,IAAI,CAAC;EACrF,mCAAmC,KAAK;CAC1C;AACF;;;;;;;;;;;;;;;AAgBA,SAAgB,uCACd,MAC0B;CAC1B,OAAO,8BAA8B,IAAI;AAC3C"}

package/dist/partner/auth-core.cjs

@@ -0,0 +1,175 @@
+const require_abort = require("../util/abort.cjs");
+const require_retry = require("../http/retry.cjs");
+const require_realms = require("../auth/realms.cjs");
+const require_url_guard = require("../http/url-guard.cjs");
+const require_transport = require("../http/transport.cjs");
+const require_in_memory = require("./in-memory.cjs");
+const require_raw = require("./raw.cjs");
+//#region src/partner/auth-core.ts
+/**
+* Internal Partner authorization state machine shared by public facades.
+*
+* @internal
+*/
+var PartnerAuthCore = class {
+	/** Low-level Partner raw client used for authorization and Partner endpoints. */
+	raw;
+	/** Partner authorization state storage. */
+	partnerAccountInfo;
+	/** Default transport URL guard, or null when a custom transport owns guarding. */
+	urlGuard;
+	/** Retry-wrapped transport shared by facade-specific raw clients. */
+	transport;
+	/** Endpoint suffixes validated from cached authorization during construction. */
+	cachedEndpointSuffixes;
+	/** Resolved Partner authorize realm URL. */
+	realmUrl;
+	/** Whether custom authorize realms are trusted. */
+	allowCustomAuthorizeRealm;
+	#masterKeyId;
+	#masterKey;
+	additionalAllowedSuffixes;
+	disableSsrfGuard;
+	#inflightReauth = null;
+	/**
+	* Creates a shared Partner authorization core.
+	*
+	* @param options - Credentials, state storage, transport, retry, and guard settings.
+	*/
+	constructor(options) {
+		this.#masterKeyId = options.masterKeyId;
+		this.#masterKey = options.masterKey;
+		this.realmUrl = require_realms.getRealmUrl(options.realm ?? "production");
+		this.partnerAccountInfo = options.partnerAccountInfo ?? new require_in_memory.InMemoryPartnerAccountInfo();
+		this.additionalAllowedSuffixes = options.additionalAllowedHostSuffixes;
+		this.disableSsrfGuard = options.disableSsrfGuard ?? false;
+		this.allowCustomAuthorizeRealm = options.allowCustomAuthorizeRealm ?? false;
+		let baseTransport;
+		if (options.transport !== void 0) {
+			baseTransport = options.transport;
+			this.urlGuard = null;
+		} else {
+			const urlGuard = new require_url_guard.UrlGuard();
+			baseTransport = new require_transport.FetchTransport({
+				urlGuard,
+				...options.userAgent !== void 0 ? { userAgent: options.userAgent } : {},
+				...options.followSameOriginRedirects !== void 0 ? { followSameOriginRedirects: options.followSameOriginRedirects } : {}
+			});
+			this.urlGuard = urlGuard;
+		}
+		this.transport = new require_transport.RetryTransport({
+			transport: baseTransport,
+			retry: {
+				...require_retry.DEFAULT_RETRY_OPTIONS,
+				...options.retry
+			},
+			onReauth: (signal) => this.reauthorize(signal)
+		});
+		this.cachedEndpointSuffixes = this.validateCachedAuth();
+		if (this.cachedEndpointSuffixes !== void 0) this.lockUrlGuardFromSuffixes(this.cachedEndpointSuffixes);
+		this.raw = new require_raw.PartnerRawClient({
+			transport: this.transport,
+			...this.cachedEndpointSuffixes !== void 0 ? { authorizedPartnerEndpointSuffixes: this.cachedEndpointSuffixes } : {},
+			...options.allowCustomAuthorizeRealm !== void 0 ? { allowCustomAuthorizeRealm: options.allowCustomAuthorizeRealm } : {}
+		});
+	}
+	/**
+	* Authenticates with B2 Partner authorization and stores the authorization state.
+	*
+	* @param options - Optional abort signal.
+	*
+	* @returns The normalized Partner authorization response.
+	*/
+	async authorize(options) {
+		require_abort.throwIfSignalAborted(options?.signal);
+		const auth = await this.raw.authorizePartner(this.#masterKeyId, this.#masterKey, this.realmUrl, options?.signal !== void 0 ? { signal: options.signal } : void 0);
+		require_abort.throwIfSignalAborted(options?.signal);
+		this.partnerAccountInfo.setAuth(auth);
+		this.lockUrlGuard(auth);
+		return auth;
+	}
+	/**
+	* Locks the default transport URL guard to suffixes from a validated auth response.
+	*
+	* @param auth - Partner authorization response to derive suffixes from.
+	*/
+	lockUrlGuard(auth) {
+		this.lockUrlGuardFromSuffixes(require_raw.derivePartnerAllowedSuffixes(auth, this.realmUrl));
+	}
+	/**
+	* Locks the default transport URL guard to previously validated endpoint suffixes.
+	*
+	* @param derived - Validated endpoint suffixes.
+	*/
+	lockUrlGuardFromSuffixes(derived) {
+		if (this.urlGuard === null) return;
+		const merged = this.disableSsrfGuard === true ? [] : this.additionalAllowedSuffixes !== void 0 ? Array.from(/* @__PURE__ */ new Set([...derived, ...this.additionalAllowedSuffixes])) : derived;
+		this.urlGuard.setAllowedSuffixes(merged);
+	}
+	/**
+	* Validates a Partner authorization snapshot and returns endpoint suffixes.
+	*
+	* @param auth - Partner authorization response to validate.
+	*
+	* @returns Host suffixes safe for Partner-token endpoint requests.
+	*
+	* @internal
+	*/
+	validateEndpointSuffixes(auth) {
+		return require_raw.validatePartnerAuthorizeResponseEndpoints(auth, this.realmUrl, this.allowCustomAuthorizeRealm);
+	}
+	/**
+	* Validates an auth snapshot, locks the default URL guard, and returns endpoint suffixes.
+	*
+	* @param auth - Partner authorization response to validate and activate.
+	*
+	* @returns Host suffixes safe for Partner-token endpoint requests.
+	*
+	* @internal
+	*/
+	activateEndpointSuffixes(auth) {
+		const suffixes = this.validateEndpointSuffixes(auth);
+		this.lockUrlGuardFromSuffixes(suffixes);
+		return suffixes;
+	}
+	validateCachedAuth() {
+		const cachedAuth = this.partnerAccountInfo.getAuth();
+		if (cachedAuth === null) return void 0;
+		try {
+			return this.validateEndpointSuffixes(cachedAuth);
+		} catch {
+			return;
+		}
+	}
+	reauthorize(signal) {
+		require_abort.throwIfSignalAborted(signal);
+		const inflight = this.#inflightReauth ?? this.startReauthorize();
+		inflight.waiters += 1;
+		return require_abort.raceWithAbort(inflight.promise, signal).finally(() => {
+			inflight.waiters -= 1;
+			if (inflight.waiters === 0 && !inflight.settled && !inflight.controller.signal.aborted) inflight.controller.abort(signal?.aborted === true ? require_abort.abortReason(signal) : void 0);
+		});
+	}
+	startReauthorize() {
+		const controller = new AbortController();
+		const inflight = {
+			controller,
+			promise: require_abort.raceWithAbort(this.doReauthorize(controller.signal), controller.signal).finally(() => {
+				if (this.#inflightReauth?.controller !== controller) return;
+				this.#inflightReauth.settled = true;
+				this.#inflightReauth = null;
+			}),
+			waiters: 0,
+			settled: false
+		};
+		this.#inflightReauth = inflight;
+		return inflight;
+	}
+	async doReauthorize(signal) {
+		return (await this.authorize({ signal })).authorizationToken;
+	}
+};
+//#endregion
+exports.PartnerAuthCore = PartnerAuthCore;
+
+//# sourceMappingURL=auth-core.cjs.map

package/dist/partner/auth-core.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-core.cjs","names":["#masterKeyId","#masterKey","#inflightReauth"],"sources":["../../src/partner/auth-core.ts"],"sourcesContent":["import { getRealmUrl } from '../auth/realms.ts'\nimport { DEFAULT_RETRY_OPTIONS, type RetryOptions } from '../http/retry.ts'\nimport type { HttpTransport } from '../http/transport.ts'\nimport { FetchTransport, RetryTransport } from '../http/transport.ts'\nimport { UrlGuard } from '../http/url-guard.ts'\nimport type { PartnerAuthorizeResponse } from '../types/partner.ts'\nimport { abortReason, raceWithAbort, throwIfSignalAborted } from '../util/abort.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { InMemoryPartnerAccountInfo } from './in-memory.ts'\nimport {\n  derivePartnerAllowedSuffixes,\n  PartnerRawClient,\n  validatePartnerAuthorizeResponseEndpoints,\n} from './raw.ts'\n\n/** Shared Partner authorization options used by Partner and Backup facades. */\nexport interface PartnerAuthCoreOptions {\n  /** The Master Application Key ID for the partner administrator account. */\n  readonly masterKeyId: string\n  /** The Master Application Key secret. */\n  readonly masterKey: string\n  /** B2 realm alias or direct trusted realm URL. Defaults to `\"production\"`. */\n  readonly realm?: string\n  /** Storage backend for Partner authorization state. */\n  readonly partnerAccountInfo?: PartnerAccountInfo\n  /** Custom HTTP transport. Defaults to {@link FetchTransport}. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior for retryable requests. */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /** Extra trusted host suffixes to merge into the default SSRF guard. */\n  readonly additionalAllowedHostSuffixes?: readonly string[]\n  /** Explicitly disable default SSRF guard suffix locking. */\n  readonly disableSsrfGuard?: boolean\n  /** Whether the default fetch transport may follow same-origin GET/HEAD redirects. */\n  readonly followSameOriginRedirects?: boolean\n  /** Allow direct custom authorize realms for tests or private proxies. */\n  readonly allowCustomAuthorizeRealm?: boolean\n}\n\n/** Options for Partner authorization through {@link PartnerAuthCore}. */\nexport interface PartnerAuthCoreAuthorizeOptions {\n  /** Abort signal for cancelling the authorize request. */\n  readonly signal?: AbortSignal\n}\n\ninterface InflightPartnerReauth {\n  readonly controller: AbortController\n  readonly promise: Promise<string>\n  waiters: number\n  settled: boolean\n}\n\n/**\n * Internal Partner authorization state machine shared by public facades.\n *\n * @internal\n */\nexport class PartnerAuthCore {\n  /** Low-level Partner raw client used for authorization and Partner endpoints. */\n  readonly raw: PartnerRawClient\n  /** Partner authorization state storage. */\n  readonly partnerAccountInfo: PartnerAccountInfo\n  /** Default transport URL guard, or null when a custom transport owns guarding. */\n  readonly urlGuard: UrlGuard | null\n  /** Retry-wrapped transport shared by facade-specific raw clients. */\n  readonly transport: HttpTransport\n  /** Endpoint suffixes validated from cached authorization during construction. */\n  readonly cachedEndpointSuffixes: readonly string[] | undefined\n  /** Resolved Partner authorize realm URL. */\n  private readonly realmUrl: string\n  /** Whether custom authorize realms are trusted. */\n  private readonly allowCustomAuthorizeRealm: boolean\n  readonly #masterKeyId: string\n  readonly #masterKey: string\n  private readonly additionalAllowedSuffixes: readonly string[] | undefined\n  private readonly disableSsrfGuard: boolean\n  #inflightReauth: InflightPartnerReauth | null = null\n\n  /**\n   * Creates a shared Partner authorization core.\n   *\n   * @param options - Credentials, state storage, transport, retry, and guard settings.\n   */\n  constructor(options: PartnerAuthCoreOptions) {\n    this.#masterKeyId = options.masterKeyId\n    this.#masterKey = options.masterKey\n    this.realmUrl = getRealmUrl(options.realm ?? 'production')\n    this.partnerAccountInfo = options.partnerAccountInfo ?? new InMemoryPartnerAccountInfo()\n    this.additionalAllowedSuffixes = options.additionalAllowedHostSuffixes\n    this.disableSsrfGuard = options.disableSsrfGuard ?? false\n    this.allowCustomAuthorizeRealm = options.allowCustomAuthorizeRealm ?? false\n\n    let baseTransport: HttpTransport\n    if (options.transport !== undefined) {\n      baseTransport = options.transport\n      this.urlGuard = null\n    } else {\n      const urlGuard = new UrlGuard()\n      baseTransport = new FetchTransport({\n        urlGuard,\n        ...(options.userAgent !== undefined ? { userAgent: options.userAgent } : {}),\n        ...(options.followSameOriginRedirects !== undefined\n          ? { followSameOriginRedirects: options.followSameOriginRedirects }\n          : {}),\n      })\n      this.urlGuard = urlGuard\n    }\n\n    this.transport = new RetryTransport({\n      transport: baseTransport,\n      retry: { ...DEFAULT_RETRY_OPTIONS, ...options.retry },\n      onReauth: (signal) => this.reauthorize(signal),\n    })\n\n    this.cachedEndpointSuffixes = this.validateCachedAuth()\n    if (this.cachedEndpointSuffixes !== undefined) {\n      this.lockUrlGuardFromSuffixes(this.cachedEndpointSuffixes)\n    }\n\n    this.raw = new PartnerRawClient({\n      transport: this.transport,\n      ...(this.cachedEndpointSuffixes !== undefined\n        ? { authorizedPartnerEndpointSuffixes: this.cachedEndpointSuffixes }\n        : {}),\n      ...(options.allowCustomAuthorizeRealm !== undefined\n        ? { allowCustomAuthorizeRealm: options.allowCustomAuthorizeRealm }\n        : {}),\n    })\n  }\n\n  /**\n   * Authenticates with B2 Partner authorization and stores the authorization state.\n   *\n   * @param options - Optional abort signal.\n   *\n   * @returns The normalized Partner authorization response.\n   */\n  async authorize(options?: PartnerAuthCoreAuthorizeOptions): Promise<PartnerAuthorizeResponse> {\n    throwIfSignalAborted(options?.signal)\n    const auth = await this.raw.authorizePartner(\n      this.#masterKeyId,\n      this.#masterKey,\n      this.realmUrl,\n      options?.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n    throwIfSignalAborted(options?.signal)\n    this.partnerAccountInfo.setAuth(auth)\n    this.lockUrlGuard(auth)\n    return auth\n  }\n\n  /**\n   * Locks the default transport URL guard to suffixes from a validated auth response.\n   *\n   * @param auth - Partner authorization response to derive suffixes from.\n   */\n  lockUrlGuard(auth: PartnerAuthorizeResponse): void {\n    this.lockUrlGuardFromSuffixes(derivePartnerAllowedSuffixes(auth, this.realmUrl))\n  }\n\n  /**\n   * Locks the default transport URL guard to previously validated endpoint suffixes.\n   *\n   * @param derived - Validated endpoint suffixes.\n   */\n  private lockUrlGuardFromSuffixes(derived: readonly string[]): void {\n    if (this.urlGuard === null) return\n    const merged =\n      this.disableSsrfGuard === true\n        ? []\n        : this.additionalAllowedSuffixes !== undefined\n          ? Array.from(new Set([...derived, ...this.additionalAllowedSuffixes]))\n          : derived\n    this.urlGuard.setAllowedSuffixes(merged)\n  }\n\n  /**\n   * Validates a Partner authorization snapshot and returns endpoint suffixes.\n   *\n   * @param auth - Partner authorization response to validate.\n   *\n   * @returns Host suffixes safe for Partner-token endpoint requests.\n   *\n   * @internal\n   */\n  private validateEndpointSuffixes(auth: PartnerAuthorizeResponse): readonly string[] {\n    return validatePartnerAuthorizeResponseEndpoints(\n      auth,\n      this.realmUrl,\n      this.allowCustomAuthorizeRealm,\n    )\n  }\n\n  /**\n   * Validates an auth snapshot, locks the default URL guard, and returns endpoint suffixes.\n   *\n   * @param auth - Partner authorization response to validate and activate.\n   *\n   * @returns Host suffixes safe for Partner-token endpoint requests.\n   *\n   * @internal\n   */\n  activateEndpointSuffixes(auth: PartnerAuthorizeResponse): readonly string[] {\n    const suffixes = this.validateEndpointSuffixes(auth)\n    this.lockUrlGuardFromSuffixes(suffixes)\n    return suffixes\n  }\n\n  private validateCachedAuth(): readonly string[] | undefined {\n    const cachedAuth = this.partnerAccountInfo.getAuth()\n    if (cachedAuth === null) return undefined\n    try {\n      return this.validateEndpointSuffixes(cachedAuth)\n    } catch {\n      // Do not mutate a shared PartnerAccountInfo during construction. The\n      // facade will ignore this auth locally until authorize() replaces it.\n      return undefined\n    }\n  }\n\n  private reauthorize(signal: AbortSignal | undefined): Promise<string> {\n    throwIfSignalAborted(signal)\n    const inflight = this.#inflightReauth ?? this.startReauthorize()\n    inflight.waiters += 1\n    return raceWithAbort(inflight.promise, signal).finally(() => {\n      inflight.waiters -= 1\n      if (inflight.waiters === 0 && !inflight.settled && !inflight.controller.signal.aborted) {\n        inflight.controller.abort(signal?.aborted === true ? abortReason(signal) : undefined)\n      }\n    })\n  }\n\n  private startReauthorize(): InflightPartnerReauth {\n    const controller = new AbortController()\n    const promise = raceWithAbort(this.doReauthorize(controller.signal), controller.signal).finally(\n      () => {\n        if (this.#inflightReauth?.controller !== controller) return\n        this.#inflightReauth.settled = true\n        this.#inflightReauth = null\n      },\n    )\n    const inflight: InflightPartnerReauth = {\n      controller,\n      promise,\n      waiters: 0,\n      settled: false,\n    }\n    this.#inflightReauth = inflight\n    return inflight\n  }\n\n  private async doReauthorize(signal: AbortSignal): Promise<string> {\n    const auth = await this.authorize({ signal })\n    return auth.authorizationToken\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA2DA,IAAa,kBAAb,MAA6B;;CAE3B;;CAEA;;CAEA;;CAEA;;CAEA;;CAEA;;CAEA;CACA;CACA;CACA;CACA;CACA,kBAAgD;;;;;;CAOhD,YAAY,SAAiC;EAC3C,KAAKA,eAAe,QAAQ;EAC5B,KAAKC,aAAa,QAAQ;EAC1B,KAAK,WAAW,eAAA,YAAY,QAAQ,SAAS,YAAY;EACzD,KAAK,qBAAqB,QAAQ,sBAAsB,IAAI,kBAAA,2BAA2B;EACvF,KAAK,4BAA4B,QAAQ;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,4BAA4B,QAAQ,6BAA6B;EAEtE,IAAI;EACJ,IAAI,QAAQ,cAAc,KAAA,GAAW;GACnC,gBAAgB,QAAQ;GACxB,KAAK,WAAW;EAClB,OAAO;GACL,MAAM,WAAW,IAAI,kBAAA,SAAS;GAC9B,gBAAgB,IAAI,kBAAA,eAAe;IACjC;IACA,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC1E,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;GACP,CAAC;GACD,KAAK,WAAW;EAClB;EAEA,KAAK,YAAY,IAAI,kBAAA,eAAe;GAClC,WAAW;GACX,OAAO;IAAE,GAAG,cAAA;IAAuB,GAAG,QAAQ;GAAM;GACpD,WAAW,WAAW,KAAK,YAAY,MAAM;EAC/C,CAAC;EAED,KAAK,yBAAyB,KAAK,mBAAmB;EACtD,IAAI,KAAK,2BAA2B,KAAA,GAClC,KAAK,yBAAyB,KAAK,sBAAsB;EAG3D,KAAK,MAAM,IAAI,YAAA,iBAAiB;GAC9B,WAAW,KAAK;GAChB,GAAI,KAAK,2BAA2B,KAAA,IAChC,EAAE,mCAAmC,KAAK,uBAAuB,IACjE,CAAC;GACL,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;EACP,CAAC;CACH;;;;;;;;CASA,MAAM,UAAU,SAA8E;EAC5F,cAAA,qBAAqB,SAAS,MAAM;EACpC,MAAM,OAAO,MAAM,KAAK,IAAI,iBAC1B,KAAKD,cACL,KAAKC,YACL,KAAK,UACL,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC/D;EACA,cAAA,qBAAqB,SAAS,MAAM;EACpC,KAAK,mBAAmB,QAAQ,IAAI;EACpC,KAAK,aAAa,IAAI;EACtB,OAAO;CACT;;;;;;CAOA,aAAa,MAAsC;EACjD,KAAK,yBAAyB,YAAA,6BAA6B,MAAM,KAAK,QAAQ,CAAC;CACjF;;;;;;CAOA,yBAAiC,SAAkC;EACjE,IAAI,KAAK,aAAa,MAAM;EAC5B,MAAM,SACJ,KAAK,qBAAqB,OACtB,CAAC,IACD,KAAK,8BAA8B,KAAA,IACjC,MAAM,qBAAK,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK,yBAAyB,CAAC,CAAC,IACnE;EACR,KAAK,SAAS,mBAAmB,MAAM;CACzC;;;;;;;;;;CAWA,yBAAiC,MAAmD;EAClF,OAAO,YAAA,0CACL,MACA,KAAK,UACL,KAAK,yBACP;CACF;;;;;;;;;;CAWA,yBAAyB,MAAmD;EAC1E,MAAM,WAAW,KAAK,yBAAyB,IAAI;EACnD,KAAK,yBAAyB,QAAQ;EACtC,OAAO;CACT;CAEA,qBAA4D;EAC1D,MAAM,aAAa,KAAK,mBAAmB,QAAQ;EACnD,IAAI,eAAe,MAAM,OAAO,KAAA;EAChC,IAAI;GACF,OAAO,KAAK,yBAAyB,UAAU;EACjD,QAAQ;GAGN;EACF;CACF;CAEA,YAAoB,QAAkD;EACpE,cAAA,qBAAqB,MAAM;EAC3B,MAAM,WAAW,KAAKC,mBAAmB,KAAK,iBAAiB;EAC/D,SAAS,WAAW;EACpB,OAAO,cAAA,cAAc,SAAS,SAAS,MAAM,CAAC,CAAC,cAAc;GAC3D,SAAS,WAAW;GACpB,IAAI,SAAS,YAAY,KAAK,CAAC,SAAS,WAAW,CAAC,SAAS,WAAW,OAAO,SAC7E,SAAS,WAAW,MAAM,QAAQ,YAAY,OAAO,cAAA,YAAY,MAAM,IAAI,KAAA,CAAS;EAExF,CAAC;CACH;CAEA,mBAAkD;EAChD,MAAM,aAAa,IAAI,gBAAgB;EAQvC,MAAM,WAAkC;GACtC;GACA,SATc,cAAA,cAAc,KAAK,cAAc,WAAW,MAAM,GAAG,WAAW,MAAM,CAAC,CAAC,cAChF;IACJ,IAAI,KAAKA,iBAAiB,eAAe,YAAY;IACrD,KAAKA,gBAAgB,UAAU;IAC/B,KAAKA,kBAAkB;GACzB,CAIA;GACA,SAAS;GACT,SAAS;EACX;EACA,KAAKA,kBAAkB;EACvB,OAAO;CACT;CAEA,MAAc,cAAc,QAAsC;EAEhE,QAAO,MADY,KAAK,UAAU,EAAE,OAAO,CAAC,EAAA,CAChC;CACd;AACF"}