@backblaze-labs/b2-sdk 0.1.0 → 0.3.0

package/dist/partner/redaction.cjs

@@ -0,0 +1,267 @@
+const require_errors_index = require("../errors/index.cjs");
+const require_redaction_placeholders = require("./redaction-placeholders.cjs");
+//#region src/partner/redaction.ts
+var inspectSymbol = Symbol.for("nodejs.util.inspect.custom");
+function installPortableJsonHook(target, toJson) {
+	const originalPrototype = Object.getPrototypeOf(target);
+	const redactionPrototype = Object.create(originalPrototype);
+	Object.defineProperty(redactionPrototype, "toJSON", {
+		value: toJson,
+		enumerable: false,
+		configurable: true
+	});
+	Object.setPrototypeOf(target, redactionPrototype);
+	Object.defineProperty(target, "toJSON", {
+		value: toJson,
+		enumerable: false,
+		configurable: true
+	});
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide tokens.
+*
+* @param auth - Partner authorization response to render safely.
+*
+* @returns A plain object with the Partner token replaced by a placeholder.
+*/
+function partnerAuthorizeResponseToRedactedJson(auth) {
+	return {
+		...auth,
+		authorizationToken: require_redaction_placeholders.PARTNER_TOKEN_REDACTED
+	};
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide group-member keys.
+*
+* @param result - Create group member result to render safely.
+*
+* @returns A plain object with the application key secret replaced by a placeholder.
+*/
+function createGroupMemberResultToRedactedJson(result) {
+	return {
+		...result,
+		applicationKey: require_redaction_placeholders.APPLICATION_KEY_REDACTED
+	};
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide group-member keys.
+*
+* @param response - Create group member response to render safely.
+*
+* @returns A plain array with every application key secret replaced by a placeholder.
+*/
+function createGroupMemberResponseToRedactedJson(response) {
+	return response.map((result) => createGroupMemberResultToRedactedJson(result));
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide trial account keys.
+*
+* @param result - Reserve trial account result to render safely.
+*
+* @returns A plain object with the application key secret replaced by a placeholder.
+*/
+function reserveTrialCreateAccountResultToRedactedJson(result) {
+	return {
+		...result,
+		applicationKey: require_redaction_placeholders.APPLICATION_KEY_REDACTED
+	};
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide trial account keys.
+*
+* @param response - Reserve trial account response to render safely.
+*
+* @returns A plain array with every application key secret replaced by a placeholder.
+*/
+function reserveTrialCreateAccountResponseToRedactedJson(response) {
+	return response.map((result) => reserveTrialCreateAccountResultToRedactedJson(result));
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact the
+* Partner token through `JSON.stringify`, `toString`, and Node `util.inspect`
+* while preserving direct property access.
+*
+* `JSON.stringify` no longer round-trips `authorizationToken` from protected
+* authorize responses. Persist trusted auth caches with
+* `partnerAuthorizeResponseForPersistence(auth)` only into encrypted or
+* otherwise credential-grade storage, or read `authorizationToken` directly
+* into secure storage before serializing.
+*
+* This does not make the object universally log-safe: object spread,
+* `Object.assign`, `Object.entries`, `structuredClone`, and serializers that
+* walk enumerable properties can still expose the raw token.
+*
+* @param auth - Partner authorization response to protect from accidental inspection.
+*
+* @returns The same auth object with inspection hooks installed when possible.
+*/
+function redactPartnerAuthorizeResponse(auth) {
+	const target = Object.isExtensible(auth) ? auth : { ...auth };
+	const toRedactedJson = () => partnerAuthorizeResponseToRedactedJson(target);
+	const toRedactedString = () => `[PartnerAuthorizeResponse ${require_redaction_placeholders.PARTNER_TOKEN_REDACTED}]`;
+	installPortableJsonHook(target, toRedactedJson);
+	Object.defineProperties(target, {
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact the
+* application key secret while preserving direct property access.
+*
+* @param result - Create group member result to protect from accidental logging.
+*
+* @returns The same result object with redaction hooks installed when possible.
+*/
+function redactCreateGroupMemberResult(result) {
+	const target = Object.isExtensible(result) ? result : { ...result };
+	const toRedactedJson = () => createGroupMemberResultToRedactedJson(target);
+	const toRedactedString = () => `[CreateGroupMemberResult ${require_redaction_placeholders.APPLICATION_KEY_REDACTED}]`;
+	installPortableJsonHook(target, toRedactedJson);
+	Object.defineProperties(target, {
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact all
+* create-group-member application key secrets while preserving direct access.
+*
+* @param response - Create group member response to protect from accidental logging.
+*
+* @returns The same response array with redaction hooks installed when possible.
+*
+* @throws B2PartnerAuthorizationError if the response is not an array.
+*/
+function redactCreateGroupMemberResponse(response) {
+	if (!Array.isArray(response)) throw new require_errors_index.B2PartnerAuthorizationError("b2_create_group_member response was not a JSON array");
+	const target = Object.isExtensible(response) ? response : [...response];
+	const writableTarget = target;
+	for (let i = 0; i < writableTarget.length; i++) {
+		const result = writableTarget[i];
+		if (result !== void 0) writableTarget[i] = redactCreateGroupMemberResult(result);
+	}
+	const toRedactedJson = () => createGroupMemberResponseToRedactedJson(target);
+	const toRedactedString = () => `[CreateGroupMemberResponse ${require_redaction_placeholders.APPLICATION_KEY_REDACTED}]`;
+	Object.defineProperties(target, {
+		toJSON: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		},
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact the
+* application key secret while preserving direct property access.
+*
+* `JSON.stringify` redacts because the response contains newly minted
+* application key secrets that are commonly logged as batch results. Callers
+* that need to persist the key should read `applicationKey` directly into
+* secure storage before serializing the object.
+*
+* @param result - Reserve trial account result to protect from accidental logging.
+*
+* @returns The same result object with redaction hooks installed when possible.
+*/
+function redactReserveTrialCreateAccountResult(result) {
+	const target = Object.isExtensible(result) ? result : { ...result };
+	const toRedactedJson = () => reserveTrialCreateAccountResultToRedactedJson(target);
+	const toRedactedString = () => `[ReserveTrialCreateAccountResult ${require_redaction_placeholders.APPLICATION_KEY_REDACTED}]`;
+	installPortableJsonHook(target, toRedactedJson);
+	Object.defineProperties(target, {
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact all
+* reserve-trial application key secrets while preserving direct property access.
+*
+* @param response - Reserve trial account response to protect from accidental logging.
+*
+* @returns The same response array with redaction hooks installed when possible.
+*
+* @throws B2PartnerAuthorizationError if the response is not an array.
+*/
+function redactReserveTrialCreateAccountResponse(response) {
+	if (!Array.isArray(response)) throw new require_errors_index.B2PartnerAuthorizationError("b2_reserve_trial_create_account response was not a JSON array");
+	const target = Object.isExtensible(response) ? response : [...response];
+	const writableTarget = target;
+	for (let i = 0; i < writableTarget.length; i++) {
+		const result = writableTarget[i];
+		if (result !== void 0) writableTarget[i] = redactReserveTrialCreateAccountResult(result);
+	}
+	const toRedactedJson = () => reserveTrialCreateAccountResponseToRedactedJson(target);
+	const toRedactedString = () => `[ReserveTrialCreateAccountResponse ${require_redaction_placeholders.APPLICATION_KEY_REDACTED}]`;
+	Object.defineProperties(target, {
+		toJSON: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		},
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+//#endregion
+exports.PARTNER_TOKEN_REDACTED = require_redaction_placeholders.PARTNER_TOKEN_REDACTED;
+exports.createGroupMemberResponseToRedactedJson = createGroupMemberResponseToRedactedJson;
+exports.createGroupMemberResultToRedactedJson = createGroupMemberResultToRedactedJson;
+exports.partnerAuthorizeResponseToRedactedJson = partnerAuthorizeResponseToRedactedJson;
+exports.redactCreateGroupMemberResponse = redactCreateGroupMemberResponse;
+exports.redactCreateGroupMemberResult = redactCreateGroupMemberResult;
+exports.redactPartnerAuthorizeResponse = redactPartnerAuthorizeResponse;
+exports.redactReserveTrialCreateAccountResponse = redactReserveTrialCreateAccountResponse;
+exports.redactReserveTrialCreateAccountResult = redactReserveTrialCreateAccountResult;
+exports.reserveTrialCreateAccountResponseToRedactedJson = reserveTrialCreateAccountResponseToRedactedJson;
+exports.reserveTrialCreateAccountResultToRedactedJson = reserveTrialCreateAccountResultToRedactedJson;
+
+//# sourceMappingURL=redaction.cjs.map

package/dist/partner/redaction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.cjs","names":[],"sources":["../../src/partner/redaction.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type {\n  CreateGroupMemberResponse,\n  CreateGroupMemberResult,\n  PartnerAuthorizeResponse,\n  ReserveTrialCreateAccountResponse,\n  ReserveTrialCreateAccountResult,\n} from '../types/partner.ts'\nimport { APPLICATION_KEY_REDACTED, PARTNER_TOKEN_REDACTED } from './redaction-placeholders.ts'\n\nexport {\n  APPLICATION_KEY_REDACTED,\n  PARTNER_TOKEN_REDACTED,\n} from './redaction-placeholders.ts'\n\n/**\n * JSON-safe Partner authorize response with the Partner token replaced by a\n * placeholder string.\n */\nexport interface RedactedPartnerAuthorizeResponseJson\n  extends Omit<PartnerAuthorizeResponse, 'authorizationToken'> {\n  /** Redacted Partner authorization token placeholder. */\n  readonly authorizationToken: string\n}\n\nexport type RedactedCreateGroupMemberResultJson = Omit<\n  CreateGroupMemberResult,\n  'applicationKey'\n> & {\n  readonly applicationKey: string\n}\n\nexport type RedactedCreateGroupMemberResponseJson = readonly RedactedCreateGroupMemberResultJson[]\n\nexport type RedactedReserveTrialCreateAccountResultJson = Omit<\n  ReserveTrialCreateAccountResult,\n  'applicationKey'\n> & {\n  readonly applicationKey: string\n}\n\nexport type RedactedReserveTrialCreateAccountResponseJson =\n  readonly RedactedReserveTrialCreateAccountResultJson[]\n\nconst inspectSymbol = Symbol.for('nodejs.util.inspect.custom')\n\n// Bun/WebKit only honor object toJSON hooks when they are inherited, while Node\n// honors own hooks. Install both shapes so SDK safe serialization is portable.\nfunction installPortableJsonHook<T extends object>(target: T, toJson: () => unknown): void {\n  const originalPrototype = Object.getPrototypeOf(target)\n  const redactionPrototype = Object.create(originalPrototype) as object\n  Object.defineProperty(redactionPrototype, 'toJSON', {\n    value: toJson,\n    enumerable: false,\n    configurable: true,\n  })\n  Object.setPrototypeOf(target, redactionPrototype)\n  Object.defineProperty(target, 'toJSON', {\n    value: toJson,\n    enumerable: false,\n    configurable: true,\n  })\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide tokens.\n *\n * @param auth - Partner authorization response to render safely.\n *\n * @returns A plain object with the Partner token replaced by a placeholder.\n */\nexport function partnerAuthorizeResponseToRedactedJson(\n  auth: PartnerAuthorizeResponse,\n): RedactedPartnerAuthorizeResponseJson {\n  return {\n    ...auth,\n    authorizationToken: PARTNER_TOKEN_REDACTED,\n  }\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide group-member keys.\n *\n * @param result - Create group member result to render safely.\n *\n * @returns A plain object with the application key secret replaced by a placeholder.\n */\nexport function createGroupMemberResultToRedactedJson(\n  result: CreateGroupMemberResult,\n): RedactedCreateGroupMemberResultJson {\n  return {\n    ...result,\n    applicationKey: APPLICATION_KEY_REDACTED,\n  }\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide group-member keys.\n *\n * @param response - Create group member response to render safely.\n *\n * @returns A plain array with every application key secret replaced by a placeholder.\n */\nexport function createGroupMemberResponseToRedactedJson(\n  response: CreateGroupMemberResponse,\n): RedactedCreateGroupMemberResponseJson {\n  return response.map((result) => createGroupMemberResultToRedactedJson(result))\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide trial account keys.\n *\n * @param result - Reserve trial account result to render safely.\n *\n * @returns A plain object with the application key secret replaced by a placeholder.\n */\nexport function reserveTrialCreateAccountResultToRedactedJson(\n  result: ReserveTrialCreateAccountResult,\n): RedactedReserveTrialCreateAccountResultJson {\n  return {\n    ...result,\n    applicationKey: APPLICATION_KEY_REDACTED,\n  }\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide trial account keys.\n *\n * @param response - Reserve trial account response to render safely.\n *\n * @returns A plain array with every application key secret replaced by a placeholder.\n */\nexport function reserveTrialCreateAccountResponseToRedactedJson(\n  response: ReserveTrialCreateAccountResponse,\n): RedactedReserveTrialCreateAccountResponseJson {\n  return response.map((result) => reserveTrialCreateAccountResultToRedactedJson(result))\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact the\n * Partner token through `JSON.stringify`, `toString`, and Node `util.inspect`\n * while preserving direct property access.\n *\n * `JSON.stringify` no longer round-trips `authorizationToken` from protected\n * authorize responses. Persist trusted auth caches with\n * `partnerAuthorizeResponseForPersistence(auth)` only into encrypted or\n * otherwise credential-grade storage, or read `authorizationToken` directly\n * into secure storage before serializing.\n *\n * This does not make the object universally log-safe: object spread,\n * `Object.assign`, `Object.entries`, `structuredClone`, and serializers that\n * walk enumerable properties can still expose the raw token.\n *\n * @param auth - Partner authorization response to protect from accidental inspection.\n *\n * @returns The same auth object with inspection hooks installed when possible.\n */\nexport function redactPartnerAuthorizeResponse(\n  auth: PartnerAuthorizeResponse,\n): PartnerAuthorizeResponse {\n  const target = Object.isExtensible(auth) ? auth : { ...auth }\n  const toRedactedJson = (): RedactedPartnerAuthorizeResponseJson =>\n    partnerAuthorizeResponseToRedactedJson(target)\n  const toRedactedString = (): string => `[PartnerAuthorizeResponse ${PARTNER_TOKEN_REDACTED}]`\n\n  installPortableJsonHook(target, toRedactedJson)\n  Object.defineProperties(target, {\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact the\n * application key secret while preserving direct property access.\n *\n * @param result - Create group member result to protect from accidental logging.\n *\n * @returns The same result object with redaction hooks installed when possible.\n */\nexport function redactCreateGroupMemberResult(\n  result: CreateGroupMemberResult,\n): CreateGroupMemberResult {\n  const target = Object.isExtensible(result) ? result : { ...result }\n  const toRedactedJson = (): RedactedCreateGroupMemberResultJson =>\n    createGroupMemberResultToRedactedJson(target)\n  const toRedactedString = (): string => `[CreateGroupMemberResult ${APPLICATION_KEY_REDACTED}]`\n\n  installPortableJsonHook(target, toRedactedJson)\n  Object.defineProperties(target, {\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact all\n * create-group-member application key secrets while preserving direct access.\n *\n * @param response - Create group member response to protect from accidental logging.\n *\n * @returns The same response array with redaction hooks installed when possible.\n *\n * @throws B2PartnerAuthorizationError if the response is not an array.\n */\nexport function redactCreateGroupMemberResponse(\n  response: CreateGroupMemberResponse,\n): CreateGroupMemberResponse {\n  if (!Array.isArray(response)) {\n    throw new B2PartnerAuthorizationError('b2_create_group_member response was not a JSON array')\n  }\n\n  const target = Object.isExtensible(response) ? response : [...response]\n  const writableTarget = target as CreateGroupMemberResult[]\n  for (let i = 0; i < writableTarget.length; i++) {\n    const result = writableTarget[i]\n    if (result !== undefined) writableTarget[i] = redactCreateGroupMemberResult(result)\n  }\n\n  const toRedactedJson = (): RedactedCreateGroupMemberResponseJson =>\n    createGroupMemberResponseToRedactedJson(target)\n  const toRedactedString = (): string => `[CreateGroupMemberResponse ${APPLICATION_KEY_REDACTED}]`\n\n  Object.defineProperties(target, {\n    toJSON: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact the\n * application key secret while preserving direct property access.\n *\n * `JSON.stringify` redacts because the response contains newly minted\n * application key secrets that are commonly logged as batch results. Callers\n * that need to persist the key should read `applicationKey` directly into\n * secure storage before serializing the object.\n *\n * @param result - Reserve trial account result to protect from accidental logging.\n *\n * @returns The same result object with redaction hooks installed when possible.\n */\nexport function redactReserveTrialCreateAccountResult(\n  result: ReserveTrialCreateAccountResult,\n): ReserveTrialCreateAccountResult {\n  const target = Object.isExtensible(result) ? result : { ...result }\n  const toRedactedJson = (): RedactedReserveTrialCreateAccountResultJson =>\n    reserveTrialCreateAccountResultToRedactedJson(target)\n  const toRedactedString = (): string =>\n    `[ReserveTrialCreateAccountResult ${APPLICATION_KEY_REDACTED}]`\n\n  installPortableJsonHook(target, toRedactedJson)\n  Object.defineProperties(target, {\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact all\n * reserve-trial application key secrets while preserving direct property access.\n *\n * @param response - Reserve trial account response to protect from accidental logging.\n *\n * @returns The same response array with redaction hooks installed when possible.\n *\n * @throws B2PartnerAuthorizationError if the response is not an array.\n */\nexport function redactReserveTrialCreateAccountResponse(\n  response: ReserveTrialCreateAccountResponse,\n): ReserveTrialCreateAccountResponse {\n  if (!Array.isArray(response)) {\n    throw new B2PartnerAuthorizationError(\n      'b2_reserve_trial_create_account response was not a JSON array',\n    )\n  }\n\n  const target = Object.isExtensible(response) ? response : [...response]\n  const writableTarget = target as ReserveTrialCreateAccountResult[]\n  for (let i = 0; i < writableTarget.length; i++) {\n    const result = writableTarget[i]\n    if (result !== undefined) writableTarget[i] = redactReserveTrialCreateAccountResult(result)\n  }\n\n  const toRedactedJson = (): RedactedReserveTrialCreateAccountResponseJson =>\n    reserveTrialCreateAccountResponseToRedactedJson(target)\n  const toRedactedString = (): string =>\n    `[ReserveTrialCreateAccountResponse ${APPLICATION_KEY_REDACTED}]`\n\n  Object.defineProperties(target, {\n    toJSON: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n"],"mappings":";;;AA4CA,IAAM,gBAAgB,OAAO,IAAI,4BAA4B;AAI7D,SAAS,wBAA0C,QAAW,QAA6B;CACzF,MAAM,oBAAoB,OAAO,eAAe,MAAM;CACtD,MAAM,qBAAqB,OAAO,OAAO,iBAAiB;CAC1D,OAAO,eAAe,oBAAoB,UAAU;EAClD,OAAO;EACP,YAAY;EACZ,cAAc;CAChB,CAAC;CACD,OAAO,eAAe,QAAQ,kBAAkB;CAChD,OAAO,eAAe,QAAQ,UAAU;EACtC,OAAO;EACP,YAAY;EACZ,cAAc;CAChB,CAAC;AACH;;;;;;;;AASA,SAAgB,uCACd,MACsC;CACtC,OAAO;EACL,GAAG;EACH,oBAAoB,+BAAA;CACtB;AACF;;;;;;;;AASA,SAAgB,sCACd,QACqC;CACrC,OAAO;EACL,GAAG;EACH,gBAAgB,+BAAA;CAClB;AACF;;;;;;;;AASA,SAAgB,wCACd,UACuC;CACvC,OAAO,SAAS,KAAK,WAAW,sCAAsC,MAAM,CAAC;AAC/E;;;;;;;;AASA,SAAgB,8CACd,QAC6C;CAC7C,OAAO;EACL,GAAG;EACH,gBAAgB,+BAAA;CAClB;AACF;;;;;;;;AASA,SAAgB,gDACd,UAC+C;CAC/C,OAAO,SAAS,KAAK,WAAW,8CAA8C,MAAM,CAAC;AACvF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,+BACd,MAC0B;CAC1B,MAAM,SAAS,OAAO,aAAa,IAAI,IAAI,OAAO,EAAE,GAAG,KAAK;CAC5D,MAAM,uBACJ,uCAAuC,MAAM;CAC/C,MAAM,yBAAiC,6BAA6B,+BAAA,uBAAuB;CAE3F,wBAAwB,QAAQ,cAAc;CAC9C,OAAO,iBAAiB,QAAQ;EAC9B,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;AAUA,SAAgB,8BACd,QACyB;CACzB,MAAM,SAAS,OAAO,aAAa,MAAM,IAAI,SAAS,EAAE,GAAG,OAAO;CAClE,MAAM,uBACJ,sCAAsC,MAAM;CAC9C,MAAM,yBAAiC,4BAA4B,+BAAA,yBAAyB;CAE5F,wBAAwB,QAAQ,cAAc;CAC9C,OAAO,iBAAiB,QAAQ;EAC9B,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,gCACd,UAC2B;CAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ,GACzB,MAAM,IAAI,qBAAA,4BAA4B,sDAAsD;CAG9F,MAAM,SAAS,OAAO,aAAa,QAAQ,IAAI,WAAW,CAAC,GAAG,QAAQ;CACtE,MAAM,iBAAiB;CACvB,KAAK,IAAI,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;EAC9C,MAAM,SAAS,eAAe;EAC9B,IAAI,WAAW,KAAA,GAAW,eAAe,KAAK,8BAA8B,MAAM;CACpF;CAEA,MAAM,uBACJ,wCAAwC,MAAM;CAChD,MAAM,yBAAiC,8BAA8B,+BAAA,yBAAyB;CAE9F,OAAO,iBAAiB,QAAQ;EAC9B,QAAQ;GACN,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;EACA,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAgB,sCACd,QACiC;CACjC,MAAM,SAAS,OAAO,aAAa,MAAM,IAAI,SAAS,EAAE,GAAG,OAAO;CAClE,MAAM,uBACJ,8CAA8C,MAAM;CACtD,MAAM,yBACJ,oCAAoC,+BAAA,yBAAyB;CAE/D,wBAAwB,QAAQ,cAAc;CAC9C,OAAO,iBAAiB,QAAQ;EAC9B,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,wCACd,UACmC;CACnC,IAAI,CAAC,MAAM,QAAQ,QAAQ,GACzB,MAAM,IAAI,qBAAA,4BACR,+DACF;CAGF,MAAM,SAAS,OAAO,aAAa,QAAQ,IAAI,WAAW,CAAC,GAAG,QAAQ;CACtE,MAAM,iBAAiB;CACvB,KAAK,IAAI,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;EAC9C,MAAM,SAAS,eAAe;EAC9B,IAAI,WAAW,KAAA,GAAW,eAAe,KAAK,sCAAsC,MAAM;CAC5F;CAEA,MAAM,uBACJ,gDAAgD,MAAM;CACxD,MAAM,yBACJ,sCAAsC,+BAAA,yBAAyB;CAEjE,OAAO,iBAAiB,QAAQ;EAC9B,QAAQ;GACN,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;EACA,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT"}

package/dist/partner/redaction.d.cts

@@ -0,0 +1,124 @@
+import { CreateGroupMemberResponse, CreateGroupMemberResult, PartnerAuthorizeResponse, ReserveTrialCreateAccountResponse, ReserveTrialCreateAccountResult } from '../types/partner.js';
+export { APPLICATION_KEY_REDACTED, PARTNER_TOKEN_REDACTED, } from './redaction-placeholders.js';
+/**
+ * JSON-safe Partner authorize response with the Partner token replaced by a
+ * placeholder string.
+ */
+export interface RedactedPartnerAuthorizeResponseJson extends Omit<PartnerAuthorizeResponse, 'authorizationToken'> {
+    /** Redacted Partner authorization token placeholder. */
+    readonly authorizationToken: string;
+}
+export type RedactedCreateGroupMemberResultJson = Omit<CreateGroupMemberResult, 'applicationKey'> & {
+    readonly applicationKey: string;
+};
+export type RedactedCreateGroupMemberResponseJson = readonly RedactedCreateGroupMemberResultJson[];
+export type RedactedReserveTrialCreateAccountResultJson = Omit<ReserveTrialCreateAccountResult, 'applicationKey'> & {
+    readonly applicationKey: string;
+};
+export type RedactedReserveTrialCreateAccountResponseJson = readonly RedactedReserveTrialCreateAccountResultJson[];
+/**
+ * Returns a redacted copy for log serializers that intentionally hide tokens.
+ *
+ * @param auth - Partner authorization response to render safely.
+ *
+ * @returns A plain object with the Partner token replaced by a placeholder.
+ */
+export declare function partnerAuthorizeResponseToRedactedJson(auth: PartnerAuthorizeResponse): RedactedPartnerAuthorizeResponseJson;
+/**
+ * Returns a redacted copy for log serializers that intentionally hide group-member keys.
+ *
+ * @param result - Create group member result to render safely.
+ *
+ * @returns A plain object with the application key secret replaced by a placeholder.
+ */
+export declare function createGroupMemberResultToRedactedJson(result: CreateGroupMemberResult): RedactedCreateGroupMemberResultJson;
+/**
+ * Returns a redacted copy for log serializers that intentionally hide group-member keys.
+ *
+ * @param response - Create group member response to render safely.
+ *
+ * @returns A plain array with every application key secret replaced by a placeholder.
+ */
+export declare function createGroupMemberResponseToRedactedJson(response: CreateGroupMemberResponse): RedactedCreateGroupMemberResponseJson;
+/**
+ * Returns a redacted copy for log serializers that intentionally hide trial account keys.
+ *
+ * @param result - Reserve trial account result to render safely.
+ *
+ * @returns A plain object with the application key secret replaced by a placeholder.
+ */
+export declare function reserveTrialCreateAccountResultToRedactedJson(result: ReserveTrialCreateAccountResult): RedactedReserveTrialCreateAccountResultJson;
+/**
+ * Returns a redacted copy for log serializers that intentionally hide trial account keys.
+ *
+ * @param response - Reserve trial account response to render safely.
+ *
+ * @returns A plain array with every application key secret replaced by a placeholder.
+ */
+export declare function reserveTrialCreateAccountResponseToRedactedJson(response: ReserveTrialCreateAccountResponse): RedactedReserveTrialCreateAccountResponseJson;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact the
+ * Partner token through `JSON.stringify`, `toString`, and Node `util.inspect`
+ * while preserving direct property access.
+ *
+ * `JSON.stringify` no longer round-trips `authorizationToken` from protected
+ * authorize responses. Persist trusted auth caches with
+ * `partnerAuthorizeResponseForPersistence(auth)` only into encrypted or
+ * otherwise credential-grade storage, or read `authorizationToken` directly
+ * into secure storage before serializing.
+ *
+ * This does not make the object universally log-safe: object spread,
+ * `Object.assign`, `Object.entries`, `structuredClone`, and serializers that
+ * walk enumerable properties can still expose the raw token.
+ *
+ * @param auth - Partner authorization response to protect from accidental inspection.
+ *
+ * @returns The same auth object with inspection hooks installed when possible.
+ */
+export declare function redactPartnerAuthorizeResponse(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact the
+ * application key secret while preserving direct property access.
+ *
+ * @param result - Create group member result to protect from accidental logging.
+ *
+ * @returns The same result object with redaction hooks installed when possible.
+ */
+export declare function redactCreateGroupMemberResult(result: CreateGroupMemberResult): CreateGroupMemberResult;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact all
+ * create-group-member application key secrets while preserving direct access.
+ *
+ * @param response - Create group member response to protect from accidental logging.
+ *
+ * @returns The same response array with redaction hooks installed when possible.
+ *
+ * @throws B2PartnerAuthorizationError if the response is not an array.
+ */
+export declare function redactCreateGroupMemberResponse(response: CreateGroupMemberResponse): CreateGroupMemberResponse;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact the
+ * application key secret while preserving direct property access.
+ *
+ * `JSON.stringify` redacts because the response contains newly minted
+ * application key secrets that are commonly logged as batch results. Callers
+ * that need to persist the key should read `applicationKey` directly into
+ * secure storage before serializing the object.
+ *
+ * @param result - Reserve trial account result to protect from accidental logging.
+ *
+ * @returns The same result object with redaction hooks installed when possible.
+ */
+export declare function redactReserveTrialCreateAccountResult(result: ReserveTrialCreateAccountResult): ReserveTrialCreateAccountResult;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact all
+ * reserve-trial application key secrets while preserving direct property access.
+ *
+ * @param response - Reserve trial account response to protect from accidental logging.
+ *
+ * @returns The same response array with redaction hooks installed when possible.
+ *
+ * @throws B2PartnerAuthorizationError if the response is not an array.
+ */
+export declare function redactReserveTrialCreateAccountResponse(response: ReserveTrialCreateAccountResponse): ReserveTrialCreateAccountResponse;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/partner/redaction.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/partner/redaction.js"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,iCAAiC,EACjC,+BAA+B,EAChC,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,6BAA6B,CAAA;AAEpC;;;GAGG;AACH,MAAM,WAAW,oCACf,SAAQ,IAAI,CAAC,wBAAwB,EAAE,oBAAoB,CAAC;IAC5D,wDAAwD;IACxD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED,MAAM,MAAM,mCAAmC,GAAG,IAAI,CACpD,uBAAuB,EACvB,gBAAgB,CACjB,GAAG;IACF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qCAAqC,GAAG,SAAS,mCAAmC,EAAE,CAAA;AAElG,MAAM,MAAM,2CAA2C,GAAG,IAAI,CAC5D,+BAA+B,EAC/B,gBAAgB,CACjB,GAAG;IACF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,6CAA6C,GACvD,SAAS,2CAA2C,EAAE,CAAA;AAsBxD;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,wBAAwB,GAC7B,oCAAoC,CAKtC;AAED;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,uBAAuB,GAC9B,mCAAmC,CAKrC;AAED;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,yBAAyB,GAClC,qCAAqC,CAEvC;AAED;;;;;;GAMG;AACH,wBAAgB,6CAA6C,CAC3D,MAAM,EAAE,+BAA+B,GACtC,2CAA2C,CAK7C;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,QAAQ,EAAE,iCAAiC,GAC1C,6CAA6C,CAE/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,wBAAwB,GAC7B,wBAAwB,CAqB1B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,uBAAuB,GAC9B,uBAAuB,CAqBzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,CAmC3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,+BAA+B,GACtC,+BAA+B,CAsBjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,iCAAiC,GAC1C,iCAAiC,CAsCnC"}

package/dist/partner/redaction.d.ts

@@ -0,0 +1,124 @@
+import { CreateGroupMemberResponse, CreateGroupMemberResult, PartnerAuthorizeResponse, ReserveTrialCreateAccountResponse, ReserveTrialCreateAccountResult } from '../types/partner.js';
+export { APPLICATION_KEY_REDACTED, PARTNER_TOKEN_REDACTED, } from './redaction-placeholders.js';
+/**
+ * JSON-safe Partner authorize response with the Partner token replaced by a
+ * placeholder string.
+ */
+export interface RedactedPartnerAuthorizeResponseJson extends Omit<PartnerAuthorizeResponse, 'authorizationToken'> {
+    /** Redacted Partner authorization token placeholder. */
+    readonly authorizationToken: string;
+}
+export type RedactedCreateGroupMemberResultJson = Omit<CreateGroupMemberResult, 'applicationKey'> & {
+    readonly applicationKey: string;
+};
+export type RedactedCreateGroupMemberResponseJson = readonly RedactedCreateGroupMemberResultJson[];
+export type RedactedReserveTrialCreateAccountResultJson = Omit<ReserveTrialCreateAccountResult, 'applicationKey'> & {
+    readonly applicationKey: string;
+};
+export type RedactedReserveTrialCreateAccountResponseJson = readonly RedactedReserveTrialCreateAccountResultJson[];
+/**
+ * Returns a redacted copy for log serializers that intentionally hide tokens.
+ *
+ * @param auth - Partner authorization response to render safely.
+ *
+ * @returns A plain object with the Partner token replaced by a placeholder.
+ */
+export declare function partnerAuthorizeResponseToRedactedJson(auth: PartnerAuthorizeResponse): RedactedPartnerAuthorizeResponseJson;
+/**
+ * Returns a redacted copy for log serializers that intentionally hide group-member keys.
+ *
+ * @param result - Create group member result to render safely.
+ *
+ * @returns A plain object with the application key secret replaced by a placeholder.
+ */
+export declare function createGroupMemberResultToRedactedJson(result: CreateGroupMemberResult): RedactedCreateGroupMemberResultJson;
+/**
+ * Returns a redacted copy for log serializers that intentionally hide group-member keys.
+ *
+ * @param response - Create group member response to render safely.
+ *
+ * @returns A plain array with every application key secret replaced by a placeholder.
+ */
+export declare function createGroupMemberResponseToRedactedJson(response: CreateGroupMemberResponse): RedactedCreateGroupMemberResponseJson;
+/**
+ * Returns a redacted copy for log serializers that intentionally hide trial account keys.
+ *
+ * @param result - Reserve trial account result to render safely.
+ *
+ * @returns A plain object with the application key secret replaced by a placeholder.
+ */
+export declare function reserveTrialCreateAccountResultToRedactedJson(result: ReserveTrialCreateAccountResult): RedactedReserveTrialCreateAccountResultJson;
+/**
+ * Returns a redacted copy for log serializers that intentionally hide trial account keys.
+ *
+ * @param response - Reserve trial account response to render safely.
+ *
+ * @returns A plain array with every application key secret replaced by a placeholder.
+ */
+export declare function reserveTrialCreateAccountResponseToRedactedJson(response: ReserveTrialCreateAccountResponse): RedactedReserveTrialCreateAccountResponseJson;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact the
+ * Partner token through `JSON.stringify`, `toString`, and Node `util.inspect`
+ * while preserving direct property access.
+ *
+ * `JSON.stringify` no longer round-trips `authorizationToken` from protected
+ * authorize responses. Persist trusted auth caches with
+ * `partnerAuthorizeResponseForPersistence(auth)` only into encrypted or
+ * otherwise credential-grade storage, or read `authorizationToken` directly
+ * into secure storage before serializing.
+ *
+ * This does not make the object universally log-safe: object spread,
+ * `Object.assign`, `Object.entries`, `structuredClone`, and serializers that
+ * walk enumerable properties can still expose the raw token.
+ *
+ * @param auth - Partner authorization response to protect from accidental inspection.
+ *
+ * @returns The same auth object with inspection hooks installed when possible.
+ */
+export declare function redactPartnerAuthorizeResponse(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact the
+ * application key secret while preserving direct property access.
+ *
+ * @param result - Create group member result to protect from accidental logging.
+ *
+ * @returns The same result object with redaction hooks installed when possible.
+ */
+export declare function redactCreateGroupMemberResult(result: CreateGroupMemberResult): CreateGroupMemberResult;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact all
+ * create-group-member application key secrets while preserving direct access.
+ *
+ * @param response - Create group member response to protect from accidental logging.
+ *
+ * @returns The same response array with redaction hooks installed when possible.
+ *
+ * @throws B2PartnerAuthorizationError if the response is not an array.
+ */
+export declare function redactCreateGroupMemberResponse(response: CreateGroupMemberResponse): CreateGroupMemberResponse;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact the
+ * application key secret while preserving direct property access.
+ *
+ * `JSON.stringify` redacts because the response contains newly minted
+ * application key secrets that are commonly logged as batch results. Callers
+ * that need to persist the key should read `applicationKey` directly into
+ * secure storage before serializing the object.
+ *
+ * @param result - Reserve trial account result to protect from accidental logging.
+ *
+ * @returns The same result object with redaction hooks installed when possible.
+ */
+export declare function redactReserveTrialCreateAccountResult(result: ReserveTrialCreateAccountResult): ReserveTrialCreateAccountResult;
+/**
+ * Adds non-enumerable serialization and inspection hooks that redact all
+ * reserve-trial application key secrets while preserving direct property access.
+ *
+ * @param response - Reserve trial account response to protect from accidental logging.
+ *
+ * @returns The same response array with redaction hooks installed when possible.
+ *
+ * @throws B2PartnerAuthorizationError if the response is not an array.
+ */
+export declare function redactReserveTrialCreateAccountResponse(response: ReserveTrialCreateAccountResponse): ReserveTrialCreateAccountResponse;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/partner/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/partner/redaction.js"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,iCAAiC,EACjC,+BAA+B,EAChC,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,6BAA6B,CAAA;AAEpC;;;GAGG;AACH,MAAM,WAAW,oCACf,SAAQ,IAAI,CAAC,wBAAwB,EAAE,oBAAoB,CAAC;IAC5D,wDAAwD;IACxD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED,MAAM,MAAM,mCAAmC,GAAG,IAAI,CACpD,uBAAuB,EACvB,gBAAgB,CACjB,GAAG;IACF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qCAAqC,GAAG,SAAS,mCAAmC,EAAE,CAAA;AAElG,MAAM,MAAM,2CAA2C,GAAG,IAAI,CAC5D,+BAA+B,EAC/B,gBAAgB,CACjB,GAAG;IACF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,6CAA6C,GACvD,SAAS,2CAA2C,EAAE,CAAA;AAsBxD;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,wBAAwB,GAC7B,oCAAoC,CAKtC;AAED;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,uBAAuB,GAC9B,mCAAmC,CAKrC;AAED;;;;;;GAMG;AACH,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,yBAAyB,GAClC,qCAAqC,CAEvC;AAED;;;;;;GAMG;AACH,wBAAgB,6CAA6C,CAC3D,MAAM,EAAE,+BAA+B,GACtC,2CAA2C,CAK7C;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,QAAQ,EAAE,iCAAiC,GAC1C,6CAA6C,CAE/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,wBAAwB,GAC7B,wBAAwB,CAqB1B;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,uBAAuB,GAC9B,uBAAuB,CAqBzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,CAmC3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,+BAA+B,GACtC,+BAA+B,CAsBjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,iCAAiC,GAC1C,iCAAiC,CAsCnC"}