@backblaze-labs/b2-sdk 0.2.0 → 0.4.0

package/dist/partner/raw.cjs

@@ -0,0 +1,400 @@
+const require_ids = require("../types/ids.cjs");
+const require_errors_index = require("../errors/index.cjs");
+const require_realms = require("../auth/realms.cjs");
+const require_url_guard = require("../http/url-guard.cjs");
+const require_transport = require("../http/transport.cjs");
+const require_url = require("../raw/url.cjs");
+const require_auth_shape = require("./auth-shape.cjs");
+const require_redaction = require("./redaction.cjs");
+const require_endpoint_url = require("./endpoint-url.cjs");
+//#region src/partner/raw.ts
+var PARTNER_API_PREFIX = "b2api";
+var PARTNER_AUTHORIZE_API = {
+	prefix: PARTNER_API_PREFIX,
+	version: "v3"
+};
+var PARTNER_GROUPS_API = {
+	prefix: PARTNER_API_PREFIX,
+	version: "v4"
+};
+var DEFAULT_PARTNER_REALM_URL = "https://api.backblazeb2.com";
+var PRODUCTION_HOST_SUFFIX = "backblazeb2.com";
+var PRODUCTION_ENDPOINT_HOST_SUFFIX = "backblaze.com";
+var STAGING_HOST_SUFFIX = "backblaze.net";
+var VERIFIED_PARTNER_AUTHORIZE_REALM_ORIGINS = /* @__PURE__ */ new Set(["https://api.backblazeb2.com", "https://api.backblaze.net"]);
+function assertVerifiedPartnerAuthorizeRealm(realmUrl, allowCustomAuthorizeRealm) {
+	if (allowCustomAuthorizeRealm) return;
+	const realm = new URL(realmUrl);
+	if (VERIFIED_PARTNER_AUTHORIZE_REALM_ORIGINS.has(realm.origin)) return;
+	throw new require_errors_index.B2RealmConfigurationError(`refusing to send Master Application Key credentials to unverified Partner authorize realm: ${realm.origin}`);
+}
+function endpointAllowedSuffixesForRealm(realmUrl, allowCustomAuthorizeRealm) {
+	const realmHost = new URL(realmUrl).hostname.toLowerCase();
+	if (require_url_guard.hostMatchesAllowedSuffix(realmHost, PRODUCTION_HOST_SUFFIX)) return [PRODUCTION_ENDPOINT_HOST_SUFFIX, PRODUCTION_HOST_SUFFIX];
+	if (require_url_guard.hostMatchesAllowedSuffix(realmHost, STAGING_HOST_SUFFIX)) return [STAGING_HOST_SUFFIX];
+	return allowCustomAuthorizeRealm ? [authorizeRealmAllowedSuffix(realmUrl)] : [realmHost];
+}
+function authorizeRealmAllowedSuffix(realmUrl) {
+	const host = new URL(realmUrl).hostname.toLowerCase();
+	if (require_url_guard.hostMatchesAllowedSuffix(host, PRODUCTION_HOST_SUFFIX)) return PRODUCTION_HOST_SUFFIX;
+	if (require_url_guard.hostMatchesAllowedSuffix(host, STAGING_HOST_SUFFIX)) return STAGING_HOST_SUFFIX;
+	if (require_url_guard.hostMatchesAllowedSuffix(host, PRODUCTION_ENDPOINT_HOST_SUFFIX)) return PRODUCTION_ENDPOINT_HOST_SUFFIX;
+	return host;
+}
+function endpointAllowedSuffix(url) {
+	const host = new URL(url).hostname.toLowerCase();
+	if (require_url_guard.hostMatchesAllowedSuffix(host, PRODUCTION_HOST_SUFFIX)) return PRODUCTION_HOST_SUFFIX;
+	if (require_url_guard.hostMatchesAllowedSuffix(host, STAGING_HOST_SUFFIX)) return STAGING_HOST_SUFFIX;
+	if (require_url_guard.hostMatchesAllowedSuffix(host, PRODUCTION_ENDPOINT_HOST_SUFFIX)) return PRODUCTION_ENDPOINT_HOST_SUFFIX;
+	return host;
+}
+function normalizeGroupsApi(groupsApi, allowedSuffixes) {
+	return {
+		...groupsApi,
+		groupsApiUrl: require_endpoint_url.validatePartnerEndpointUrl(groupsApi.groupsApiUrl, "groupsApiUrl", allowedSuffixes),
+		capabilities: [...groupsApi.capabilities ?? []],
+		infoType: "groupsApi"
+	};
+}
+function normalizeBackupApi(backupApi, allowedSuffixes) {
+	return {
+		...backupApi,
+		backupApiUrl: require_endpoint_url.validatePartnerEndpointUrl(backupApi.backupApiUrl, "backupApiUrl", allowedSuffixes),
+		capabilities: [...backupApi.capabilities ?? []],
+		infoType: "backupApi"
+	};
+}
+function normalizePartnerAuthorizeResponse(response, realmUrl, allowCustomAuthorizeRealm) {
+	const { groupsApi, backupApi } = response.apiInfo;
+	if (groupsApi === void 0 && backupApi === void 0) throw new require_errors_index.B2PartnerAuthorizationError("Partner authorize response did not include apiInfo.groupsApi or apiInfo.backupApi");
+	const allowedSuffixes = endpointAllowedSuffixesForRealm(realmUrl, allowCustomAuthorizeRealm);
+	const normalizedGroupsApi = groupsApi !== void 0 ? normalizeGroupsApi(groupsApi, allowedSuffixes) : void 0;
+	const normalizedBackupApi = backupApi !== void 0 ? normalizeBackupApi(backupApi, allowedSuffixes) : void 0;
+	const apiInfo = {
+		...response.apiInfo.storageApi !== void 0 ? { storageApi: response.apiInfo.storageApi } : {},
+		...normalizedGroupsApi !== void 0 ? { groupsApi: normalizedGroupsApi } : {},
+		...normalizedBackupApi !== void 0 ? { backupApi: normalizedBackupApi } : {}
+	};
+	const normalized = {
+		accountId: require_ids.accountId(response.accountId),
+		authorizationToken: require_ids.partnerToken(response.authorizationToken),
+		apiInfo,
+		...normalizedGroupsApi !== void 0 ? { groupsApiUrl: normalizedGroupsApi.groupsApiUrl } : {},
+		...normalizedBackupApi !== void 0 ? { backupApiUrl: normalizedBackupApi.backupApiUrl } : {},
+		...normalizedGroupsApi !== void 0 ? { groupsCapabilities: normalizedGroupsApi.capabilities } : {},
+		...normalizedBackupApi !== void 0 ? { backupCapabilities: normalizedBackupApi.capabilities } : {},
+		applicationKeyExpirationTimestamp: response.applicationKeyExpirationTimestamp
+	};
+	require_auth_shape.validatePartnerAuthorizeResponseShape(normalized);
+	return require_redaction.redactPartnerAuthorizeResponse(normalized);
+}
+/**
+* Derives the Partner authorize and endpoint host suffixes that may receive
+* Partner tokens after a trusted authorize response has been validated.
+*
+* @param auth - Normalized Partner authorize response.
+* @param realmUrl - Realm URL used for Partner authorization.
+*
+* @returns Sorted list of unique host suffixes to allow.
+*
+* @internal
+*/
+function derivePartnerAllowedSuffixes(auth, realmUrl) {
+	const suffixes = /* @__PURE__ */ new Set([authorizeRealmAllowedSuffix(realmUrl)]);
+	if (auth.apiInfo.groupsApi !== void 0) suffixes.add(endpointAllowedSuffix(auth.apiInfo.groupsApi.groupsApiUrl));
+	if (auth.apiInfo.backupApi !== void 0) suffixes.add(endpointAllowedSuffix(auth.apiInfo.backupApi.backupApiUrl));
+	return Array.from(suffixes).sort();
+}
+/**
+* Validates cached Partner authorize endpoint URLs with the same realm policy
+* applied to fresh `authorizePartner()` responses and returns guard suffixes.
+*
+* @param auth - Cached Partner authorize response to validate.
+* @param realmUrl - Realm URL used for Partner authorization.
+* @param allowCustomAuthorizeRealm - Whether custom authorize realms are trusted.
+*
+* @returns Sorted list of host suffixes derived from the validated auth state.
+*
+* @throws B2PartnerAuthorizationError if the cached auth endpoints are unsafe.
+*
+* @internal
+*/
+function validatePartnerAuthorizeResponseEndpoints(auth, realmUrl, allowCustomAuthorizeRealm) {
+	require_realms.assertSecureRealmUrl(realmUrl);
+	assertVerifiedPartnerAuthorizeRealm(realmUrl, allowCustomAuthorizeRealm);
+	require_auth_shape.validatePartnerAuthorizeResponseShape(auth);
+	const { groupsApi, backupApi } = auth.apiInfo;
+	const allowedSuffixes = endpointAllowedSuffixesForRealm(realmUrl, allowCustomAuthorizeRealm);
+	if (groupsApi !== void 0) require_endpoint_url.validatePartnerEndpointUrl(groupsApi.groupsApiUrl, "groupsApiUrl", allowedSuffixes);
+	if (backupApi !== void 0) require_endpoint_url.validatePartnerEndpointUrl(backupApi.backupApiUrl, "backupApiUrl", allowedSuffixes);
+	return derivePartnerAllowedSuffixes(auth, realmUrl);
+}
+function lockTransportUrlGuard(transport, allowedSuffixes) {
+	const guard = require_transport.getTransportUrlGuard(transport);
+	if (guard === void 0) return;
+	const suffixes = /* @__PURE__ */ new Set([...guard.getAllowedSuffixes(), ...allowedSuffixes]);
+	guard.setAllowedSuffixes(Array.from(suffixes).sort());
+}
+function partnerEndpointAllowedSuffixes(transport, authorizedSuffixes) {
+	return require_endpoint_url.endpointAllowedSuffixes(transport, authorizedSuffixes, {
+		missingGuard: "Partner endpoint requests require authorizePartner() or a UrlGuardedTransport with a locked URL guard before sending Partner tokens",
+		unlockedGuard: "Partner endpoint requests require a locked URL guard before sending Partner tokens"
+	});
+}
+function validatePartnerRequestGroupsApiUrl(transport, authorizedSuffixes, groupsApiUrl) {
+	return require_endpoint_url.validatePartnerEndpointUrl(groupsApiUrl, "groupsApiUrl", partnerEndpointAllowedSuffixes(transport, authorizedSuffixes));
+}
+function reserveTrialCreateAccountRequestBody(request) {
+	if (Array.isArray(request)) throw new TypeError("reserveTrialCreateAccount request must be a single account object.");
+	return {
+		email: request.email,
+		term: request.term,
+		storage: request.storage,
+		...request.region != null ? { region: request.region } : {}
+	};
+}
+function partnerAuthorizeUrl(realmUrl) {
+	return require_url.b2Url(realmUrl, {
+		...PARTNER_AUTHORIZE_API,
+		endpoint: "b2_authorize_account"
+	});
+}
+function partnerGroupsEndpointUrl(groupsApiUrl, endpoint) {
+	return require_url.b2Url(groupsApiUrl, {
+		...PARTNER_GROUPS_API,
+		endpoint
+	});
+}
+/**
+* Low-level client for Partner API authorization and endpoint bindings.
+*/
+var PartnerRawClient = class {
+	/** @internal */
+	transport;
+	allowCustomAuthorizeRealm;
+	authorizedEndpointSuffixes;
+	/**
+	* Creates a new PartnerRawClient with the given transport.
+	*
+	* @param options - The constructor configuration.
+	*/
+	constructor(options) {
+		this.transport = options.transport;
+		this.allowCustomAuthorizeRealm = options.allowCustomAuthorizeRealm ?? false;
+		this.authorizedEndpointSuffixes = Array.from(options.authorizedPartnerEndpointSuffixes ?? []);
+	}
+	/**
+	* Replaces the validated Partner endpoint host suffixes.
+	*
+	* @param suffixes - Host suffixes derived from Partner authorization.
+	*
+	* @internal
+	*/
+	setAuthorizedEndpointSuffixes(suffixes) {
+		this.authorizedEndpointSuffixes = Array.from(suffixes);
+	}
+	/**
+	* Calls `b2_authorize_account` with Master Application Key credentials and
+	* normalizes the Partner/Backup suites into a Partner-specific auth shape.
+	*
+	* The Partner API documentation currently shows the v3 authorize path, so
+	* this method intentionally uses `/b2api/v3/b2_authorize_account` while the
+	* storage raw client keeps using v4.
+	*
+	* @param masterKeyId - The Master Application Key ID for authentication.
+	* @param masterKey - The Master Application Key secret.
+	* @param realmUrl - The B2 realm URL to authenticate against.
+	* @param options - Optional abort and per-request retry settings.
+	*
+	* @returns The normalized Partner authorization response.
+	*
+	* @throws B2RealmConfigurationError if the realm URL is unsafe for Master Application Key credentials.
+	* @throws B2PartnerAuthorizationError if the response omits or returns unsafe Partner endpoint data.
+	*/
+	async authorizePartner(masterKeyId, masterKey, realmUrl = DEFAULT_PARTNER_REALM_URL, options) {
+		require_realms.assertSecureRealmUrl(realmUrl);
+		assertVerifiedPartnerAuthorizeRealm(realmUrl, this.allowCustomAuthorizeRealm);
+		const auth = normalizePartnerAuthorizeResponse(await (await this.transport.send({
+			url: partnerAuthorizeUrl(realmUrl),
+			method: "GET",
+			headers: { Authorization: `Basic ${btoa(`${masterKeyId}:${masterKey}`)}` },
+			...options?.signal !== void 0 ? { signal: options.signal } : {},
+			...options?.retry !== void 0 ? { retry: options.retry } : {}
+		})).json(), realmUrl, this.allowCustomAuthorizeRealm);
+		const suffixes = derivePartnerAllowedSuffixes(auth, realmUrl);
+		this.setAuthorizedEndpointSuffixes(suffixes);
+		lockTransportUrlGuard(this.transport, suffixes);
+		return auth;
+	}
+	/**
+	* Calls {@link https://www.backblaze.com/apidocs/b2-create-group-member | b2_create_group_member}.
+	*
+	* The Partner API creates a new Backblaze account for an email address that
+	* is not already a Backblaze account and adds that account to the managed
+	* group. The wire response is a single JSON object.
+	*
+	* @param groupsApiUrl - The Partner API base URL from `authorizePartner`.
+	* @param authToken - The Partner API authorization token.
+	* @param request - The group-member creation request body.
+	* @param options - Optional abort and per-request retry settings.
+	*
+	* @returns The created member result, including the member application key.
+	*/
+	async createGroupMember(groupsApiUrl, authToken, request, options) {
+		const response = await this.postNonRetryingMutationJson(groupsApiUrl, authToken, "b2_create_group_member", {
+			adminAccountId: request.adminAccountId,
+			groupId: request.groupId,
+			memberEmail: request.memberEmail,
+			...request.region != null ? { region: request.region } : {}
+		}, options);
+		return require_redaction.redactCreateGroupMemberResponse(response);
+	}
+	/**
+	* Calls {@link https://www.backblaze.com/apidocs/b2-eject-group-member | b2_eject_group_member}.
+	*
+	* Ejection removes the member account from the group but does not delete the
+	* Backblaze account. The wire response is a single JSON object.
+	*
+	* @param groupsApiUrl - The Partner API base URL from `authorizePartner`.
+	* @param authToken - The Partner API authorization token.
+	* @param request - The group-member ejection request body.
+	* @param options - Optional abort and per-request retry settings.
+	*
+	* @returns The ejected member object.
+	*/
+	async ejectGroupMember(groupsApiUrl, authToken, request, options) {
+		return this.postNonRetryingMutationJson(groupsApiUrl, authToken, "b2_eject_group_member", {
+			adminAccountId: request.adminAccountId,
+			groupId: request.groupId,
+			memberAccountId: request.memberAccountId,
+			...request.email !== void 0 ? { email: request.email } : {}
+		}, options);
+	}
+	/**
+	* Calls {@link https://www.backblaze.com/apidocs/b2-reserve-trial-create-account | b2_reserve_trial_create_account}.
+	*
+	* The Partner API creates one new Backblaze B2 account and starts a B2
+	* Reserve trial for it. The wire request and success response are single
+	* JSON objects.
+	*
+	* Each email address must not already be a Backblaze account. `term` is the
+	* trial duration in days, documented as 7 through 30 inclusive. `storage` is
+	* the requested storage in TB, documented as 1 through 50 inclusive.
+	*
+	* This operation is non-idempotent and creates billable accounts. Automatic
+	* retries and expired-token reauthorization are disabled; long-lived
+	* callers must catch auth expiry, reauthorize, and then decide whether to
+	* issue a new request. A network or timeout failure after the server has
+	* processed the request may still have created an account, and the
+	* application key from a lost response is not recoverable from B2. Callers
+	* should reconcile account state out of band, such as through Partner
+	* account listing, before re-issuing a request for the same email address.
+	*
+	* @param groupsApiUrl - The Partner API base URL from `authorizePartner`. The authorize response currently exposes the shared Partner endpoint base as `groupsApiUrl`.
+	* @param authToken - The Partner API authorization token.
+	* @param request - Email, term, storage, and optional region for the account to create.
+	* @param options - Optional abort and per-request retry settings.
+	*
+	* @returns The created reserve-trial account result.
+	*
+	* @experimental Partner API surface; shape may change as the Partner API docs evolve.
+	*/
+	async reserveTrialCreateAccount(groupsApiUrl, authToken, request, options) {
+		const response = await this.postNonRetryingMutationJson(groupsApiUrl, authToken, "b2_reserve_trial_create_account", reserveTrialCreateAccountRequestBody(request), options);
+		return require_redaction.redactReserveTrialCreateAccountResponse(response);
+	}
+	/**
+	* Calls {@link https://www.backblaze.com/apidocs/b2-list-groups | b2_list_groups}.
+	*
+	* Uses the documented canonical GET form. The wire response is a single JSON
+	* object that surfaces `nextGroupId` for cursor-based pagination.
+	*
+	* @param groupsApiUrl - The Partner API base URL from `authorizePartner`.
+	* @param authToken - The Partner API authorization token.
+	* @param request - The group listing query parameters.
+	* @param options - Optional abort and per-request retry settings.
+	*
+	* @returns The groups page object.
+	*/
+	async listGroups(groupsApiUrl, authToken, request, options) {
+		return this.getJson(groupsApiUrl, authToken, "b2_list_groups", {
+			adminAccountId: request.adminAccountId,
+			...request.groupName !== void 0 ? { groupName: request.groupName } : {},
+			...request.startGroupId !== void 0 ? { startGroupId: request.startGroupId } : {},
+			...request.maxGroupCount !== void 0 ? { maxGroupCount: request.maxGroupCount } : {}
+		}, options);
+	}
+	/**
+	* Calls {@link https://www.backblaze.com/apidocs/b2-list-group-members | b2_list_group_members}.
+	*
+	* Uses the documented canonical GET form. The wire response is a JSON array
+	* whose result objects surface `nextEmail` for cursor-based pagination.
+	*
+	* @param groupsApiUrl - The Partner API base URL from `authorizePartner`.
+	* @param authToken - The Partner API authorization token.
+	* @param request - The member listing query parameters.
+	* @param options - Optional abort and per-request retry settings.
+	*
+	* @returns The group-member page result array.
+	*/
+	async listGroupMembers(groupsApiUrl, authToken, request, options) {
+		return this.getJson(groupsApiUrl, authToken, "b2_list_group_members", {
+			adminAccountId: request.adminAccountId,
+			groupId: request.groupId,
+			...request.startEmail !== void 0 ? { startEmail: request.startEmail } : {},
+			...request.maxMemberCount !== void 0 ? { maxMemberCount: request.maxMemberCount } : {}
+		}, options);
+	}
+	/**
+	* Sends a JSON GET request to the specified Partner API endpoint.
+	* @param groupsApiUrl - The Partner API base URL.
+	* @param authToken - The Partner API authorization token.
+	* @param endpoint - The Partner API endpoint name.
+	* @param query - The query-string parameters.
+	* @param options - Optional abort and per-request retry settings.
+	*
+	* @returns The parsed JSON response.
+	*/
+	async getJson(groupsApiUrl, authToken, endpoint, query, options) {
+		const safeGroupsApiUrl = validatePartnerRequestGroupsApiUrl(this.transport, this.authorizedEndpointSuffixes, groupsApiUrl);
+		return (await this.transport.send({
+			url: require_endpoint_url.withQueryString(partnerGroupsEndpointUrl(safeGroupsApiUrl, endpoint), query),
+			method: "GET",
+			headers: { Authorization: authToken },
+			...options?.signal !== void 0 ? { signal: options.signal } : {},
+			...options?.retry !== void 0 ? { retry: options.retry } : {}
+		})).json();
+	}
+	/**
+	* Sends a non-retrying JSON mutation POST request to the specified Partner API endpoint.
+	* @param groupsApiUrl - The Partner API base URL.
+	* @param authToken - The Partner API authorization token.
+	* @param endpoint - The Partner API endpoint name.
+	* @param body - The JSON request body.
+	* @param options - Optional abort and per-request retry settings.
+	*
+	* @returns The parsed JSON response.
+	*/
+	async postNonRetryingMutationJson(groupsApiUrl, authToken, endpoint, body, options) {
+		const safeGroupsApiUrl = validatePartnerRequestGroupsApiUrl(this.transport, this.authorizedEndpointSuffixes, groupsApiUrl);
+		const requestOptions = require_endpoint_url.nonRetryingMutationRequestOptions(options);
+		return (await this.transport.send({
+			url: partnerGroupsEndpointUrl(safeGroupsApiUrl, endpoint),
+			method: "POST",
+			headers: {
+				Authorization: authToken,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(body),
+			...requestOptions.signal !== void 0 ? { signal: requestOptions.signal } : {},
+			...requestOptions.idempotent !== void 0 ? { idempotent: requestOptions.idempotent } : {},
+			...requestOptions.retry !== void 0 ? { retry: requestOptions.retry } : {}
+		})).json();
+	}
+};
+//#endregion
+exports.PartnerRawClient = PartnerRawClient;
+exports.derivePartnerAllowedSuffixes = derivePartnerAllowedSuffixes;
+exports.validatePartnerAuthorizeResponseEndpoints = validatePartnerAuthorizeResponseEndpoints;
+
+//# sourceMappingURL=raw.cjs.map

package/dist/partner/raw.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw.cjs","names":[],"sources":["../../src/partner/raw.ts"],"sourcesContent":["import { assertSecureRealmUrl } from '../auth/realms.ts'\nimport { B2PartnerAuthorizationError, B2RealmConfigurationError } from '../errors/index.ts'\nimport type { PartnerNonIdempotentMutationEndpoint } from '../http/non-idempotent-mutations.ts'\nimport type { RetryOptions } from '../http/retry.ts'\nimport {\n  getTransportUrlGuard,\n  type HttpTransport,\n  type UrlGuardedTransport,\n} from '../http/transport.ts'\nimport { hostMatchesAllowedSuffix } from '../http/url-guard.ts'\nimport { type B2EndpointUrlOptions, b2Url } from '../raw/url.ts'\nimport { accountId, partnerToken } from '../types/ids.ts'\nimport type {\n  CreateGroupMemberRequest,\n  CreateGroupMemberResponse,\n  EjectGroupMemberRequest,\n  EjectGroupMemberResponse,\n  ListGroupMembersRequest,\n  ListGroupMembersResponse,\n  ListGroupsRequest,\n  ListGroupsResponse,\n  PartnerApiInfo,\n  PartnerAuthorizeResponse,\n  PartnerBackupApiInfo,\n  PartnerGroupsApiInfo,\n  ReserveTrialCreateAccountRequest,\n  ReserveTrialCreateAccountResponse,\n} from '../types/partner.ts'\nimport { validatePartnerAuthorizeResponseShape } from './auth-shape.ts'\nimport {\n  endpointAllowedSuffixes,\n  nonRetryingMutationRequestOptions,\n  type QueryParams,\n  validatePartnerEndpointUrl,\n  withQueryString,\n} from './endpoint-url.ts'\nimport {\n  redactCreateGroupMemberResponse,\n  redactPartnerAuthorizeResponse,\n  redactReserveTrialCreateAccountResponse,\n} from './redaction.ts'\n\nconst PARTNER_API_PREFIX = 'b2api'\nconst PARTNER_AUTHORIZE_API: B2EndpointUrlOptions = {\n  prefix: PARTNER_API_PREFIX,\n  version: 'v3',\n}\nconst PARTNER_GROUPS_API: B2EndpointUrlOptions = {\n  prefix: PARTNER_API_PREFIX,\n  version: 'v4',\n}\nconst DEFAULT_PARTNER_REALM_URL = 'https://api.backblazeb2.com'\nconst PRODUCTION_HOST_SUFFIX = 'backblazeb2.com'\nconst PRODUCTION_ENDPOINT_HOST_SUFFIX = 'backblaze.com'\nconst STAGING_HOST_SUFFIX = 'backblaze.net'\nconst VERIFIED_PARTNER_AUTHORIZE_REALM_ORIGINS = new Set([\n  'https://api.backblazeb2.com',\n  'https://api.backblaze.net',\n])\n\n/** Configuration for constructing a {@link PartnerRawClient}. */\nexport interface PartnerRawClientOptions {\n  /**\n   * The HTTP transport used to send requests.\n   *\n   * Partner endpoint calls validate URLs against suffixes recorded by\n   * `authorizePartner()`. A rehydrated client that skips authorization must use\n   * `authorizedPartnerEndpointSuffixes` or a {@link UrlGuardedTransport} with a\n   * locked `urlGuard`. Because Partner authorize responses redact\n   * `authorizationToken` under `JSON.stringify`, durable caches should persist\n   * `partnerAuthorizeResponseForPersistence(auth)` only to encrypted or\n   * otherwise credential-grade storage, or use another secure token-preserving\n   * representation.\n   */\n  readonly transport: HttpTransport\n  /**\n   * Validated Partner endpoint host suffixes restored from cached\n   * authorization. Facades normally manage this after authorization; direct raw\n   * clients can pass suffixes derived from trusted Partner authorization when\n   * rehydrating an auth cache. Do not derive this cache with\n   * `JSON.stringify(authorizePartner())`, which intentionally stores a redacted\n   * token placeholder instead of a usable Partner token. Rehydrating that\n   * placeholder fails fast.\n   */\n  readonly authorizedPartnerEndpointSuffixes?: readonly string[]\n  /**\n   * Allow direct custom authorize realms for tests or private proxies.\n   * Leave disabled unless the configured host is trusted with the Master Application Key.\n   */\n  readonly allowCustomAuthorizeRealm?: boolean\n}\n\n/** Optional controls for raw Partner API requests. */\nexport interface PartnerRawRequestOptions {\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n  /** Per-request retry override. */\n  readonly retry?: Partial<RetryOptions>\n}\n\ninterface WirePartnerAuthorizeResponse {\n  readonly accountId: string\n  readonly authorizationToken: string\n  readonly apiInfo: PartnerApiInfo\n  readonly applicationKeyExpirationTimestamp: number | null\n}\n\nfunction assertVerifiedPartnerAuthorizeRealm(realmUrl: string, allowCustomAuthorizeRealm: boolean) {\n  if (allowCustomAuthorizeRealm) return\n\n  const realm = new URL(realmUrl)\n  if (VERIFIED_PARTNER_AUTHORIZE_REALM_ORIGINS.has(realm.origin)) return\n\n  throw new B2RealmConfigurationError(\n    `refusing to send Master Application Key credentials to unverified Partner authorize realm: ${realm.origin}`,\n  )\n}\n\nfunction endpointAllowedSuffixesForRealm(\n  realmUrl: string,\n  allowCustomAuthorizeRealm: boolean,\n): readonly string[] {\n  const realmHost = new URL(realmUrl).hostname.toLowerCase()\n  if (hostMatchesAllowedSuffix(realmHost, PRODUCTION_HOST_SUFFIX)) {\n    return [PRODUCTION_ENDPOINT_HOST_SUFFIX, PRODUCTION_HOST_SUFFIX]\n  }\n  if (hostMatchesAllowedSuffix(realmHost, STAGING_HOST_SUFFIX)) return [STAGING_HOST_SUFFIX]\n  return allowCustomAuthorizeRealm ? [authorizeRealmAllowedSuffix(realmUrl)] : [realmHost]\n}\n\nfunction authorizeRealmAllowedSuffix(realmUrl: string): string {\n  const host = new URL(realmUrl).hostname.toLowerCase()\n  if (hostMatchesAllowedSuffix(host, PRODUCTION_HOST_SUFFIX)) return PRODUCTION_HOST_SUFFIX\n  if (hostMatchesAllowedSuffix(host, STAGING_HOST_SUFFIX)) return STAGING_HOST_SUFFIX\n  if (hostMatchesAllowedSuffix(host, PRODUCTION_ENDPOINT_HOST_SUFFIX)) {\n    return PRODUCTION_ENDPOINT_HOST_SUFFIX\n  }\n  return host\n}\n\nfunction endpointAllowedSuffix(url: string): string {\n  const host = new URL(url).hostname.toLowerCase()\n  if (hostMatchesAllowedSuffix(host, PRODUCTION_HOST_SUFFIX)) return PRODUCTION_HOST_SUFFIX\n  if (hostMatchesAllowedSuffix(host, STAGING_HOST_SUFFIX)) return STAGING_HOST_SUFFIX\n  if (hostMatchesAllowedSuffix(host, PRODUCTION_ENDPOINT_HOST_SUFFIX)) {\n    return PRODUCTION_ENDPOINT_HOST_SUFFIX\n  }\n  return host\n}\n\nfunction normalizeGroupsApi(\n  groupsApi: PartnerGroupsApiInfo,\n  allowedSuffixes: readonly string[],\n): PartnerGroupsApiInfo {\n  return {\n    ...groupsApi,\n    groupsApiUrl: validatePartnerEndpointUrl(\n      groupsApi.groupsApiUrl,\n      'groupsApiUrl',\n      allowedSuffixes,\n    ),\n    capabilities: [...(groupsApi.capabilities ?? [])],\n    infoType: 'groupsApi',\n  }\n}\n\nfunction normalizeBackupApi(\n  backupApi: PartnerBackupApiInfo,\n  allowedSuffixes: readonly string[],\n): PartnerBackupApiInfo {\n  return {\n    ...backupApi,\n    backupApiUrl: validatePartnerEndpointUrl(\n      backupApi.backupApiUrl,\n      'backupApiUrl',\n      allowedSuffixes,\n    ),\n    capabilities: [...(backupApi.capabilities ?? [])],\n    infoType: 'backupApi',\n  }\n}\n\nfunction normalizePartnerAuthorizeResponse(\n  response: WirePartnerAuthorizeResponse,\n  realmUrl: string,\n  allowCustomAuthorizeRealm: boolean,\n): PartnerAuthorizeResponse {\n  const { groupsApi, backupApi } = response.apiInfo\n  if (groupsApi === undefined && backupApi === undefined) {\n    throw new B2PartnerAuthorizationError(\n      'Partner authorize response did not include apiInfo.groupsApi or apiInfo.backupApi',\n    )\n  }\n\n  const allowedSuffixes = endpointAllowedSuffixesForRealm(realmUrl, allowCustomAuthorizeRealm)\n  const normalizedGroupsApi =\n    groupsApi !== undefined ? normalizeGroupsApi(groupsApi, allowedSuffixes) : undefined\n  const normalizedBackupApi =\n    backupApi !== undefined ? normalizeBackupApi(backupApi, allowedSuffixes) : undefined\n  const apiInfo: PartnerApiInfo = {\n    ...(response.apiInfo.storageApi !== undefined\n      ? { storageApi: response.apiInfo.storageApi }\n      : {}),\n    ...(normalizedGroupsApi !== undefined ? { groupsApi: normalizedGroupsApi } : {}),\n    ...(normalizedBackupApi !== undefined ? { backupApi: normalizedBackupApi } : {}),\n  }\n  const normalized: PartnerAuthorizeResponse = {\n    accountId: accountId(response.accountId),\n    authorizationToken: partnerToken(response.authorizationToken),\n    apiInfo,\n    ...(normalizedGroupsApi !== undefined\n      ? { groupsApiUrl: normalizedGroupsApi.groupsApiUrl }\n      : {}),\n    ...(normalizedBackupApi !== undefined\n      ? { backupApiUrl: normalizedBackupApi.backupApiUrl }\n      : {}),\n    ...(normalizedGroupsApi !== undefined\n      ? { groupsCapabilities: normalizedGroupsApi.capabilities }\n      : {}),\n    ...(normalizedBackupApi !== undefined\n      ? { backupCapabilities: normalizedBackupApi.capabilities }\n      : {}),\n    applicationKeyExpirationTimestamp: response.applicationKeyExpirationTimestamp,\n  }\n\n  validatePartnerAuthorizeResponseShape(normalized)\n  return redactPartnerAuthorizeResponse(normalized)\n}\n\n/**\n * Derives the Partner authorize and endpoint host suffixes that may receive\n * Partner tokens after a trusted authorize response has been validated.\n *\n * @param auth - Normalized Partner authorize response.\n * @param realmUrl - Realm URL used for Partner authorization.\n *\n * @returns Sorted list of unique host suffixes to allow.\n *\n * @internal\n */\nexport function derivePartnerAllowedSuffixes(\n  auth: PartnerAuthorizeResponse,\n  realmUrl: string,\n): readonly string[] {\n  const suffixes = new Set<string>([authorizeRealmAllowedSuffix(realmUrl)])\n  if (auth.apiInfo.groupsApi !== undefined) {\n    suffixes.add(endpointAllowedSuffix(auth.apiInfo.groupsApi.groupsApiUrl))\n  }\n  if (auth.apiInfo.backupApi !== undefined) {\n    suffixes.add(endpointAllowedSuffix(auth.apiInfo.backupApi.backupApiUrl))\n  }\n  return Array.from(suffixes).sort()\n}\n\n/**\n * Validates cached Partner authorize endpoint URLs with the same realm policy\n * applied to fresh `authorizePartner()` responses and returns guard suffixes.\n *\n * @param auth - Cached Partner authorize response to validate.\n * @param realmUrl - Realm URL used for Partner authorization.\n * @param allowCustomAuthorizeRealm - Whether custom authorize realms are trusted.\n *\n * @returns Sorted list of host suffixes derived from the validated auth state.\n *\n * @throws B2PartnerAuthorizationError if the cached auth endpoints are unsafe.\n *\n * @internal\n */\nexport function validatePartnerAuthorizeResponseEndpoints(\n  auth: PartnerAuthorizeResponse,\n  realmUrl: string,\n  allowCustomAuthorizeRealm: boolean,\n): readonly string[] {\n  assertSecureRealmUrl(realmUrl)\n  assertVerifiedPartnerAuthorizeRealm(realmUrl, allowCustomAuthorizeRealm)\n  validatePartnerAuthorizeResponseShape(auth)\n\n  const { groupsApi, backupApi } = auth.apiInfo\n  const allowedSuffixes = endpointAllowedSuffixesForRealm(realmUrl, allowCustomAuthorizeRealm)\n  if (groupsApi !== undefined) {\n    validatePartnerEndpointUrl(groupsApi.groupsApiUrl, 'groupsApiUrl', allowedSuffixes)\n  }\n  if (backupApi !== undefined) {\n    validatePartnerEndpointUrl(backupApi.backupApiUrl, 'backupApiUrl', allowedSuffixes)\n  }\n\n  return derivePartnerAllowedSuffixes(auth, realmUrl)\n}\n\nfunction lockTransportUrlGuard(transport: HttpTransport, allowedSuffixes: readonly string[]): void {\n  const guard = getTransportUrlGuard(transport)\n  if (guard === undefined) return\n\n  const suffixes = new Set([...guard.getAllowedSuffixes(), ...allowedSuffixes])\n  guard.setAllowedSuffixes(Array.from(suffixes).sort())\n}\n\nfunction partnerEndpointAllowedSuffixes(\n  transport: HttpTransport,\n  authorizedSuffixes: readonly string[],\n): readonly string[] {\n  return endpointAllowedSuffixes(transport, authorizedSuffixes, {\n    missingGuard:\n      'Partner endpoint requests require authorizePartner() or a UrlGuardedTransport with a locked URL guard before sending Partner tokens',\n    unlockedGuard:\n      'Partner endpoint requests require a locked URL guard before sending Partner tokens',\n  })\n}\n\nfunction validatePartnerRequestGroupsApiUrl(\n  transport: HttpTransport,\n  authorizedSuffixes: readonly string[],\n  groupsApiUrl: string,\n): string {\n  return validatePartnerEndpointUrl(\n    groupsApiUrl,\n    'groupsApiUrl',\n    partnerEndpointAllowedSuffixes(transport, authorizedSuffixes),\n  )\n}\n\nfunction reserveTrialCreateAccountRequestBody(\n  request: ReserveTrialCreateAccountRequest,\n): ReserveTrialCreateAccountRequest {\n  if (Array.isArray(request)) {\n    throw new TypeError('reserveTrialCreateAccount request must be a single account object.')\n  }\n\n  return {\n    email: request.email,\n    term: request.term,\n    storage: request.storage,\n    ...(request.region != null ? { region: request.region } : {}),\n  }\n}\n\nfunction partnerAuthorizeUrl(realmUrl: string): string {\n  return b2Url(realmUrl, { ...PARTNER_AUTHORIZE_API, endpoint: 'b2_authorize_account' })\n}\n\nfunction partnerGroupsEndpointUrl(groupsApiUrl: string, endpoint: string): string {\n  return b2Url(groupsApiUrl, { ...PARTNER_GROUPS_API, endpoint })\n}\n\n/**\n * Low-level client for Partner API authorization and endpoint bindings.\n */\nexport class PartnerRawClient {\n  /** @internal */\n  private readonly transport: HttpTransport\n  private readonly allowCustomAuthorizeRealm: boolean\n  private authorizedEndpointSuffixes: readonly string[]\n\n  /**\n   * Creates a new PartnerRawClient with the given transport.\n   *\n   * @param options - The constructor configuration.\n   */\n  constructor(options: PartnerRawClientOptions) {\n    this.transport = options.transport\n    this.allowCustomAuthorizeRealm = options.allowCustomAuthorizeRealm ?? false\n    this.authorizedEndpointSuffixes = Array.from(options.authorizedPartnerEndpointSuffixes ?? [])\n  }\n\n  /**\n   * Replaces the validated Partner endpoint host suffixes.\n   *\n   * @param suffixes - Host suffixes derived from Partner authorization.\n   *\n   * @internal\n   */\n  setAuthorizedEndpointSuffixes(suffixes: readonly string[]): void {\n    this.authorizedEndpointSuffixes = Array.from(suffixes)\n  }\n\n  /**\n   * Calls `b2_authorize_account` with Master Application Key credentials and\n   * normalizes the Partner/Backup suites into a Partner-specific auth shape.\n   *\n   * The Partner API documentation currently shows the v3 authorize path, so\n   * this method intentionally uses `/b2api/v3/b2_authorize_account` while the\n   * storage raw client keeps using v4.\n   *\n   * @param masterKeyId - The Master Application Key ID for authentication.\n   * @param masterKey - The Master Application Key secret.\n   * @param realmUrl - The B2 realm URL to authenticate against.\n   * @param options - Optional abort and per-request retry settings.\n   *\n   * @returns The normalized Partner authorization response.\n   *\n   * @throws B2RealmConfigurationError if the realm URL is unsafe for Master Application Key credentials.\n   * @throws B2PartnerAuthorizationError if the response omits or returns unsafe Partner endpoint data.\n   */\n  async authorizePartner(\n    masterKeyId: string,\n    masterKey: string,\n    realmUrl = DEFAULT_PARTNER_REALM_URL,\n    options?: PartnerRawRequestOptions,\n  ): Promise<PartnerAuthorizeResponse> {\n    assertSecureRealmUrl(realmUrl)\n    assertVerifiedPartnerAuthorizeRealm(realmUrl, this.allowCustomAuthorizeRealm)\n    const response = await this.transport.send({\n      url: partnerAuthorizeUrl(realmUrl),\n      method: 'GET',\n      headers: {\n        Authorization: `Basic ${btoa(`${masterKeyId}:${masterKey}`)}`,\n      },\n      ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n      ...(options?.retry !== undefined ? { retry: options.retry } : {}),\n    })\n    const auth = normalizePartnerAuthorizeResponse(\n      await response.json<WirePartnerAuthorizeResponse>(),\n      realmUrl,\n      this.allowCustomAuthorizeRealm,\n    )\n    const suffixes = derivePartnerAllowedSuffixes(auth, realmUrl)\n    this.setAuthorizedEndpointSuffixes(suffixes)\n    lockTransportUrlGuard(this.transport, suffixes)\n    return auth\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-create-group-member | b2_create_group_member}.\n   *\n   * The Partner API creates a new Backblaze account for an email address that\n   * is not already a Backblaze account and adds that account to the managed\n   * group. The wire response is a single JSON object.\n   *\n   * @param groupsApiUrl - The Partner API base URL from `authorizePartner`.\n   * @param authToken - The Partner API authorization token.\n   * @param request - The group-member creation request body.\n   * @param options - Optional abort and per-request retry settings.\n   *\n   * @returns The created member result, including the member application key.\n   */\n  async createGroupMember(\n    groupsApiUrl: string,\n    authToken: string,\n    request: CreateGroupMemberRequest,\n    options?: PartnerRawRequestOptions,\n  ): Promise<CreateGroupMemberResponse> {\n    const response = await this.postNonRetryingMutationJson<CreateGroupMemberResponse>(\n      groupsApiUrl,\n      authToken,\n      'b2_create_group_member',\n      {\n        adminAccountId: request.adminAccountId,\n        groupId: request.groupId,\n        memberEmail: request.memberEmail,\n        ...(request.region != null ? { region: request.region } : {}),\n      },\n      options,\n    )\n    return redactCreateGroupMemberResponse(response)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-eject-group-member | b2_eject_group_member}.\n   *\n   * Ejection removes the member account from the group but does not delete the\n   * Backblaze account. The wire response is a single JSON object.\n   *\n   * @param groupsApiUrl - The Partner API base URL from `authorizePartner`.\n   * @param authToken - The Partner API authorization token.\n   * @param request - The group-member ejection request body.\n   * @param options - Optional abort and per-request retry settings.\n   *\n   * @returns The ejected member object.\n   */\n  async ejectGroupMember(\n    groupsApiUrl: string,\n    authToken: string,\n    request: EjectGroupMemberRequest,\n    options?: PartnerRawRequestOptions,\n  ): Promise<EjectGroupMemberResponse> {\n    return this.postNonRetryingMutationJson<EjectGroupMemberResponse>(\n      groupsApiUrl,\n      authToken,\n      'b2_eject_group_member',\n      {\n        adminAccountId: request.adminAccountId,\n        groupId: request.groupId,\n        memberAccountId: request.memberAccountId,\n        ...(request.email !== undefined ? { email: request.email } : {}),\n      },\n      options,\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-reserve-trial-create-account | b2_reserve_trial_create_account}.\n   *\n   * The Partner API creates one new Backblaze B2 account and starts a B2\n   * Reserve trial for it. The wire request and success response are single\n   * JSON objects.\n   *\n   * Each email address must not already be a Backblaze account. `term` is the\n   * trial duration in days, documented as 7 through 30 inclusive. `storage` is\n   * the requested storage in TB, documented as 1 through 50 inclusive.\n   *\n   * This operation is non-idempotent and creates billable accounts. Automatic\n   * retries and expired-token reauthorization are disabled; long-lived\n   * callers must catch auth expiry, reauthorize, and then decide whether to\n   * issue a new request. A network or timeout failure after the server has\n   * processed the request may still have created an account, and the\n   * application key from a lost response is not recoverable from B2. Callers\n   * should reconcile account state out of band, such as through Partner\n   * account listing, before re-issuing a request for the same email address.\n   *\n   * @param groupsApiUrl - The Partner API base URL from `authorizePartner`. The authorize response currently exposes the shared Partner endpoint base as `groupsApiUrl`.\n   * @param authToken - The Partner API authorization token.\n   * @param request - Email, term, storage, and optional region for the account to create.\n   * @param options - Optional abort and per-request retry settings.\n   *\n   * @returns The created reserve-trial account result.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async reserveTrialCreateAccount(\n    groupsApiUrl: string,\n    authToken: string,\n    request: ReserveTrialCreateAccountRequest,\n    options?: PartnerRawRequestOptions,\n  ): Promise<ReserveTrialCreateAccountResponse> {\n    const response = await this.postNonRetryingMutationJson<ReserveTrialCreateAccountResponse>(\n      groupsApiUrl,\n      authToken,\n      'b2_reserve_trial_create_account',\n      reserveTrialCreateAccountRequestBody(request),\n      options,\n    )\n    return redactReserveTrialCreateAccountResponse(response)\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-list-groups | b2_list_groups}.\n   *\n   * Uses the documented canonical GET form. The wire response is a single JSON\n   * object that surfaces `nextGroupId` for cursor-based pagination.\n   *\n   * @param groupsApiUrl - The Partner API base URL from `authorizePartner`.\n   * @param authToken - The Partner API authorization token.\n   * @param request - The group listing query parameters.\n   * @param options - Optional abort and per-request retry settings.\n   *\n   * @returns The groups page object.\n   */\n  async listGroups(\n    groupsApiUrl: string,\n    authToken: string,\n    request: ListGroupsRequest,\n    options?: PartnerRawRequestOptions,\n  ): Promise<ListGroupsResponse> {\n    return this.getJson<ListGroupsResponse>(\n      groupsApiUrl,\n      authToken,\n      'b2_list_groups',\n      {\n        adminAccountId: request.adminAccountId,\n        ...(request.groupName !== undefined ? { groupName: request.groupName } : {}),\n        ...(request.startGroupId !== undefined ? { startGroupId: request.startGroupId } : {}),\n        ...(request.maxGroupCount !== undefined ? { maxGroupCount: request.maxGroupCount } : {}),\n      },\n      options,\n    )\n  }\n\n  /**\n   * Calls {@link https://www.backblaze.com/apidocs/b2-list-group-members | b2_list_group_members}.\n   *\n   * Uses the documented canonical GET form. The wire response is a JSON array\n   * whose result objects surface `nextEmail` for cursor-based pagination.\n   *\n   * @param groupsApiUrl - The Partner API base URL from `authorizePartner`.\n   * @param authToken - The Partner API authorization token.\n   * @param request - The member listing query parameters.\n   * @param options - Optional abort and per-request retry settings.\n   *\n   * @returns The group-member page result array.\n   */\n  async listGroupMembers(\n    groupsApiUrl: string,\n    authToken: string,\n    request: ListGroupMembersRequest,\n    options?: PartnerRawRequestOptions,\n  ): Promise<ListGroupMembersResponse> {\n    return this.getJson<ListGroupMembersResponse>(\n      groupsApiUrl,\n      authToken,\n      'b2_list_group_members',\n      {\n        adminAccountId: request.adminAccountId,\n        groupId: request.groupId,\n        ...(request.startEmail !== undefined ? { startEmail: request.startEmail } : {}),\n        ...(request.maxMemberCount !== undefined ? { maxMemberCount: request.maxMemberCount } : {}),\n      },\n      options,\n    )\n  }\n\n  /**\n   * Sends a JSON GET request to the specified Partner API endpoint.\n   * @param groupsApiUrl - The Partner API base URL.\n   * @param authToken - The Partner API authorization token.\n   * @param endpoint - The Partner API endpoint name.\n   * @param query - The query-string parameters.\n   * @param options - Optional abort and per-request retry settings.\n   *\n   * @returns The parsed JSON response.\n   */\n  private async getJson<T>(\n    groupsApiUrl: string,\n    authToken: string,\n    endpoint: string,\n    query: QueryParams,\n    options?: PartnerRawRequestOptions,\n  ): Promise<T> {\n    const safeGroupsApiUrl = validatePartnerRequestGroupsApiUrl(\n      this.transport,\n      this.authorizedEndpointSuffixes,\n      groupsApiUrl,\n    )\n    const response = await this.transport.send({\n      url: withQueryString(partnerGroupsEndpointUrl(safeGroupsApiUrl, endpoint), query),\n      method: 'GET',\n      headers: {\n        Authorization: authToken,\n      },\n      ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n      ...(options?.retry !== undefined ? { retry: options.retry } : {}),\n    })\n    return response.json<T>()\n  }\n\n  /**\n   * Sends a non-retrying JSON mutation POST request to the specified Partner API endpoint.\n   * @param groupsApiUrl - The Partner API base URL.\n   * @param authToken - The Partner API authorization token.\n   * @param endpoint - The Partner API endpoint name.\n   * @param body - The JSON request body.\n   * @param options - Optional abort and per-request retry settings.\n   *\n   * @returns The parsed JSON response.\n   */\n  private async postNonRetryingMutationJson<T>(\n    groupsApiUrl: string,\n    authToken: string,\n    endpoint: PartnerNonIdempotentMutationEndpoint,\n    body: unknown,\n    options?: PartnerRawRequestOptions,\n  ): Promise<T> {\n    const safeGroupsApiUrl = validatePartnerRequestGroupsApiUrl(\n      this.transport,\n      this.authorizedEndpointSuffixes,\n      groupsApiUrl,\n    )\n    const requestOptions = nonRetryingMutationRequestOptions(options)\n    const response = await this.transport.send({\n      url: partnerGroupsEndpointUrl(safeGroupsApiUrl, endpoint),\n      method: 'POST',\n      headers: {\n        Authorization: authToken,\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify(body),\n      ...(requestOptions.signal !== undefined ? { signal: requestOptions.signal } : {}),\n      ...(requestOptions.idempotent !== undefined ? { idempotent: requestOptions.idempotent } : {}),\n      ...(requestOptions.retry !== undefined ? { retry: requestOptions.retry } : {}),\n    })\n    return response.json<T>()\n  }\n}\n"],"mappings":";;;;;;;;;;AA0CA,IAAM,qBAAqB;AAC3B,IAAM,wBAA8C;CAClD,QAAQ;CACR,SAAS;AACX;AACA,IAAM,qBAA2C;CAC/C,QAAQ;CACR,SAAS;AACX;AACA,IAAM,4BAA4B;AAClC,IAAM,yBAAyB;AAC/B,IAAM,kCAAkC;AACxC,IAAM,sBAAsB;AAC5B,IAAM,2DAA2C,IAAI,IAAI,CACvD,+BACA,2BACF,CAAC;AAiDD,SAAS,oCAAoC,UAAkB,2BAAoC;CACjG,IAAI,2BAA2B;CAE/B,MAAM,QAAQ,IAAI,IAAI,QAAQ;CAC9B,IAAI,yCAAyC,IAAI,MAAM,MAAM,GAAG;CAEhE,MAAM,IAAI,qBAAA,0BACR,8FAA8F,MAAM,QACtG;AACF;AAEA,SAAS,gCACP,UACA,2BACmB;CACnB,MAAM,YAAY,IAAI,IAAI,QAAQ,CAAC,CAAC,SAAS,YAAY;CACzD,IAAI,kBAAA,yBAAyB,WAAW,sBAAsB,GAC5D,OAAO,CAAC,iCAAiC,sBAAsB;CAEjE,IAAI,kBAAA,yBAAyB,WAAW,mBAAmB,GAAG,OAAO,CAAC,mBAAmB;CACzF,OAAO,4BAA4B,CAAC,4BAA4B,QAAQ,CAAC,IAAI,CAAC,SAAS;AACzF;AAEA,SAAS,4BAA4B,UAA0B;CAC7D,MAAM,OAAO,IAAI,IAAI,QAAQ,CAAC,CAAC,SAAS,YAAY;CACpD,IAAI,kBAAA,yBAAyB,MAAM,sBAAsB,GAAG,OAAO;CACnE,IAAI,kBAAA,yBAAyB,MAAM,mBAAmB,GAAG,OAAO;CAChE,IAAI,kBAAA,yBAAyB,MAAM,+BAA+B,GAChE,OAAO;CAET,OAAO;AACT;AAEA,SAAS,sBAAsB,KAAqB;CAClD,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,YAAY;CAC/C,IAAI,kBAAA,yBAAyB,MAAM,sBAAsB,GAAG,OAAO;CACnE,IAAI,kBAAA,yBAAyB,MAAM,mBAAmB,GAAG,OAAO;CAChE,IAAI,kBAAA,yBAAyB,MAAM,+BAA+B,GAChE,OAAO;CAET,OAAO;AACT;AAEA,SAAS,mBACP,WACA,iBACsB;CACtB,OAAO;EACL,GAAG;EACH,cAAc,qBAAA,2BACZ,UAAU,cACV,gBACA,eACF;EACA,cAAc,CAAC,GAAI,UAAU,gBAAgB,CAAC,CAAE;EAChD,UAAU;CACZ;AACF;AAEA,SAAS,mBACP,WACA,iBACsB;CACtB,OAAO;EACL,GAAG;EACH,cAAc,qBAAA,2BACZ,UAAU,cACV,gBACA,eACF;EACA,cAAc,CAAC,GAAI,UAAU,gBAAgB,CAAC,CAAE;EAChD,UAAU;CACZ;AACF;AAEA,SAAS,kCACP,UACA,UACA,2BAC0B;CAC1B,MAAM,EAAE,WAAW,cAAc,SAAS;CAC1C,IAAI,cAAc,KAAA,KAAa,cAAc,KAAA,GAC3C,MAAM,IAAI,qBAAA,4BACR,mFACF;CAGF,MAAM,kBAAkB,gCAAgC,UAAU,yBAAyB;CAC3F,MAAM,sBACJ,cAAc,KAAA,IAAY,mBAAmB,WAAW,eAAe,IAAI,KAAA;CAC7E,MAAM,sBACJ,cAAc,KAAA,IAAY,mBAAmB,WAAW,eAAe,IAAI,KAAA;CAC7E,MAAM,UAA0B;EAC9B,GAAI,SAAS,QAAQ,eAAe,KAAA,IAChC,EAAE,YAAY,SAAS,QAAQ,WAAW,IAC1C,CAAC;EACL,GAAI,wBAAwB,KAAA,IAAY,EAAE,WAAW,oBAAoB,IAAI,CAAC;EAC9E,GAAI,wBAAwB,KAAA,IAAY,EAAE,WAAW,oBAAoB,IAAI,CAAC;CAChF;CACA,MAAM,aAAuC;EAC3C,WAAW,YAAA,UAAU,SAAS,SAAS;EACvC,oBAAoB,YAAA,aAAa,SAAS,kBAAkB;EAC5D;EACA,GAAI,wBAAwB,KAAA,IACxB,EAAE,cAAc,oBAAoB,aAAa,IACjD,CAAC;EACL,GAAI,wBAAwB,KAAA,IACxB,EAAE,cAAc,oBAAoB,aAAa,IACjD,CAAC;EACL,GAAI,wBAAwB,KAAA,IACxB,EAAE,oBAAoB,oBAAoB,aAAa,IACvD,CAAC;EACL,GAAI,wBAAwB,KAAA,IACxB,EAAE,oBAAoB,oBAAoB,aAAa,IACvD,CAAC;EACL,mCAAmC,SAAS;CAC9C;CAEA,mBAAA,sCAAsC,UAAU;CAChD,OAAO,kBAAA,+BAA+B,UAAU;AAClD;;;;;;;;;;;;AAaA,SAAgB,6BACd,MACA,UACmB;CACnB,MAAM,2BAAW,IAAI,IAAY,CAAC,4BAA4B,QAAQ,CAAC,CAAC;CACxE,IAAI,KAAK,QAAQ,cAAc,KAAA,GAC7B,SAAS,IAAI,sBAAsB,KAAK,QAAQ,UAAU,YAAY,CAAC;CAEzE,IAAI,KAAK,QAAQ,cAAc,KAAA,GAC7B,SAAS,IAAI,sBAAsB,KAAK,QAAQ,UAAU,YAAY,CAAC;CAEzE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AACnC;;;;;;;;;;;;;;;AAgBA,SAAgB,0CACd,MACA,UACA,2BACmB;CACnB,eAAA,qBAAqB,QAAQ;CAC7B,oCAAoC,UAAU,yBAAyB;CACvE,mBAAA,sCAAsC,IAAI;CAE1C,MAAM,EAAE,WAAW,cAAc,KAAK;CACtC,MAAM,kBAAkB,gCAAgC,UAAU,yBAAyB;CAC3F,IAAI,cAAc,KAAA,GAChB,qBAAA,2BAA2B,UAAU,cAAc,gBAAgB,eAAe;CAEpF,IAAI,cAAc,KAAA,GAChB,qBAAA,2BAA2B,UAAU,cAAc,gBAAgB,eAAe;CAGpF,OAAO,6BAA6B,MAAM,QAAQ;AACpD;AAEA,SAAS,sBAAsB,WAA0B,iBAA0C;CACjG,MAAM,QAAQ,kBAAA,qBAAqB,SAAS;CAC5C,IAAI,UAAU,KAAA,GAAW;CAEzB,MAAM,2BAAW,IAAI,IAAI,CAAC,GAAG,MAAM,mBAAmB,GAAG,GAAG,eAAe,CAAC;CAC5E,MAAM,mBAAmB,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC;AACtD;AAEA,SAAS,+BACP,WACA,oBACmB;CACnB,OAAO,qBAAA,wBAAwB,WAAW,oBAAoB;EAC5D,cACE;EACF,eACE;CACJ,CAAC;AACH;AAEA,SAAS,mCACP,WACA,oBACA,cACQ;CACR,OAAO,qBAAA,2BACL,cACA,gBACA,+BAA+B,WAAW,kBAAkB,CAC9D;AACF;AAEA,SAAS,qCACP,SACkC;CAClC,IAAI,MAAM,QAAQ,OAAO,GACvB,MAAM,IAAI,UAAU,oEAAoE;CAG1F,OAAO;EACL,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,SAAS,QAAQ;EACjB,GAAI,QAAQ,UAAU,OAAO,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;CAC7D;AACF;AAEA,SAAS,oBAAoB,UAA0B;CACrD,OAAO,YAAA,MAAM,UAAU;EAAE,GAAG;EAAuB,UAAU;CAAuB,CAAC;AACvF;AAEA,SAAS,yBAAyB,cAAsB,UAA0B;CAChF,OAAO,YAAA,MAAM,cAAc;EAAE,GAAG;EAAoB;CAAS,CAAC;AAChE;;;;AAKA,IAAa,mBAAb,MAA8B;;CAE5B;CACA;CACA;;;;;;CAOA,YAAY,SAAkC;EAC5C,KAAK,YAAY,QAAQ;EACzB,KAAK,4BAA4B,QAAQ,6BAA6B;EACtE,KAAK,6BAA6B,MAAM,KAAK,QAAQ,qCAAqC,CAAC,CAAC;CAC9F;;;;;;;;CASA,8BAA8B,UAAmC;EAC/D,KAAK,6BAA6B,MAAM,KAAK,QAAQ;CACvD;;;;;;;;;;;;;;;;;;;CAoBA,MAAM,iBACJ,aACA,WACA,WAAW,2BACX,SACmC;EACnC,eAAA,qBAAqB,QAAQ;EAC7B,oCAAoC,UAAU,KAAK,yBAAyB;EAU5E,MAAM,OAAO,kCACX,OAAM,MAVe,KAAK,UAAU,KAAK;GACzC,KAAK,oBAAoB,QAAQ;GACjC,QAAQ;GACR,SAAS,EACP,eAAe,SAAS,KAAK,GAAG,YAAY,GAAG,WAAW,IAC5D;GACA,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GAClE,GAAI,SAAS,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjE,CAAC,EAAA,CAEgB,KAAmC,GAClD,UACA,KAAK,yBACP;EACA,MAAM,WAAW,6BAA6B,MAAM,QAAQ;EAC5D,KAAK,8BAA8B,QAAQ;EAC3C,sBAAsB,KAAK,WAAW,QAAQ;EAC9C,OAAO;CACT;;;;;;;;;;;;;;;CAgBA,MAAM,kBACJ,cACA,WACA,SACA,SACoC;EACpC,MAAM,WAAW,MAAM,KAAK,4BAC1B,cACA,WACA,0BACA;GACE,gBAAgB,QAAQ;GACxB,SAAS,QAAQ;GACjB,aAAa,QAAQ;GACrB,GAAI,QAAQ,UAAU,OAAO,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAC7D,GACA,OACF;EACA,OAAO,kBAAA,gCAAgC,QAAQ;CACjD;;;;;;;;;;;;;;CAeA,MAAM,iBACJ,cACA,WACA,SACA,SACmC;EACnC,OAAO,KAAK,4BACV,cACA,WACA,yBACA;GACE,gBAAgB,QAAQ;GACxB,SAAS,QAAQ;GACjB,iBAAiB,QAAQ;GACzB,GAAI,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EAChE,GACA,OACF;CACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BA,MAAM,0BACJ,cACA,WACA,SACA,SAC4C;EAC5C,MAAM,WAAW,MAAM,KAAK,4BAC1B,cACA,WACA,mCACA,qCAAqC,OAAO,GAC5C,OACF;EACA,OAAO,kBAAA,wCAAwC,QAAQ;CACzD;;;;;;;;;;;;;;CAeA,MAAM,WACJ,cACA,WACA,SACA,SAC6B;EAC7B,OAAO,KAAK,QACV,cACA,WACA,kBACA;GACE,gBAAgB,QAAQ;GACxB,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;GAC1E,GAAI,QAAQ,iBAAiB,KAAA,IAAY,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;GACnF,GAAI,QAAQ,kBAAkB,KAAA,IAAY,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;EACxF,GACA,OACF;CACF;;;;;;;;;;;;;;CAeA,MAAM,iBACJ,cACA,WACA,SACA,SACmC;EACnC,OAAO,KAAK,QACV,cACA,WACA,yBACA;GACE,gBAAgB,QAAQ;GACxB,SAAS,QAAQ;GACjB,GAAI,QAAQ,eAAe,KAAA,IAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;GAC7E,GAAI,QAAQ,mBAAmB,KAAA,IAAY,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;EAC3F,GACA,OACF;CACF;;;;;;;;;;;CAYA,MAAc,QACZ,cACA,WACA,UACA,OACA,SACY;EACZ,MAAM,mBAAmB,mCACvB,KAAK,WACL,KAAK,4BACL,YACF;EAUA,QAAO,MATgB,KAAK,UAAU,KAAK;GACzC,KAAK,qBAAA,gBAAgB,yBAAyB,kBAAkB,QAAQ,GAAG,KAAK;GAChF,QAAQ;GACR,SAAS,EACP,eAAe,UACjB;GACA,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GAClE,GAAI,SAAS,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjE,CAAC,EAAA,CACe,KAAQ;CAC1B;;;;;;;;;;;CAYA,MAAc,4BACZ,cACA,WACA,UACA,MACA,SACY;EACZ,MAAM,mBAAmB,mCACvB,KAAK,WACL,KAAK,4BACL,YACF;EACA,MAAM,iBAAiB,qBAAA,kCAAkC,OAAO;EAahE,QAAO,MAZgB,KAAK,UAAU,KAAK;GACzC,KAAK,yBAAyB,kBAAkB,QAAQ;GACxD,QAAQ;GACR,SAAS;IACP,eAAe;IACf,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU,IAAI;GACzB,GAAI,eAAe,WAAW,KAAA,IAAY,EAAE,QAAQ,eAAe,OAAO,IAAI,CAAC;GAC/E,GAAI,eAAe,eAAe,KAAA,IAAY,EAAE,YAAY,eAAe,WAAW,IAAI,CAAC;GAC3F,GAAI,eAAe,UAAU,KAAA,IAAY,EAAE,OAAO,eAAe,MAAM,IAAI,CAAC;EAC9E,CAAC,EAAA,CACe,KAAQ;CAC1B;AACF"}