@backblaze-labs/b2-sdk 0.2.0 → 0.3.0

package/dist/partner/auth-core.cjs

@@ -0,0 +1,175 @@
+const require_abort = require("../util/abort.cjs");
+const require_retry = require("../http/retry.cjs");
+const require_realms = require("../auth/realms.cjs");
+const require_url_guard = require("../http/url-guard.cjs");
+const require_transport = require("../http/transport.cjs");
+const require_in_memory = require("./in-memory.cjs");
+const require_raw = require("./raw.cjs");
+//#region src/partner/auth-core.ts
+/**
+* Internal Partner authorization state machine shared by public facades.
+*
+* @internal
+*/
+var PartnerAuthCore = class {
+	/** Low-level Partner raw client used for authorization and Partner endpoints. */
+	raw;
+	/** Partner authorization state storage. */
+	partnerAccountInfo;
+	/** Default transport URL guard, or null when a custom transport owns guarding. */
+	urlGuard;
+	/** Retry-wrapped transport shared by facade-specific raw clients. */
+	transport;
+	/** Endpoint suffixes validated from cached authorization during construction. */
+	cachedEndpointSuffixes;
+	/** Resolved Partner authorize realm URL. */
+	realmUrl;
+	/** Whether custom authorize realms are trusted. */
+	allowCustomAuthorizeRealm;
+	#masterKeyId;
+	#masterKey;
+	additionalAllowedSuffixes;
+	disableSsrfGuard;
+	#inflightReauth = null;
+	/**
+	* Creates a shared Partner authorization core.
+	*
+	* @param options - Credentials, state storage, transport, retry, and guard settings.
+	*/
+	constructor(options) {
+		this.#masterKeyId = options.masterKeyId;
+		this.#masterKey = options.masterKey;
+		this.realmUrl = require_realms.getRealmUrl(options.realm ?? "production");
+		this.partnerAccountInfo = options.partnerAccountInfo ?? new require_in_memory.InMemoryPartnerAccountInfo();
+		this.additionalAllowedSuffixes = options.additionalAllowedHostSuffixes;
+		this.disableSsrfGuard = options.disableSsrfGuard ?? false;
+		this.allowCustomAuthorizeRealm = options.allowCustomAuthorizeRealm ?? false;
+		let baseTransport;
+		if (options.transport !== void 0) {
+			baseTransport = options.transport;
+			this.urlGuard = null;
+		} else {
+			const urlGuard = new require_url_guard.UrlGuard();
+			baseTransport = new require_transport.FetchTransport({
+				urlGuard,
+				...options.userAgent !== void 0 ? { userAgent: options.userAgent } : {},
+				...options.followSameOriginRedirects !== void 0 ? { followSameOriginRedirects: options.followSameOriginRedirects } : {}
+			});
+			this.urlGuard = urlGuard;
+		}
+		this.transport = new require_transport.RetryTransport({
+			transport: baseTransport,
+			retry: {
+				...require_retry.DEFAULT_RETRY_OPTIONS,
+				...options.retry
+			},
+			onReauth: (signal) => this.reauthorize(signal)
+		});
+		this.cachedEndpointSuffixes = this.validateCachedAuth();
+		if (this.cachedEndpointSuffixes !== void 0) this.lockUrlGuardFromSuffixes(this.cachedEndpointSuffixes);
+		this.raw = new require_raw.PartnerRawClient({
+			transport: this.transport,
+			...this.cachedEndpointSuffixes !== void 0 ? { authorizedPartnerEndpointSuffixes: this.cachedEndpointSuffixes } : {},
+			...options.allowCustomAuthorizeRealm !== void 0 ? { allowCustomAuthorizeRealm: options.allowCustomAuthorizeRealm } : {}
+		});
+	}
+	/**
+	* Authenticates with B2 Partner authorization and stores the authorization state.
+	*
+	* @param options - Optional abort signal.
+	*
+	* @returns The normalized Partner authorization response.
+	*/
+	async authorize(options) {
+		require_abort.throwIfSignalAborted(options?.signal);
+		const auth = await this.raw.authorizePartner(this.#masterKeyId, this.#masterKey, this.realmUrl, options?.signal !== void 0 ? { signal: options.signal } : void 0);
+		require_abort.throwIfSignalAborted(options?.signal);
+		this.partnerAccountInfo.setAuth(auth);
+		this.lockUrlGuard(auth);
+		return auth;
+	}
+	/**
+	* Locks the default transport URL guard to suffixes from a validated auth response.
+	*
+	* @param auth - Partner authorization response to derive suffixes from.
+	*/
+	lockUrlGuard(auth) {
+		this.lockUrlGuardFromSuffixes(require_raw.derivePartnerAllowedSuffixes(auth, this.realmUrl));
+	}
+	/**
+	* Locks the default transport URL guard to previously validated endpoint suffixes.
+	*
+	* @param derived - Validated endpoint suffixes.
+	*/
+	lockUrlGuardFromSuffixes(derived) {
+		if (this.urlGuard === null) return;
+		const merged = this.disableSsrfGuard === true ? [] : this.additionalAllowedSuffixes !== void 0 ? Array.from(/* @__PURE__ */ new Set([...derived, ...this.additionalAllowedSuffixes])) : derived;
+		this.urlGuard.setAllowedSuffixes(merged);
+	}
+	/**
+	* Validates a Partner authorization snapshot and returns endpoint suffixes.
+	*
+	* @param auth - Partner authorization response to validate.
+	*
+	* @returns Host suffixes safe for Partner-token endpoint requests.
+	*
+	* @internal
+	*/
+	validateEndpointSuffixes(auth) {
+		return require_raw.validatePartnerAuthorizeResponseEndpoints(auth, this.realmUrl, this.allowCustomAuthorizeRealm);
+	}
+	/**
+	* Validates an auth snapshot, locks the default URL guard, and returns endpoint suffixes.
+	*
+	* @param auth - Partner authorization response to validate and activate.
+	*
+	* @returns Host suffixes safe for Partner-token endpoint requests.
+	*
+	* @internal
+	*/
+	activateEndpointSuffixes(auth) {
+		const suffixes = this.validateEndpointSuffixes(auth);
+		this.lockUrlGuardFromSuffixes(suffixes);
+		return suffixes;
+	}
+	validateCachedAuth() {
+		const cachedAuth = this.partnerAccountInfo.getAuth();
+		if (cachedAuth === null) return void 0;
+		try {
+			return this.validateEndpointSuffixes(cachedAuth);
+		} catch {
+			return;
+		}
+	}
+	reauthorize(signal) {
+		require_abort.throwIfSignalAborted(signal);
+		const inflight = this.#inflightReauth ?? this.startReauthorize();
+		inflight.waiters += 1;
+		return require_abort.raceWithAbort(inflight.promise, signal).finally(() => {
+			inflight.waiters -= 1;
+			if (inflight.waiters === 0 && !inflight.settled && !inflight.controller.signal.aborted) inflight.controller.abort(signal?.aborted === true ? require_abort.abortReason(signal) : void 0);
+		});
+	}
+	startReauthorize() {
+		const controller = new AbortController();
+		const inflight = {
+			controller,
+			promise: require_abort.raceWithAbort(this.doReauthorize(controller.signal), controller.signal).finally(() => {
+				if (this.#inflightReauth?.controller !== controller) return;
+				this.#inflightReauth.settled = true;
+				this.#inflightReauth = null;
+			}),
+			waiters: 0,
+			settled: false
+		};
+		this.#inflightReauth = inflight;
+		return inflight;
+	}
+	async doReauthorize(signal) {
+		return (await this.authorize({ signal })).authorizationToken;
+	}
+};
+//#endregion
+exports.PartnerAuthCore = PartnerAuthCore;
+
+//# sourceMappingURL=auth-core.cjs.map

package/dist/partner/auth-core.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-core.cjs","names":["#masterKeyId","#masterKey","#inflightReauth"],"sources":["../../src/partner/auth-core.ts"],"sourcesContent":["import { getRealmUrl } from '../auth/realms.ts'\nimport { DEFAULT_RETRY_OPTIONS, type RetryOptions } from '../http/retry.ts'\nimport type { HttpTransport } from '../http/transport.ts'\nimport { FetchTransport, RetryTransport } from '../http/transport.ts'\nimport { UrlGuard } from '../http/url-guard.ts'\nimport type { PartnerAuthorizeResponse } from '../types/partner.ts'\nimport { abortReason, raceWithAbort, throwIfSignalAborted } from '../util/abort.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { InMemoryPartnerAccountInfo } from './in-memory.ts'\nimport {\n  derivePartnerAllowedSuffixes,\n  PartnerRawClient,\n  validatePartnerAuthorizeResponseEndpoints,\n} from './raw.ts'\n\n/** Shared Partner authorization options used by Partner and Backup facades. */\nexport interface PartnerAuthCoreOptions {\n  /** The Master Application Key ID for the partner administrator account. */\n  readonly masterKeyId: string\n  /** The Master Application Key secret. */\n  readonly masterKey: string\n  /** B2 realm alias or direct trusted realm URL. Defaults to `\"production\"`. */\n  readonly realm?: string\n  /** Storage backend for Partner authorization state. */\n  readonly partnerAccountInfo?: PartnerAccountInfo\n  /** Custom HTTP transport. Defaults to {@link FetchTransport}. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior for retryable requests. */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /** Extra trusted host suffixes to merge into the default SSRF guard. */\n  readonly additionalAllowedHostSuffixes?: readonly string[]\n  /** Explicitly disable default SSRF guard suffix locking. */\n  readonly disableSsrfGuard?: boolean\n  /** Whether the default fetch transport may follow same-origin GET/HEAD redirects. */\n  readonly followSameOriginRedirects?: boolean\n  /** Allow direct custom authorize realms for tests or private proxies. */\n  readonly allowCustomAuthorizeRealm?: boolean\n}\n\n/** Options for Partner authorization through {@link PartnerAuthCore}. */\nexport interface PartnerAuthCoreAuthorizeOptions {\n  /** Abort signal for cancelling the authorize request. */\n  readonly signal?: AbortSignal\n}\n\ninterface InflightPartnerReauth {\n  readonly controller: AbortController\n  readonly promise: Promise<string>\n  waiters: number\n  settled: boolean\n}\n\n/**\n * Internal Partner authorization state machine shared by public facades.\n *\n * @internal\n */\nexport class PartnerAuthCore {\n  /** Low-level Partner raw client used for authorization and Partner endpoints. */\n  readonly raw: PartnerRawClient\n  /** Partner authorization state storage. */\n  readonly partnerAccountInfo: PartnerAccountInfo\n  /** Default transport URL guard, or null when a custom transport owns guarding. */\n  readonly urlGuard: UrlGuard | null\n  /** Retry-wrapped transport shared by facade-specific raw clients. */\n  readonly transport: HttpTransport\n  /** Endpoint suffixes validated from cached authorization during construction. */\n  readonly cachedEndpointSuffixes: readonly string[] | undefined\n  /** Resolved Partner authorize realm URL. */\n  private readonly realmUrl: string\n  /** Whether custom authorize realms are trusted. */\n  private readonly allowCustomAuthorizeRealm: boolean\n  readonly #masterKeyId: string\n  readonly #masterKey: string\n  private readonly additionalAllowedSuffixes: readonly string[] | undefined\n  private readonly disableSsrfGuard: boolean\n  #inflightReauth: InflightPartnerReauth | null = null\n\n  /**\n   * Creates a shared Partner authorization core.\n   *\n   * @param options - Credentials, state storage, transport, retry, and guard settings.\n   */\n  constructor(options: PartnerAuthCoreOptions) {\n    this.#masterKeyId = options.masterKeyId\n    this.#masterKey = options.masterKey\n    this.realmUrl = getRealmUrl(options.realm ?? 'production')\n    this.partnerAccountInfo = options.partnerAccountInfo ?? new InMemoryPartnerAccountInfo()\n    this.additionalAllowedSuffixes = options.additionalAllowedHostSuffixes\n    this.disableSsrfGuard = options.disableSsrfGuard ?? false\n    this.allowCustomAuthorizeRealm = options.allowCustomAuthorizeRealm ?? false\n\n    let baseTransport: HttpTransport\n    if (options.transport !== undefined) {\n      baseTransport = options.transport\n      this.urlGuard = null\n    } else {\n      const urlGuard = new UrlGuard()\n      baseTransport = new FetchTransport({\n        urlGuard,\n        ...(options.userAgent !== undefined ? { userAgent: options.userAgent } : {}),\n        ...(options.followSameOriginRedirects !== undefined\n          ? { followSameOriginRedirects: options.followSameOriginRedirects }\n          : {}),\n      })\n      this.urlGuard = urlGuard\n    }\n\n    this.transport = new RetryTransport({\n      transport: baseTransport,\n      retry: { ...DEFAULT_RETRY_OPTIONS, ...options.retry },\n      onReauth: (signal) => this.reauthorize(signal),\n    })\n\n    this.cachedEndpointSuffixes = this.validateCachedAuth()\n    if (this.cachedEndpointSuffixes !== undefined) {\n      this.lockUrlGuardFromSuffixes(this.cachedEndpointSuffixes)\n    }\n\n    this.raw = new PartnerRawClient({\n      transport: this.transport,\n      ...(this.cachedEndpointSuffixes !== undefined\n        ? { authorizedPartnerEndpointSuffixes: this.cachedEndpointSuffixes }\n        : {}),\n      ...(options.allowCustomAuthorizeRealm !== undefined\n        ? { allowCustomAuthorizeRealm: options.allowCustomAuthorizeRealm }\n        : {}),\n    })\n  }\n\n  /**\n   * Authenticates with B2 Partner authorization and stores the authorization state.\n   *\n   * @param options - Optional abort signal.\n   *\n   * @returns The normalized Partner authorization response.\n   */\n  async authorize(options?: PartnerAuthCoreAuthorizeOptions): Promise<PartnerAuthorizeResponse> {\n    throwIfSignalAborted(options?.signal)\n    const auth = await this.raw.authorizePartner(\n      this.#masterKeyId,\n      this.#masterKey,\n      this.realmUrl,\n      options?.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n    throwIfSignalAborted(options?.signal)\n    this.partnerAccountInfo.setAuth(auth)\n    this.lockUrlGuard(auth)\n    return auth\n  }\n\n  /**\n   * Locks the default transport URL guard to suffixes from a validated auth response.\n   *\n   * @param auth - Partner authorization response to derive suffixes from.\n   */\n  lockUrlGuard(auth: PartnerAuthorizeResponse): void {\n    this.lockUrlGuardFromSuffixes(derivePartnerAllowedSuffixes(auth, this.realmUrl))\n  }\n\n  /**\n   * Locks the default transport URL guard to previously validated endpoint suffixes.\n   *\n   * @param derived - Validated endpoint suffixes.\n   */\n  private lockUrlGuardFromSuffixes(derived: readonly string[]): void {\n    if (this.urlGuard === null) return\n    const merged =\n      this.disableSsrfGuard === true\n        ? []\n        : this.additionalAllowedSuffixes !== undefined\n          ? Array.from(new Set([...derived, ...this.additionalAllowedSuffixes]))\n          : derived\n    this.urlGuard.setAllowedSuffixes(merged)\n  }\n\n  /**\n   * Validates a Partner authorization snapshot and returns endpoint suffixes.\n   *\n   * @param auth - Partner authorization response to validate.\n   *\n   * @returns Host suffixes safe for Partner-token endpoint requests.\n   *\n   * @internal\n   */\n  private validateEndpointSuffixes(auth: PartnerAuthorizeResponse): readonly string[] {\n    return validatePartnerAuthorizeResponseEndpoints(\n      auth,\n      this.realmUrl,\n      this.allowCustomAuthorizeRealm,\n    )\n  }\n\n  /**\n   * Validates an auth snapshot, locks the default URL guard, and returns endpoint suffixes.\n   *\n   * @param auth - Partner authorization response to validate and activate.\n   *\n   * @returns Host suffixes safe for Partner-token endpoint requests.\n   *\n   * @internal\n   */\n  activateEndpointSuffixes(auth: PartnerAuthorizeResponse): readonly string[] {\n    const suffixes = this.validateEndpointSuffixes(auth)\n    this.lockUrlGuardFromSuffixes(suffixes)\n    return suffixes\n  }\n\n  private validateCachedAuth(): readonly string[] | undefined {\n    const cachedAuth = this.partnerAccountInfo.getAuth()\n    if (cachedAuth === null) return undefined\n    try {\n      return this.validateEndpointSuffixes(cachedAuth)\n    } catch {\n      // Do not mutate a shared PartnerAccountInfo during construction. The\n      // facade will ignore this auth locally until authorize() replaces it.\n      return undefined\n    }\n  }\n\n  private reauthorize(signal: AbortSignal | undefined): Promise<string> {\n    throwIfSignalAborted(signal)\n    const inflight = this.#inflightReauth ?? this.startReauthorize()\n    inflight.waiters += 1\n    return raceWithAbort(inflight.promise, signal).finally(() => {\n      inflight.waiters -= 1\n      if (inflight.waiters === 0 && !inflight.settled && !inflight.controller.signal.aborted) {\n        inflight.controller.abort(signal?.aborted === true ? abortReason(signal) : undefined)\n      }\n    })\n  }\n\n  private startReauthorize(): InflightPartnerReauth {\n    const controller = new AbortController()\n    const promise = raceWithAbort(this.doReauthorize(controller.signal), controller.signal).finally(\n      () => {\n        if (this.#inflightReauth?.controller !== controller) return\n        this.#inflightReauth.settled = true\n        this.#inflightReauth = null\n      },\n    )\n    const inflight: InflightPartnerReauth = {\n      controller,\n      promise,\n      waiters: 0,\n      settled: false,\n    }\n    this.#inflightReauth = inflight\n    return inflight\n  }\n\n  private async doReauthorize(signal: AbortSignal): Promise<string> {\n    const auth = await this.authorize({ signal })\n    return auth.authorizationToken\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA2DA,IAAa,kBAAb,MAA6B;;CAE3B;;CAEA;;CAEA;;CAEA;;CAEA;;CAEA;;CAEA;CACA;CACA;CACA;CACA;CACA,kBAAgD;;;;;;CAOhD,YAAY,SAAiC;EAC3C,KAAKA,eAAe,QAAQ;EAC5B,KAAKC,aAAa,QAAQ;EAC1B,KAAK,WAAW,eAAA,YAAY,QAAQ,SAAS,YAAY;EACzD,KAAK,qBAAqB,QAAQ,sBAAsB,IAAI,kBAAA,2BAA2B;EACvF,KAAK,4BAA4B,QAAQ;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,4BAA4B,QAAQ,6BAA6B;EAEtE,IAAI;EACJ,IAAI,QAAQ,cAAc,KAAA,GAAW;GACnC,gBAAgB,QAAQ;GACxB,KAAK,WAAW;EAClB,OAAO;GACL,MAAM,WAAW,IAAI,kBAAA,SAAS;GAC9B,gBAAgB,IAAI,kBAAA,eAAe;IACjC;IACA,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC1E,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;GACP,CAAC;GACD,KAAK,WAAW;EAClB;EAEA,KAAK,YAAY,IAAI,kBAAA,eAAe;GAClC,WAAW;GACX,OAAO;IAAE,GAAG,cAAA;IAAuB,GAAG,QAAQ;GAAM;GACpD,WAAW,WAAW,KAAK,YAAY,MAAM;EAC/C,CAAC;EAED,KAAK,yBAAyB,KAAK,mBAAmB;EACtD,IAAI,KAAK,2BAA2B,KAAA,GAClC,KAAK,yBAAyB,KAAK,sBAAsB;EAG3D,KAAK,MAAM,IAAI,YAAA,iBAAiB;GAC9B,WAAW,KAAK;GAChB,GAAI,KAAK,2BAA2B,KAAA,IAChC,EAAE,mCAAmC,KAAK,uBAAuB,IACjE,CAAC;GACL,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;EACP,CAAC;CACH;;;;;;;;CASA,MAAM,UAAU,SAA8E;EAC5F,cAAA,qBAAqB,SAAS,MAAM;EACpC,MAAM,OAAO,MAAM,KAAK,IAAI,iBAC1B,KAAKD,cACL,KAAKC,YACL,KAAK,UACL,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC/D;EACA,cAAA,qBAAqB,SAAS,MAAM;EACpC,KAAK,mBAAmB,QAAQ,IAAI;EACpC,KAAK,aAAa,IAAI;EACtB,OAAO;CACT;;;;;;CAOA,aAAa,MAAsC;EACjD,KAAK,yBAAyB,YAAA,6BAA6B,MAAM,KAAK,QAAQ,CAAC;CACjF;;;;;;CAOA,yBAAiC,SAAkC;EACjE,IAAI,KAAK,aAAa,MAAM;EAC5B,MAAM,SACJ,KAAK,qBAAqB,OACtB,CAAC,IACD,KAAK,8BAA8B,KAAA,IACjC,MAAM,qBAAK,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK,yBAAyB,CAAC,CAAC,IACnE;EACR,KAAK,SAAS,mBAAmB,MAAM;CACzC;;;;;;;;;;CAWA,yBAAiC,MAAmD;EAClF,OAAO,YAAA,0CACL,MACA,KAAK,UACL,KAAK,yBACP;CACF;;;;;;;;;;CAWA,yBAAyB,MAAmD;EAC1E,MAAM,WAAW,KAAK,yBAAyB,IAAI;EACnD,KAAK,yBAAyB,QAAQ;EACtC,OAAO;CACT;CAEA,qBAA4D;EAC1D,MAAM,aAAa,KAAK,mBAAmB,QAAQ;EACnD,IAAI,eAAe,MAAM,OAAO,KAAA;EAChC,IAAI;GACF,OAAO,KAAK,yBAAyB,UAAU;EACjD,QAAQ;GAGN;EACF;CACF;CAEA,YAAoB,QAAkD;EACpE,cAAA,qBAAqB,MAAM;EAC3B,MAAM,WAAW,KAAKC,mBAAmB,KAAK,iBAAiB;EAC/D,SAAS,WAAW;EACpB,OAAO,cAAA,cAAc,SAAS,SAAS,MAAM,CAAC,CAAC,cAAc;GAC3D,SAAS,WAAW;GACpB,IAAI,SAAS,YAAY,KAAK,CAAC,SAAS,WAAW,CAAC,SAAS,WAAW,OAAO,SAC7E,SAAS,WAAW,MAAM,QAAQ,YAAY,OAAO,cAAA,YAAY,MAAM,IAAI,KAAA,CAAS;EAExF,CAAC;CACH;CAEA,mBAAkD;EAChD,MAAM,aAAa,IAAI,gBAAgB;EAQvC,MAAM,WAAkC;GACtC;GACA,SATc,cAAA,cAAc,KAAK,cAAc,WAAW,MAAM,GAAG,WAAW,MAAM,CAAC,CAAC,cAChF;IACJ,IAAI,KAAKA,iBAAiB,eAAe,YAAY;IACrD,KAAKA,gBAAgB,UAAU;IAC/B,KAAKA,kBAAkB;GACzB,CAIA;GACA,SAAS;GACT,SAAS;EACX;EACA,KAAKA,kBAAkB;EACvB,OAAO;CACT;CAEA,MAAc,cAAc,QAAsC;EAEhE,QAAO,MADY,KAAK,UAAU,EAAE,OAAO,CAAC,EAAA,CAChC;CACd;AACF"}

package/dist/partner/auth-core.d.cts

@@ -0,0 +1,111 @@
+import { RetryOptions } from '../http/retry.js';
+import { HttpTransport } from '../http/transport.js';
+import { UrlGuard } from '../http/url-guard.js';
+import { PartnerAuthorizeResponse } from '../types/partner.js';
+import { PartnerAccountInfo } from './account-info.js';
+import { PartnerRawClient } from './raw.js';
+/** Shared Partner authorization options used by Partner and Backup facades. */
+export interface PartnerAuthCoreOptions {
+    /** The Master Application Key ID for the partner administrator account. */
+    readonly masterKeyId: string;
+    /** The Master Application Key secret. */
+    readonly masterKey: string;
+    /** B2 realm alias or direct trusted realm URL. Defaults to `"production"`. */
+    readonly realm?: string;
+    /** Storage backend for Partner authorization state. */
+    readonly partnerAccountInfo?: PartnerAccountInfo;
+    /** Custom HTTP transport. Defaults to {@link FetchTransport}. */
+    readonly transport?: HttpTransport;
+    /** Override retry behavior for retryable requests. */
+    readonly retry?: Partial<RetryOptions>;
+    /** Custom user-agent string prepended to the SDK default. */
+    readonly userAgent?: string;
+    /** Extra trusted host suffixes to merge into the default SSRF guard. */
+    readonly additionalAllowedHostSuffixes?: readonly string[];
+    /** Explicitly disable default SSRF guard suffix locking. */
+    readonly disableSsrfGuard?: boolean;
+    /** Whether the default fetch transport may follow same-origin GET/HEAD redirects. */
+    readonly followSameOriginRedirects?: boolean;
+    /** Allow direct custom authorize realms for tests or private proxies. */
+    readonly allowCustomAuthorizeRealm?: boolean;
+}
+/** Options for Partner authorization through {@link PartnerAuthCore}. */
+export interface PartnerAuthCoreAuthorizeOptions {
+    /** Abort signal for cancelling the authorize request. */
+    readonly signal?: AbortSignal;
+}
+/**
+ * Internal Partner authorization state machine shared by public facades.
+ *
+ * @internal
+ */
+export declare class PartnerAuthCore {
+    #private;
+    /** Low-level Partner raw client used for authorization and Partner endpoints. */
+    readonly raw: PartnerRawClient;
+    /** Partner authorization state storage. */
+    readonly partnerAccountInfo: PartnerAccountInfo;
+    /** Default transport URL guard, or null when a custom transport owns guarding. */
+    readonly urlGuard: UrlGuard | null;
+    /** Retry-wrapped transport shared by facade-specific raw clients. */
+    readonly transport: HttpTransport;
+    /** Endpoint suffixes validated from cached authorization during construction. */
+    readonly cachedEndpointSuffixes: readonly string[] | undefined;
+    /** Resolved Partner authorize realm URL. */
+    private readonly realmUrl;
+    /** Whether custom authorize realms are trusted. */
+    private readonly allowCustomAuthorizeRealm;
+    private readonly additionalAllowedSuffixes;
+    private readonly disableSsrfGuard;
+    /**
+     * Creates a shared Partner authorization core.
+     *
+     * @param options - Credentials, state storage, transport, retry, and guard settings.
+     */
+    constructor(options: PartnerAuthCoreOptions);
+    /**
+     * Authenticates with B2 Partner authorization and stores the authorization state.
+     *
+     * @param options - Optional abort signal.
+     *
+     * @returns The normalized Partner authorization response.
+     */
+    authorize(options?: PartnerAuthCoreAuthorizeOptions): Promise<PartnerAuthorizeResponse>;
+    /**
+     * Locks the default transport URL guard to suffixes from a validated auth response.
+     *
+     * @param auth - Partner authorization response to derive suffixes from.
+     */
+    lockUrlGuard(auth: PartnerAuthorizeResponse): void;
+    /**
+     * Locks the default transport URL guard to previously validated endpoint suffixes.
+     *
+     * @param derived - Validated endpoint suffixes.
+     */
+    private lockUrlGuardFromSuffixes;
+    /**
+     * Validates a Partner authorization snapshot and returns endpoint suffixes.
+     *
+     * @param auth - Partner authorization response to validate.
+     *
+     * @returns Host suffixes safe for Partner-token endpoint requests.
+     *
+     * @internal
+     */
+    private validateEndpointSuffixes;
+    /**
+     * Validates an auth snapshot, locks the default URL guard, and returns endpoint suffixes.
+     *
+     * @param auth - Partner authorization response to validate and activate.
+     *
+     * @returns Host suffixes safe for Partner-token endpoint requests.
+     *
+     * @internal
+     */
+    activateEndpointSuffixes(auth: PartnerAuthorizeResponse): readonly string[];
+    private validateCachedAuth;
+    private reauthorize;
+    private startReauthorize;
+    private doReauthorize;
+}
+//# sourceMappingURL=auth-core.d.ts.map

package/dist/partner/auth-core.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-core.d.ts","sourceRoot":"","sources":["../../src/partner/auth-core.js"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEzD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAEnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAE3D,OAAO,EAEL,gBAAgB,EAEjB,MAAM,UAAU,CAAA;AAEjB,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IAChD,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,sDAAsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1D,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IACnC,qFAAqF;IACrF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAC5C,yEAAyE;IACzE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAC7C;AAED,yEAAyE;AACzE,MAAM,WAAW,+BAA+B;IAC9C,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AASD;;;;GAIG;AACH,qBAAa,eAAe;;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;IAC9B,2CAA2C;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;IAC/C,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;IACjC,iFAAiF;IACjF,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IAC9D,4CAA4C;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAGnD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA+B;IACzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAG1C;;;;OAIG;gBACS,OAAO,EAAE,sBAAsB;IA+C3C;;;;;;OAMG;IACG,SAAS,CAAC,OAAO,CAAC,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAc7F;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAIlD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,MAAM,EAAE;IAM3E,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,gBAAgB;YAmBV,aAAa;CAI5B"}

package/dist/partner/auth-core.d.ts

@@ -0,0 +1,111 @@
+import { RetryOptions } from '../http/retry.js';
+import { HttpTransport } from '../http/transport.js';
+import { UrlGuard } from '../http/url-guard.js';
+import { PartnerAuthorizeResponse } from '../types/partner.js';
+import { PartnerAccountInfo } from './account-info.js';
+import { PartnerRawClient } from './raw.js';
+/** Shared Partner authorization options used by Partner and Backup facades. */
+export interface PartnerAuthCoreOptions {
+    /** The Master Application Key ID for the partner administrator account. */
+    readonly masterKeyId: string;
+    /** The Master Application Key secret. */
+    readonly masterKey: string;
+    /** B2 realm alias or direct trusted realm URL. Defaults to `"production"`. */
+    readonly realm?: string;
+    /** Storage backend for Partner authorization state. */
+    readonly partnerAccountInfo?: PartnerAccountInfo;
+    /** Custom HTTP transport. Defaults to {@link FetchTransport}. */
+    readonly transport?: HttpTransport;
+    /** Override retry behavior for retryable requests. */
+    readonly retry?: Partial<RetryOptions>;
+    /** Custom user-agent string prepended to the SDK default. */
+    readonly userAgent?: string;
+    /** Extra trusted host suffixes to merge into the default SSRF guard. */
+    readonly additionalAllowedHostSuffixes?: readonly string[];
+    /** Explicitly disable default SSRF guard suffix locking. */
+    readonly disableSsrfGuard?: boolean;
+    /** Whether the default fetch transport may follow same-origin GET/HEAD redirects. */
+    readonly followSameOriginRedirects?: boolean;
+    /** Allow direct custom authorize realms for tests or private proxies. */
+    readonly allowCustomAuthorizeRealm?: boolean;
+}
+/** Options for Partner authorization through {@link PartnerAuthCore}. */
+export interface PartnerAuthCoreAuthorizeOptions {
+    /** Abort signal for cancelling the authorize request. */
+    readonly signal?: AbortSignal;
+}
+/**
+ * Internal Partner authorization state machine shared by public facades.
+ *
+ * @internal
+ */
+export declare class PartnerAuthCore {
+    #private;
+    /** Low-level Partner raw client used for authorization and Partner endpoints. */
+    readonly raw: PartnerRawClient;
+    /** Partner authorization state storage. */
+    readonly partnerAccountInfo: PartnerAccountInfo;
+    /** Default transport URL guard, or null when a custom transport owns guarding. */
+    readonly urlGuard: UrlGuard | null;
+    /** Retry-wrapped transport shared by facade-specific raw clients. */
+    readonly transport: HttpTransport;
+    /** Endpoint suffixes validated from cached authorization during construction. */
+    readonly cachedEndpointSuffixes: readonly string[] | undefined;
+    /** Resolved Partner authorize realm URL. */
+    private readonly realmUrl;
+    /** Whether custom authorize realms are trusted. */
+    private readonly allowCustomAuthorizeRealm;
+    private readonly additionalAllowedSuffixes;
+    private readonly disableSsrfGuard;
+    /**
+     * Creates a shared Partner authorization core.
+     *
+     * @param options - Credentials, state storage, transport, retry, and guard settings.
+     */
+    constructor(options: PartnerAuthCoreOptions);
+    /**
+     * Authenticates with B2 Partner authorization and stores the authorization state.
+     *
+     * @param options - Optional abort signal.
+     *
+     * @returns The normalized Partner authorization response.
+     */
+    authorize(options?: PartnerAuthCoreAuthorizeOptions): Promise<PartnerAuthorizeResponse>;
+    /**
+     * Locks the default transport URL guard to suffixes from a validated auth response.
+     *
+     * @param auth - Partner authorization response to derive suffixes from.
+     */
+    lockUrlGuard(auth: PartnerAuthorizeResponse): void;
+    /**
+     * Locks the default transport URL guard to previously validated endpoint suffixes.
+     *
+     * @param derived - Validated endpoint suffixes.
+     */
+    private lockUrlGuardFromSuffixes;
+    /**
+     * Validates a Partner authorization snapshot and returns endpoint suffixes.
+     *
+     * @param auth - Partner authorization response to validate.
+     *
+     * @returns Host suffixes safe for Partner-token endpoint requests.
+     *
+     * @internal
+     */
+    private validateEndpointSuffixes;
+    /**
+     * Validates an auth snapshot, locks the default URL guard, and returns endpoint suffixes.
+     *
+     * @param auth - Partner authorization response to validate and activate.
+     *
+     * @returns Host suffixes safe for Partner-token endpoint requests.
+     *
+     * @internal
+     */
+    activateEndpointSuffixes(auth: PartnerAuthorizeResponse): readonly string[];
+    private validateCachedAuth;
+    private reauthorize;
+    private startReauthorize;
+    private doReauthorize;
+}
+//# sourceMappingURL=auth-core.d.ts.map

package/dist/partner/auth-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-core.d.ts","sourceRoot":"","sources":["../../src/partner/auth-core.js"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEzD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAEnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAE3D,OAAO,EAEL,gBAAgB,EAEjB,MAAM,UAAU,CAAA;AAEjB,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IAChD,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,sDAAsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1D,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IACnC,qFAAqF;IACrF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAC5C,yEAAyE;IACzE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAC7C;AAED,yEAAyE;AACzE,MAAM,WAAW,+BAA+B;IAC9C,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AASD;;;;GAIG;AACH,qBAAa,eAAe;;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;IAC9B,2CAA2C;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;IAC/C,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAClC,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;IACjC,iFAAiF;IACjF,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IAC9D,4CAA4C;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAGnD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA+B;IACzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAG1C;;;;OAIG;gBACS,OAAO,EAAE,sBAAsB;IA+C3C;;;;;;OAMG;IACG,SAAS,CAAC,OAAO,CAAC,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAc7F;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI;IAIlD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,MAAM,EAAE;IAM3E,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,gBAAgB;YAmBV,aAAa;CAI5B"}

package/dist/partner/auth-core.js

@@ -0,0 +1,175 @@
+import { abortReason, raceWithAbort, throwIfSignalAborted } from "../util/abort.js";
+import { DEFAULT_RETRY_OPTIONS } from "../http/retry.js";
+import { getRealmUrl } from "../auth/realms.js";
+import { UrlGuard } from "../http/url-guard.js";
+import { FetchTransport, RetryTransport } from "../http/transport.js";
+import { InMemoryPartnerAccountInfo } from "./in-memory.js";
+import { PartnerRawClient, derivePartnerAllowedSuffixes, validatePartnerAuthorizeResponseEndpoints } from "./raw.js";
+//#region src/partner/auth-core.ts
+/**
+* Internal Partner authorization state machine shared by public facades.
+*
+* @internal
+*/
+var PartnerAuthCore = class {
+	/** Low-level Partner raw client used for authorization and Partner endpoints. */
+	raw;
+	/** Partner authorization state storage. */
+	partnerAccountInfo;
+	/** Default transport URL guard, or null when a custom transport owns guarding. */
+	urlGuard;
+	/** Retry-wrapped transport shared by facade-specific raw clients. */
+	transport;
+	/** Endpoint suffixes validated from cached authorization during construction. */
+	cachedEndpointSuffixes;
+	/** Resolved Partner authorize realm URL. */
+	realmUrl;
+	/** Whether custom authorize realms are trusted. */
+	allowCustomAuthorizeRealm;
+	#masterKeyId;
+	#masterKey;
+	additionalAllowedSuffixes;
+	disableSsrfGuard;
+	#inflightReauth = null;
+	/**
+	* Creates a shared Partner authorization core.
+	*
+	* @param options - Credentials, state storage, transport, retry, and guard settings.
+	*/
+	constructor(options) {
+		this.#masterKeyId = options.masterKeyId;
+		this.#masterKey = options.masterKey;
+		this.realmUrl = getRealmUrl(options.realm ?? "production");
+		this.partnerAccountInfo = options.partnerAccountInfo ?? new InMemoryPartnerAccountInfo();
+		this.additionalAllowedSuffixes = options.additionalAllowedHostSuffixes;
+		this.disableSsrfGuard = options.disableSsrfGuard ?? false;
+		this.allowCustomAuthorizeRealm = options.allowCustomAuthorizeRealm ?? false;
+		let baseTransport;
+		if (options.transport !== void 0) {
+			baseTransport = options.transport;
+			this.urlGuard = null;
+		} else {
+			const urlGuard = new UrlGuard();
+			baseTransport = new FetchTransport({
+				urlGuard,
+				...options.userAgent !== void 0 ? { userAgent: options.userAgent } : {},
+				...options.followSameOriginRedirects !== void 0 ? { followSameOriginRedirects: options.followSameOriginRedirects } : {}
+			});
+			this.urlGuard = urlGuard;
+		}
+		this.transport = new RetryTransport({
+			transport: baseTransport,
+			retry: {
+				...DEFAULT_RETRY_OPTIONS,
+				...options.retry
+			},
+			onReauth: (signal) => this.reauthorize(signal)
+		});
+		this.cachedEndpointSuffixes = this.validateCachedAuth();
+		if (this.cachedEndpointSuffixes !== void 0) this.lockUrlGuardFromSuffixes(this.cachedEndpointSuffixes);
+		this.raw = new PartnerRawClient({
+			transport: this.transport,
+			...this.cachedEndpointSuffixes !== void 0 ? { authorizedPartnerEndpointSuffixes: this.cachedEndpointSuffixes } : {},
+			...options.allowCustomAuthorizeRealm !== void 0 ? { allowCustomAuthorizeRealm: options.allowCustomAuthorizeRealm } : {}
+		});
+	}
+	/**
+	* Authenticates with B2 Partner authorization and stores the authorization state.
+	*
+	* @param options - Optional abort signal.
+	*
+	* @returns The normalized Partner authorization response.
+	*/
+	async authorize(options) {
+		throwIfSignalAborted(options?.signal);
+		const auth = await this.raw.authorizePartner(this.#masterKeyId, this.#masterKey, this.realmUrl, options?.signal !== void 0 ? { signal: options.signal } : void 0);
+		throwIfSignalAborted(options?.signal);
+		this.partnerAccountInfo.setAuth(auth);
+		this.lockUrlGuard(auth);
+		return auth;
+	}
+	/**
+	* Locks the default transport URL guard to suffixes from a validated auth response.
+	*
+	* @param auth - Partner authorization response to derive suffixes from.
+	*/
+	lockUrlGuard(auth) {
+		this.lockUrlGuardFromSuffixes(derivePartnerAllowedSuffixes(auth, this.realmUrl));
+	}
+	/**
+	* Locks the default transport URL guard to previously validated endpoint suffixes.
+	*
+	* @param derived - Validated endpoint suffixes.
+	*/
+	lockUrlGuardFromSuffixes(derived) {
+		if (this.urlGuard === null) return;
+		const merged = this.disableSsrfGuard === true ? [] : this.additionalAllowedSuffixes !== void 0 ? Array.from(/* @__PURE__ */ new Set([...derived, ...this.additionalAllowedSuffixes])) : derived;
+		this.urlGuard.setAllowedSuffixes(merged);
+	}
+	/**
+	* Validates a Partner authorization snapshot and returns endpoint suffixes.
+	*
+	* @param auth - Partner authorization response to validate.
+	*
+	* @returns Host suffixes safe for Partner-token endpoint requests.
+	*
+	* @internal
+	*/
+	validateEndpointSuffixes(auth) {
+		return validatePartnerAuthorizeResponseEndpoints(auth, this.realmUrl, this.allowCustomAuthorizeRealm);
+	}
+	/**
+	* Validates an auth snapshot, locks the default URL guard, and returns endpoint suffixes.
+	*
+	* @param auth - Partner authorization response to validate and activate.
+	*
+	* @returns Host suffixes safe for Partner-token endpoint requests.
+	*
+	* @internal
+	*/
+	activateEndpointSuffixes(auth) {
+		const suffixes = this.validateEndpointSuffixes(auth);
+		this.lockUrlGuardFromSuffixes(suffixes);
+		return suffixes;
+	}
+	validateCachedAuth() {
+		const cachedAuth = this.partnerAccountInfo.getAuth();
+		if (cachedAuth === null) return void 0;
+		try {
+			return this.validateEndpointSuffixes(cachedAuth);
+		} catch {
+			return;
+		}
+	}
+	reauthorize(signal) {
+		throwIfSignalAborted(signal);
+		const inflight = this.#inflightReauth ?? this.startReauthorize();
+		inflight.waiters += 1;
+		return raceWithAbort(inflight.promise, signal).finally(() => {
+			inflight.waiters -= 1;
+			if (inflight.waiters === 0 && !inflight.settled && !inflight.controller.signal.aborted) inflight.controller.abort(signal?.aborted === true ? abortReason(signal) : void 0);
+		});
+	}
+	startReauthorize() {
+		const controller = new AbortController();
+		const inflight = {
+			controller,
+			promise: raceWithAbort(this.doReauthorize(controller.signal), controller.signal).finally(() => {
+				if (this.#inflightReauth?.controller !== controller) return;
+				this.#inflightReauth.settled = true;
+				this.#inflightReauth = null;
+			}),
+			waiters: 0,
+			settled: false
+		};
+		this.#inflightReauth = inflight;
+		return inflight;
+	}
+	async doReauthorize(signal) {
+		return (await this.authorize({ signal })).authorizationToken;
+	}
+};
+//#endregion
+export { PartnerAuthCore };
+
+//# sourceMappingURL=auth-core.js.map

package/dist/partner/auth-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-core.js","names":["#masterKeyId","#masterKey","#inflightReauth"],"sources":["../../src/partner/auth-core.ts"],"sourcesContent":["import { getRealmUrl } from '../auth/realms.ts'\nimport { DEFAULT_RETRY_OPTIONS, type RetryOptions } from '../http/retry.ts'\nimport type { HttpTransport } from '../http/transport.ts'\nimport { FetchTransport, RetryTransport } from '../http/transport.ts'\nimport { UrlGuard } from '../http/url-guard.ts'\nimport type { PartnerAuthorizeResponse } from '../types/partner.ts'\nimport { abortReason, raceWithAbort, throwIfSignalAborted } from '../util/abort.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { InMemoryPartnerAccountInfo } from './in-memory.ts'\nimport {\n  derivePartnerAllowedSuffixes,\n  PartnerRawClient,\n  validatePartnerAuthorizeResponseEndpoints,\n} from './raw.ts'\n\n/** Shared Partner authorization options used by Partner and Backup facades. */\nexport interface PartnerAuthCoreOptions {\n  /** The Master Application Key ID for the partner administrator account. */\n  readonly masterKeyId: string\n  /** The Master Application Key secret. */\n  readonly masterKey: string\n  /** B2 realm alias or direct trusted realm URL. Defaults to `\"production\"`. */\n  readonly realm?: string\n  /** Storage backend for Partner authorization state. */\n  readonly partnerAccountInfo?: PartnerAccountInfo\n  /** Custom HTTP transport. Defaults to {@link FetchTransport}. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior for retryable requests. */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /** Extra trusted host suffixes to merge into the default SSRF guard. */\n  readonly additionalAllowedHostSuffixes?: readonly string[]\n  /** Explicitly disable default SSRF guard suffix locking. */\n  readonly disableSsrfGuard?: boolean\n  /** Whether the default fetch transport may follow same-origin GET/HEAD redirects. */\n  readonly followSameOriginRedirects?: boolean\n  /** Allow direct custom authorize realms for tests or private proxies. */\n  readonly allowCustomAuthorizeRealm?: boolean\n}\n\n/** Options for Partner authorization through {@link PartnerAuthCore}. */\nexport interface PartnerAuthCoreAuthorizeOptions {\n  /** Abort signal for cancelling the authorize request. */\n  readonly signal?: AbortSignal\n}\n\ninterface InflightPartnerReauth {\n  readonly controller: AbortController\n  readonly promise: Promise<string>\n  waiters: number\n  settled: boolean\n}\n\n/**\n * Internal Partner authorization state machine shared by public facades.\n *\n * @internal\n */\nexport class PartnerAuthCore {\n  /** Low-level Partner raw client used for authorization and Partner endpoints. */\n  readonly raw: PartnerRawClient\n  /** Partner authorization state storage. */\n  readonly partnerAccountInfo: PartnerAccountInfo\n  /** Default transport URL guard, or null when a custom transport owns guarding. */\n  readonly urlGuard: UrlGuard | null\n  /** Retry-wrapped transport shared by facade-specific raw clients. */\n  readonly transport: HttpTransport\n  /** Endpoint suffixes validated from cached authorization during construction. */\n  readonly cachedEndpointSuffixes: readonly string[] | undefined\n  /** Resolved Partner authorize realm URL. */\n  private readonly realmUrl: string\n  /** Whether custom authorize realms are trusted. */\n  private readonly allowCustomAuthorizeRealm: boolean\n  readonly #masterKeyId: string\n  readonly #masterKey: string\n  private readonly additionalAllowedSuffixes: readonly string[] | undefined\n  private readonly disableSsrfGuard: boolean\n  #inflightReauth: InflightPartnerReauth | null = null\n\n  /**\n   * Creates a shared Partner authorization core.\n   *\n   * @param options - Credentials, state storage, transport, retry, and guard settings.\n   */\n  constructor(options: PartnerAuthCoreOptions) {\n    this.#masterKeyId = options.masterKeyId\n    this.#masterKey = options.masterKey\n    this.realmUrl = getRealmUrl(options.realm ?? 'production')\n    this.partnerAccountInfo = options.partnerAccountInfo ?? new InMemoryPartnerAccountInfo()\n    this.additionalAllowedSuffixes = options.additionalAllowedHostSuffixes\n    this.disableSsrfGuard = options.disableSsrfGuard ?? false\n    this.allowCustomAuthorizeRealm = options.allowCustomAuthorizeRealm ?? false\n\n    let baseTransport: HttpTransport\n    if (options.transport !== undefined) {\n      baseTransport = options.transport\n      this.urlGuard = null\n    } else {\n      const urlGuard = new UrlGuard()\n      baseTransport = new FetchTransport({\n        urlGuard,\n        ...(options.userAgent !== undefined ? { userAgent: options.userAgent } : {}),\n        ...(options.followSameOriginRedirects !== undefined\n          ? { followSameOriginRedirects: options.followSameOriginRedirects }\n          : {}),\n      })\n      this.urlGuard = urlGuard\n    }\n\n    this.transport = new RetryTransport({\n      transport: baseTransport,\n      retry: { ...DEFAULT_RETRY_OPTIONS, ...options.retry },\n      onReauth: (signal) => this.reauthorize(signal),\n    })\n\n    this.cachedEndpointSuffixes = this.validateCachedAuth()\n    if (this.cachedEndpointSuffixes !== undefined) {\n      this.lockUrlGuardFromSuffixes(this.cachedEndpointSuffixes)\n    }\n\n    this.raw = new PartnerRawClient({\n      transport: this.transport,\n      ...(this.cachedEndpointSuffixes !== undefined\n        ? { authorizedPartnerEndpointSuffixes: this.cachedEndpointSuffixes }\n        : {}),\n      ...(options.allowCustomAuthorizeRealm !== undefined\n        ? { allowCustomAuthorizeRealm: options.allowCustomAuthorizeRealm }\n        : {}),\n    })\n  }\n\n  /**\n   * Authenticates with B2 Partner authorization and stores the authorization state.\n   *\n   * @param options - Optional abort signal.\n   *\n   * @returns The normalized Partner authorization response.\n   */\n  async authorize(options?: PartnerAuthCoreAuthorizeOptions): Promise<PartnerAuthorizeResponse> {\n    throwIfSignalAborted(options?.signal)\n    const auth = await this.raw.authorizePartner(\n      this.#masterKeyId,\n      this.#masterKey,\n      this.realmUrl,\n      options?.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n    throwIfSignalAborted(options?.signal)\n    this.partnerAccountInfo.setAuth(auth)\n    this.lockUrlGuard(auth)\n    return auth\n  }\n\n  /**\n   * Locks the default transport URL guard to suffixes from a validated auth response.\n   *\n   * @param auth - Partner authorization response to derive suffixes from.\n   */\n  lockUrlGuard(auth: PartnerAuthorizeResponse): void {\n    this.lockUrlGuardFromSuffixes(derivePartnerAllowedSuffixes(auth, this.realmUrl))\n  }\n\n  /**\n   * Locks the default transport URL guard to previously validated endpoint suffixes.\n   *\n   * @param derived - Validated endpoint suffixes.\n   */\n  private lockUrlGuardFromSuffixes(derived: readonly string[]): void {\n    if (this.urlGuard === null) return\n    const merged =\n      this.disableSsrfGuard === true\n        ? []\n        : this.additionalAllowedSuffixes !== undefined\n          ? Array.from(new Set([...derived, ...this.additionalAllowedSuffixes]))\n          : derived\n    this.urlGuard.setAllowedSuffixes(merged)\n  }\n\n  /**\n   * Validates a Partner authorization snapshot and returns endpoint suffixes.\n   *\n   * @param auth - Partner authorization response to validate.\n   *\n   * @returns Host suffixes safe for Partner-token endpoint requests.\n   *\n   * @internal\n   */\n  private validateEndpointSuffixes(auth: PartnerAuthorizeResponse): readonly string[] {\n    return validatePartnerAuthorizeResponseEndpoints(\n      auth,\n      this.realmUrl,\n      this.allowCustomAuthorizeRealm,\n    )\n  }\n\n  /**\n   * Validates an auth snapshot, locks the default URL guard, and returns endpoint suffixes.\n   *\n   * @param auth - Partner authorization response to validate and activate.\n   *\n   * @returns Host suffixes safe for Partner-token endpoint requests.\n   *\n   * @internal\n   */\n  activateEndpointSuffixes(auth: PartnerAuthorizeResponse): readonly string[] {\n    const suffixes = this.validateEndpointSuffixes(auth)\n    this.lockUrlGuardFromSuffixes(suffixes)\n    return suffixes\n  }\n\n  private validateCachedAuth(): readonly string[] | undefined {\n    const cachedAuth = this.partnerAccountInfo.getAuth()\n    if (cachedAuth === null) return undefined\n    try {\n      return this.validateEndpointSuffixes(cachedAuth)\n    } catch {\n      // Do not mutate a shared PartnerAccountInfo during construction. The\n      // facade will ignore this auth locally until authorize() replaces it.\n      return undefined\n    }\n  }\n\n  private reauthorize(signal: AbortSignal | undefined): Promise<string> {\n    throwIfSignalAborted(signal)\n    const inflight = this.#inflightReauth ?? this.startReauthorize()\n    inflight.waiters += 1\n    return raceWithAbort(inflight.promise, signal).finally(() => {\n      inflight.waiters -= 1\n      if (inflight.waiters === 0 && !inflight.settled && !inflight.controller.signal.aborted) {\n        inflight.controller.abort(signal?.aborted === true ? abortReason(signal) : undefined)\n      }\n    })\n  }\n\n  private startReauthorize(): InflightPartnerReauth {\n    const controller = new AbortController()\n    const promise = raceWithAbort(this.doReauthorize(controller.signal), controller.signal).finally(\n      () => {\n        if (this.#inflightReauth?.controller !== controller) return\n        this.#inflightReauth.settled = true\n        this.#inflightReauth = null\n      },\n    )\n    const inflight: InflightPartnerReauth = {\n      controller,\n      promise,\n      waiters: 0,\n      settled: false,\n    }\n    this.#inflightReauth = inflight\n    return inflight\n  }\n\n  private async doReauthorize(signal: AbortSignal): Promise<string> {\n    const auth = await this.authorize({ signal })\n    return auth.authorizationToken\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA2DA,IAAa,kBAAb,MAA6B;;CAE3B;;CAEA;;CAEA;;CAEA;;CAEA;;CAEA;;CAEA;CACA;CACA;CACA;CACA;CACA,kBAAgD;;;;;;CAOhD,YAAY,SAAiC;EAC3C,KAAKA,eAAe,QAAQ;EAC5B,KAAKC,aAAa,QAAQ;EAC1B,KAAK,WAAW,YAAY,QAAQ,SAAS,YAAY;EACzD,KAAK,qBAAqB,QAAQ,sBAAsB,IAAI,2BAA2B;EACvF,KAAK,4BAA4B,QAAQ;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,4BAA4B,QAAQ,6BAA6B;EAEtE,IAAI;EACJ,IAAI,QAAQ,cAAc,KAAA,GAAW;GACnC,gBAAgB,QAAQ;GACxB,KAAK,WAAW;EAClB,OAAO;GACL,MAAM,WAAW,IAAI,SAAS;GAC9B,gBAAgB,IAAI,eAAe;IACjC;IACA,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC1E,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;GACP,CAAC;GACD,KAAK,WAAW;EAClB;EAEA,KAAK,YAAY,IAAI,eAAe;GAClC,WAAW;GACX,OAAO;IAAE,GAAG;IAAuB,GAAG,QAAQ;GAAM;GACpD,WAAW,WAAW,KAAK,YAAY,MAAM;EAC/C,CAAC;EAED,KAAK,yBAAyB,KAAK,mBAAmB;EACtD,IAAI,KAAK,2BAA2B,KAAA,GAClC,KAAK,yBAAyB,KAAK,sBAAsB;EAG3D,KAAK,MAAM,IAAI,iBAAiB;GAC9B,WAAW,KAAK;GAChB,GAAI,KAAK,2BAA2B,KAAA,IAChC,EAAE,mCAAmC,KAAK,uBAAuB,IACjE,CAAC;GACL,GAAI,QAAQ,8BAA8B,KAAA,IACtC,EAAE,2BAA2B,QAAQ,0BAA0B,IAC/D,CAAC;EACP,CAAC;CACH;;;;;;;;CASA,MAAM,UAAU,SAA8E;EAC5F,qBAAqB,SAAS,MAAM;EACpC,MAAM,OAAO,MAAM,KAAK,IAAI,iBAC1B,KAAKD,cACL,KAAKC,YACL,KAAK,UACL,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC/D;EACA,qBAAqB,SAAS,MAAM;EACpC,KAAK,mBAAmB,QAAQ,IAAI;EACpC,KAAK,aAAa,IAAI;EACtB,OAAO;CACT;;;;;;CAOA,aAAa,MAAsC;EACjD,KAAK,yBAAyB,6BAA6B,MAAM,KAAK,QAAQ,CAAC;CACjF;;;;;;CAOA,yBAAiC,SAAkC;EACjE,IAAI,KAAK,aAAa,MAAM;EAC5B,MAAM,SACJ,KAAK,qBAAqB,OACtB,CAAC,IACD,KAAK,8BAA8B,KAAA,IACjC,MAAM,qBAAK,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK,yBAAyB,CAAC,CAAC,IACnE;EACR,KAAK,SAAS,mBAAmB,MAAM;CACzC;;;;;;;;;;CAWA,yBAAiC,MAAmD;EAClF,OAAO,0CACL,MACA,KAAK,UACL,KAAK,yBACP;CACF;;;;;;;;;;CAWA,yBAAyB,MAAmD;EAC1E,MAAM,WAAW,KAAK,yBAAyB,IAAI;EACnD,KAAK,yBAAyB,QAAQ;EACtC,OAAO;CACT;CAEA,qBAA4D;EAC1D,MAAM,aAAa,KAAK,mBAAmB,QAAQ;EACnD,IAAI,eAAe,MAAM,OAAO,KAAA;EAChC,IAAI;GACF,OAAO,KAAK,yBAAyB,UAAU;EACjD,QAAQ;GAGN;EACF;CACF;CAEA,YAAoB,QAAkD;EACpE,qBAAqB,MAAM;EAC3B,MAAM,WAAW,KAAKC,mBAAmB,KAAK,iBAAiB;EAC/D,SAAS,WAAW;EACpB,OAAO,cAAc,SAAS,SAAS,MAAM,CAAC,CAAC,cAAc;GAC3D,SAAS,WAAW;GACpB,IAAI,SAAS,YAAY,KAAK,CAAC,SAAS,WAAW,CAAC,SAAS,WAAW,OAAO,SAC7E,SAAS,WAAW,MAAM,QAAQ,YAAY,OAAO,YAAY,MAAM,IAAI,KAAA,CAAS;EAExF,CAAC;CACH;CAEA,mBAAkD;EAChD,MAAM,aAAa,IAAI,gBAAgB;EAQvC,MAAM,WAAkC;GACtC;GACA,SATc,cAAc,KAAK,cAAc,WAAW,MAAM,GAAG,WAAW,MAAM,CAAC,CAAC,cAChF;IACJ,IAAI,KAAKA,iBAAiB,eAAe,YAAY;IACrD,KAAKA,gBAAgB,UAAU;IAC/B,KAAKA,kBAAkB;GACzB,CAIA;GACA,SAAS;GACT,SAAS;EACX;EACA,KAAKA,kBAAkB;EACvB,OAAO;CACT;CAEA,MAAc,cAAc,QAAsC;EAEhE,QAAO,MADY,KAAK,UAAU,EAAE,OAAO,CAAC,EAAA,CAChC;CACd;AACF"}