@backblaze-labs/b2-sdk 0.3.0 → 0.4.0

package/dist/partner/client.js

@@ -134,9 +134,9 @@ var PartnerClient = class {
 			});
 			return {
 				page: resp,
-				nextCursor: resp[0]?.nextEmail ?? void 0
+				nextCursor: resp.nextEmail ?? void 0
 			};
-		}, (page) => page.flatMap((result) => result.groupMembers), options.signal);
+		}, (page) => [...page.groupMembers], options.signal);
 	}
 	/**
 	* Creates a new Backblaze account and adds it to a Partner group.
@@ -147,7 +147,7 @@ var PartnerClient = class {
 	*
 	* @param options - Group ID, member email, and optional region.
 	*
-	* @returns The created member result array, including the member application key.
+	* @returns The created member result, including the member application key.
 	*
 	* @experimental Partner API surface; shape may change as the Partner API docs evolve.
 	*/
@@ -183,26 +183,41 @@ var PartnerClient = class {
 		}, options.signal !== void 0 ? { signal: options.signal } : void 0);
 	}
 	/**
-	* Reserves one or more new B2 Reserve trial accounts.
+	* Reserves a new B2 Reserve trial account.
 	*
 	* This operation is non-idempotent and automatic retries/expired-token
 	* reauthorization are disabled at the raw layer. If the request fails after
-	* the server processes it, the returned application keys may be
-	* unrecoverable; reconcile account state before reissuing a batch.
+	* the server processes it, the returned application key may be unrecoverable;
+	* reconcile account state before reissuing a request for the same email.
 	*
-	* @param request - A single trial account request or a non-empty request array.
+	* @param request - Email, trial duration, storage, and optional region for the account to create.
 	* @param options - Optional abort signal.
 	*
-	* @returns The created reserve-trial account result array.
+	* @returns The created reserve-trial account result.
 	*
 	* @experimental Partner API surface; shape may change as the Partner API docs evolve.
 	*/
-	async reserveTrialAccounts(request, options) {
-		if (Array.isArray(request) && request.length === 0) throw new TypeError("reserveTrialAccounts request array must include at least one account request.");
+	async reserveTrialAccount(request, options) {
 		const { groupsApiUrl, authToken } = this.groupsCoordinates(this.ensureGroupsAuthorization());
 		return this.raw.reserveTrialCreateAccount(groupsApiUrl, authToken, request, options?.signal !== void 0 ? { signal: options.signal } : void 0);
 	}
 	/**
+	* Reserves a new B2 Reserve trial account.
+	*
+	* @param request - Email, trial duration, storage, and optional region for the account to create.
+	* @param options - Optional abort signal.
+	*
+	* @returns The created reserve-trial account result.
+	*
+	* @deprecated Use {@link reserveTrialAccount}. This plural alias is kept for
+	* callers that picked up the original experimental facade name.
+	*
+	* @experimental Partner API surface; shape may change as the Partner API docs evolve.
+	*/
+	async reserveTrialAccounts(request, options) {
+		return this.reserveTrialAccount(request, options);
+	}
+	/**
 	* Hides credentials and Partner tokens from `JSON.stringify(client)`.
 	*
 	* @returns A redacted diagnostic object.

package/dist/partner/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":[],"sources":["../../src/partner/client.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { RetryOptions } from '../http/retry.ts'\nimport type { HttpTransport } from '../http/transport.ts'\nimport type { UrlGuard } from '../http/url-guard.ts'\nimport type { AccountId, GroupId, PartnerToken } from '../types/ids.ts'\nimport type {\n  CreateGroupMemberResponse,\n  EjectGroupMemberResponse,\n  ListedGroupMember,\n  ListGroupMembersResponse,\n  ListGroupsResponse,\n  PartnerAuthorizeResponse,\n  PartnerGroup,\n  Region,\n  ReserveTrialCreateAccountRequest,\n  ReserveTrialCreateAccountRequestEntry,\n  ReserveTrialCreateAccountResponse,\n} from '../types/partner.ts'\nimport { paginateItems } from '../util/paginator.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { PartnerAuthCore } from './auth-core.ts'\nimport type { PartnerRawClient } from './raw.ts'\nimport { PARTNER_TOKEN_REDACTED } from './redaction.ts'\n\nconst MASTER_KEY_REDACTED = '[redacted Master Application Key]'\n\n/**\n * Configuration options for creating a {@link PartnerClient}.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface PartnerClientOptions {\n  /** The Master Application Key ID for the partner administrator account. */\n  readonly masterKeyId: string\n  /** The Master Application Key secret. */\n  readonly masterKey: string\n  /**\n   * B2 realm to authenticate against. Accepts a known realm-map key\n   * (`\"production\"` or `\"staging\"`) or a direct base URL. Custom HTTPS hosts\n   * are trusted with the Master Application Key during authorize, so never\n   * derive `realm` from untrusted input. URL values must use HTTPS, or\n   * loopback IP literal HTTP for local testing only; Master Application Key\n   * credentials are sent unencrypted over loopback HTTP. Unsupported schemes,\n   * malformed URLs, non-URL strings, plaintext HTTP hostnames such as\n   * `localhost`, and non-loopback plaintext HTTP are rejected before\n   * credentials are sent. URL values must not include userinfo, query strings,\n   * or fragments. Defaults to `\"production\"`.\n   */\n  readonly realm?: string\n  /**\n   * Storage backend for Partner authorization state. Defaults to\n   * {@link InMemoryPartnerAccountInfo}. Cached authorization whose endpoint\n   * URLs fail the configured realm policy is ignored by this client until\n   * `authorize()` replaces it; shared stores are not cleared during\n   * construction.\n   */\n  readonly partnerAccountInfo?: PartnerAccountInfo\n  /** Custom HTTP transport. Defaults to `FetchTransport`. Wrapped by `RetryTransport`. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior (max retries, backoff, and per-attempt timeout). */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /**\n   * Additional SSRF allow-list host suffixes. By default the SDK locks the\n   * default transport to host suffixes derived from the Partner authorize\n   * response. Pass an explicit list to add trusted hosts, for example a test\n   * proxy. An empty array adds no hosts and leaves the default guard enabled.\n   *\n   * Only consulted when {@link PartnerClientOptions.transport} is unset; a\n   * custom transport is the user's responsibility to harden.\n   */\n  readonly additionalAllowedHostSuffixes?: readonly string[]\n  /**\n   * Explicitly disable the default SSRF guard after authorize.\n   *\n   * This is intended only for controlled simulator/private-proxy tests. Never\n   * enable it for URLs derived from untrusted input or production credentials.\n   * Only consulted when {@link PartnerClientOptions.transport} is unset.\n   */\n  readonly disableSsrfGuard?: boolean\n  /**\n   * Follow same-origin GET/HEAD redirects in the default fetch transport after\n   * checking each target with the SSRF guard. POST redirects remain blocked.\n   * Defaults to true.\n   */\n  readonly followSameOriginRedirects?: boolean\n  /**\n   * Allow direct custom authorize realms for tests or private proxies.\n   * Leave disabled unless the configured host is trusted with the Master\n   * Application Key.\n   */\n  readonly allowCustomAuthorizeRealm?: boolean\n}\n\n/**\n * Options for Partner authorization.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface PartnerAuthorizeOptions {\n  /** Abort signal for cancelling the authorize request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for listing Partner groups.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface ListGroupsOptions {\n  /** Optional group name filter. Multiple groups may share the same name. */\n  readonly groupName?: string\n  /** Group ID to start listing from for pagination. */\n  readonly startGroupId?: GroupId\n  /** Maximum groups to return in this page. Forwarded to `maxGroupCount`. */\n  readonly pageSize?: number\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for paginating Partner groups.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface PaginateGroupsOptions extends Omit<ListGroupsOptions, 'startGroupId'> {\n  /**\n   * Aborts the iteration between page fetches. The signal is also forwarded to\n   * each underlying list request.\n   */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for listing Partner group members.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface ListGroupMembersOptions {\n  /** Group ID whose active members should be listed. */\n  readonly groupId: GroupId\n  /** First member email address to return for pagination. */\n  readonly startEmail?: string\n  /** Maximum members to return in this page. Forwarded to `maxMemberCount`. */\n  readonly pageSize?: number\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for paginating Partner group members.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface PaginateGroupMembersOptions extends Omit<ListGroupMembersOptions, 'startEmail'> {\n  /**\n   * Aborts the iteration between page fetches. The signal is also forwarded to\n   * each underlying list request.\n   */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for creating a Partner group member.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface CreateGroupMemberOptions {\n  /** Group ID that the new Backblaze account will join. */\n  readonly groupId: GroupId\n  /** Email address for the new group member account. */\n  readonly memberEmail: string\n  /** Region for the new account's data, or null to use the current default region. */\n  readonly region?: Region | null\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for ejecting a Partner group member.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface EjectGroupMemberOptions {\n  /** Group ID that currently contains the member. */\n  readonly groupId: GroupId\n  /** Account ID of the group member being ejected. */\n  readonly memberAccountId: AccountId\n  /** Replacement email for the ejected account, or null to keep the current email address. */\n  readonly email?: string | null\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for reserving B2 Reserve trial accounts.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface ReserveTrialAccountsOptions {\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/** Coordinates needed for Partner groups API requests. */\ninterface PartnerGroupsCoordinates {\n  readonly groupsApiUrl: string\n  readonly authToken: PartnerToken\n  readonly adminAccountId: AccountId\n}\n\n/** Redacted JSON diagnostic shape emitted by {@link PartnerClient.toJSON}. */\nexport interface PartnerClientJson {\n  /** Object kind for log consumers. */\n  readonly type: 'PartnerClient'\n  /** Redacted Master Application Key credential placeholder. */\n  readonly credentials: string\n  /** Redacted Partner token placeholder, or unauthorized state. */\n  readonly authorization: string\n  /** Whether this client currently has Partner authorization state. */\n  readonly authorized: boolean\n  /** Current default URL guard suffixes, or null when a custom transport owns guarding. */\n  readonly urlGuardAllowedSuffixes: readonly string[] | null\n}\n\n/**\n * High-level Partner API client for groups, members, and B2 Reserve trials.\n *\n * @example\n * ```ts\n * const partner = new PartnerClient({\n *   masterKeyId: process.env.B2_MASTER_KEY_ID,\n *   masterKey: process.env.B2_MASTER_KEY,\n * })\n * await partner.authorize()\n * for await (const group of partner.paginateGroups()) {\n *   console.log(group.groupName)\n * }\n * ```\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport class PartnerClient {\n  /** Low-level client for direct Partner API calls. */\n  readonly raw: PartnerRawClient\n  /** Partner authorization state storage (tokens, URLs, capabilities). */\n  readonly partnerAccountInfo: PartnerAccountInfo\n  /**\n   * SSRF allow-list applied by the default transport. `null` when\n   * a custom transport was supplied; in that case the SDK does not own the\n   * guard.\n   */\n  readonly urlGuard: UrlGuard | null\n  private readonly authCore: PartnerAuthCore\n\n  /**\n   * Creates a new PartnerClient. Call {@link authorize} before making API requests.\n   *\n   * @param options - Configuration including credentials, realm, and transport settings.\n   */\n  constructor(options: PartnerClientOptions) {\n    this.authCore = new PartnerAuthCore(options)\n    this.raw = this.authCore.raw\n    this.partnerAccountInfo = this.authCore.partnerAccountInfo\n    this.urlGuard = this.authCore.urlGuard\n  }\n\n  /**\n   * Authenticates with B2 Partner authorization and stores the authorization state.\n   *\n   * @param options - Optional abort signal.\n   *\n   * @returns The Partner authorization response containing tokens, URLs, and capabilities.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async authorize(options?: PartnerAuthorizeOptions): Promise<PartnerAuthorizeResponse> {\n    return this.authCore.authorize(options)\n  }\n\n  /**\n   * Lists Partner groups for the authorized partner administrator account.\n   *\n   * @param options - Optional group filter and pagination settings.\n   *\n   * @returns A page of Partner groups with an optional continuation cursor.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async listGroups(options?: ListGroupsOptions): Promise<ListGroupsResponse> {\n    const { groupsApiUrl, authToken, adminAccountId } = this.groupsCoordinates(\n      this.ensureGroupsAuthorization(),\n    )\n    return this.raw.listGroups(\n      groupsApiUrl,\n      authToken,\n      {\n        adminAccountId,\n        ...(options?.groupName !== undefined ? { groupName: options.groupName } : {}),\n        ...(options?.startGroupId !== undefined ? { startGroupId: options.startGroupId } : {}),\n        ...(options?.pageSize !== undefined ? { maxGroupCount: options.pageSize } : {}),\n      },\n      options?.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Async iterator that yields every Partner group for the authorized account.\n   *\n   * @param options - Optional group filter, page size, and abort signal.\n   *\n   * @returns An async iterable of {@link PartnerGroup} entries.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  paginateGroups(options?: PaginateGroupsOptions): AsyncIterableIterator<PartnerGroup> {\n    return paginateItems(\n      async (cursor: GroupId | undefined) => {\n        const resp = await this.listGroups({\n          ...(options?.groupName !== undefined ? { groupName: options.groupName } : {}),\n          ...(options?.pageSize !== undefined ? { pageSize: options.pageSize } : {}),\n          ...(cursor !== undefined ? { startGroupId: cursor } : {}),\n          ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n        })\n        return { page: resp, nextCursor: resp.nextGroupId ?? undefined }\n      },\n      (page) => page.groups,\n      options?.signal,\n    )\n  }\n\n  /**\n   * Lists active members for a Partner group.\n   *\n   * @param options - Group ID plus optional pagination settings.\n   *\n   * @returns A page of group-member results with an optional continuation cursor.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async listGroupMembers(options: ListGroupMembersOptions): Promise<ListGroupMembersResponse> {\n    const { groupsApiUrl, authToken, adminAccountId } = this.groupsCoordinates(\n      this.ensureGroupsAuthorization(),\n    )\n    return this.raw.listGroupMembers(\n      groupsApiUrl,\n      authToken,\n      {\n        adminAccountId,\n        groupId: options.groupId,\n        ...(options.startEmail !== undefined ? { startEmail: options.startEmail } : {}),\n        ...(options.pageSize !== undefined ? { maxMemberCount: options.pageSize } : {}),\n      },\n      options.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Async iterator that yields every active member for a Partner group.\n   *\n   * @param options - Group ID plus optional page size and abort signal.\n   *\n   * @returns An async iterable of {@link ListedGroupMember} entries.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  paginateGroupMembers(\n    options: PaginateGroupMembersOptions,\n  ): AsyncIterableIterator<ListedGroupMember> {\n    return paginateItems(\n      async (cursor: string | undefined) => {\n        const resp = await this.listGroupMembers({\n          groupId: options.groupId,\n          ...(options.pageSize !== undefined ? { pageSize: options.pageSize } : {}),\n          ...(cursor !== undefined ? { startEmail: cursor } : {}),\n          ...(options.signal !== undefined ? { signal: options.signal } : {}),\n        })\n        // The API returns an array for consistency with batch-capable Partner\n        // surfaces, but this request is scoped to one group ID.\n        const result = resp[0]\n        return {\n          page: resp,\n          nextCursor: result?.nextEmail ?? undefined,\n        }\n      },\n      (page) => page.flatMap((result) => result.groupMembers),\n      options.signal,\n    )\n  }\n\n  /**\n   * Creates a new Backblaze account and adds it to a Partner group.\n   *\n   * This mutation is non-idempotent. Automatic retries and expired-token\n   * reauthorization are disabled; long-running batch callers must catch token\n   * expiry, call {@link authorize}, and decide whether to issue a new request.\n   *\n   * @param options - Group ID, member email, and optional region.\n   *\n   * @returns The created member result array, including the member application key.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async createGroupMember(options: CreateGroupMemberOptions): Promise<CreateGroupMemberResponse> {\n    const { groupsApiUrl, authToken, adminAccountId } = this.groupsCoordinates(\n      this.ensureGroupsAuthorization(),\n    )\n    return this.raw.createGroupMember(\n      groupsApiUrl,\n      authToken,\n      {\n        adminAccountId,\n        groupId: options.groupId,\n        memberEmail: options.memberEmail,\n        ...(options.region !== undefined ? { region: options.region } : {}),\n      },\n      options.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Ejects an active member from a Partner group without deleting the account.\n   *\n   * This mutation is non-idempotent. Automatic retries and expired-token\n   * reauthorization are disabled; long-running batch callers must catch token\n   * expiry, call {@link authorize}, and decide whether to issue a new request.\n   *\n   * @param options - Group ID, member account ID, and optional replacement email.\n   *\n   * @returns The ejected member object.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async ejectGroupMember(options: EjectGroupMemberOptions): Promise<EjectGroupMemberResponse> {\n    const { groupsApiUrl, authToken, adminAccountId } = this.groupsCoordinates(\n      this.ensureGroupsAuthorization(),\n    )\n    return this.raw.ejectGroupMember(\n      groupsApiUrl,\n      authToken,\n      {\n        adminAccountId,\n        groupId: options.groupId,\n        memberAccountId: options.memberAccountId,\n        ...(options.email !== undefined ? { email: options.email } : {}),\n      },\n      options.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Reserves one or more new B2 Reserve trial accounts.\n   *\n   * This operation is non-idempotent and automatic retries/expired-token\n   * reauthorization are disabled at the raw layer. If the request fails after\n   * the server processes it, the returned application keys may be\n   * unrecoverable; reconcile account state before reissuing a batch.\n   *\n   * @param request - A single trial account request or a non-empty request array.\n   * @param options - Optional abort signal.\n   *\n   * @returns The created reserve-trial account result array.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async reserveTrialAccounts(\n    request: ReserveTrialCreateAccountRequestEntry | ReserveTrialCreateAccountRequest,\n    options?: ReserveTrialAccountsOptions,\n  ): Promise<ReserveTrialCreateAccountResponse> {\n    if (Array.isArray(request) && request.length === 0) {\n      throw new TypeError(\n        'reserveTrialAccounts request array must include at least one account request.',\n      )\n    }\n    const { groupsApiUrl, authToken } = this.groupsCoordinates(this.ensureGroupsAuthorization())\n    return this.raw.reserveTrialCreateAccount(\n      groupsApiUrl,\n      authToken,\n      request,\n      options?.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Hides credentials and Partner tokens from `JSON.stringify(client)`.\n   *\n   * @returns A redacted diagnostic object.\n   */\n  toJSON(): PartnerClientJson {\n    return {\n      type: 'PartnerClient',\n      credentials: MASTER_KEY_REDACTED,\n      authorization:\n        this.partnerAccountInfo.getAuth() === null ? '[unauthorized]' : PARTNER_TOKEN_REDACTED,\n      authorized: this.partnerAccountInfo.getAuth() !== null,\n      urlGuardAllowedSuffixes: this.urlGuard?.getAllowedSuffixes() ?? null,\n    }\n  }\n\n  /**\n   * Hides credentials and Partner tokens from default stringification.\n   *\n   * @returns A short redacted label.\n   */\n  toString(): string {\n    return `[PartnerClient ${MASTER_KEY_REDACTED}]`\n  }\n\n  /**\n   * Hides credentials and Partner tokens from Node's `util.inspect`.\n   *\n   * @returns A short redacted label.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n\n  private ensureGroupsAuthorization(): PartnerAuthorizeResponse {\n    const auth = this.partnerAccountInfo.getAuth()\n    if (auth === null) {\n      throw new B2PartnerAuthorizationError('Not authorized. Call PartnerClient.authorize() first.')\n    }\n    const suffixes = this.authCore.activateEndpointSuffixes(auth)\n    this.raw.setAuthorizedEndpointSuffixes(suffixes)\n    return auth\n  }\n\n  private groupsCoordinates(auth: PartnerAuthorizeResponse): PartnerGroupsCoordinates {\n    const groupsApiUrl = auth.apiInfo.groupsApi?.groupsApiUrl\n    if (groupsApiUrl === undefined) {\n      throw new B2PartnerAuthorizationError(\n        'Partner API is not available; PartnerClient.authorize() did not return apiInfo.groupsApi.',\n      )\n    }\n    return {\n      groupsApiUrl,\n      authToken: auth.authorizationToken,\n      adminAccountId: auth.accountId,\n    }\n  }\n}\n"],"mappings":";;;;;AAwBA,IAAM,sBAAsB;;;;;;;;;;;;;;;;;;AA2N5B,IAAa,gBAAb,MAA2B;;CAEzB;;CAEA;;;;;;CAMA;CACA;;;;;;CAOA,YAAY,SAA+B;EACzC,KAAK,WAAW,IAAI,gBAAgB,OAAO;EAC3C,KAAK,MAAM,KAAK,SAAS;EACzB,KAAK,qBAAqB,KAAK,SAAS;EACxC,KAAK,WAAW,KAAK,SAAS;CAChC;;;;;;;;;;CAWA,MAAM,UAAU,SAAsE;EACpF,OAAO,KAAK,SAAS,UAAU,OAAO;CACxC;;;;;;;;;;CAWA,MAAM,WAAW,SAA0D;EACzE,MAAM,EAAE,cAAc,WAAW,mBAAmB,KAAK,kBACvD,KAAK,0BAA0B,CACjC;EACA,OAAO,KAAK,IAAI,WACd,cACA,WACA;GACE;GACA,GAAI,SAAS,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;GAC3E,GAAI,SAAS,iBAAiB,KAAA,IAAY,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;GACpF,GAAI,SAAS,aAAa,KAAA,IAAY,EAAE,eAAe,QAAQ,SAAS,IAAI,CAAC;EAC/E,GACA,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC/D;CACF;;;;;;;;;;CAWA,eAAe,SAAsE;EACnF,OAAO,cACL,OAAO,WAAgC;GACrC,MAAM,OAAO,MAAM,KAAK,WAAW;IACjC,GAAI,SAAS,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC3E,GAAI,SAAS,aAAa,KAAA,IAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;IACxE,GAAI,WAAW,KAAA,IAAY,EAAE,cAAc,OAAO,IAAI,CAAC;IACvD,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACpE,CAAC;GACD,OAAO;IAAE,MAAM;IAAM,YAAY,KAAK,eAAe,KAAA;GAAU;EACjE,IACC,SAAS,KAAK,QACf,SAAS,MACX;CACF;;;;;;;;;;CAWA,MAAM,iBAAiB,SAAqE;EAC1F,MAAM,EAAE,cAAc,WAAW,mBAAmB,KAAK,kBACvD,KAAK,0BAA0B,CACjC;EACA,OAAO,KAAK,IAAI,iBACd,cACA,WACA;GACE;GACA,SAAS,QAAQ;GACjB,GAAI,QAAQ,eAAe,KAAA,IAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;GAC7E,GAAI,QAAQ,aAAa,KAAA,IAAY,EAAE,gBAAgB,QAAQ,SAAS,IAAI,CAAC;EAC/E,GACA,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC9D;CACF;;;;;;;;;;CAWA,qBACE,SAC0C;EAC1C,OAAO,cACL,OAAO,WAA+B;GACpC,MAAM,OAAO,MAAM,KAAK,iBAAiB;IACvC,SAAS,QAAQ;IACjB,GAAI,QAAQ,aAAa,KAAA,IAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;IACvE,GAAI,WAAW,KAAA,IAAY,EAAE,YAAY,OAAO,IAAI,CAAC;IACrD,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACnE,CAAC;GAID,OAAO;IACL,MAAM;IACN,YAHa,KAAK,EAGN,EAAQ,aAAa,KAAA;GACnC;EACF,IACC,SAAS,KAAK,SAAS,WAAW,OAAO,YAAY,GACtD,QAAQ,MACV;CACF;;;;;;;;;;;;;;CAeA,MAAM,kBAAkB,SAAuE;EAC7F,MAAM,EAAE,cAAc,WAAW,mBAAmB,KAAK,kBACvD,KAAK,0BAA0B,CACjC;EACA,OAAO,KAAK,IAAI,kBACd,cACA,WACA;GACE;GACA,SAAS,QAAQ;GACjB,aAAa,QAAQ;GACrB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnE,GACA,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC9D;CACF;;;;;;;;;;;;;;CAeA,MAAM,iBAAiB,SAAqE;EAC1F,MAAM,EAAE,cAAc,WAAW,mBAAmB,KAAK,kBACvD,KAAK,0BAA0B,CACjC;EACA,OAAO,KAAK,IAAI,iBACd,cACA,WACA;GACE;GACA,SAAS,QAAQ;GACjB,iBAAiB,QAAQ;GACzB,GAAI,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EAChE,GACA,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC9D;CACF;;;;;;;;;;;;;;;;CAiBA,MAAM,qBACJ,SACA,SAC4C;EAC5C,IAAI,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,GAC/C,MAAM,IAAI,UACR,+EACF;EAEF,MAAM,EAAE,cAAc,cAAc,KAAK,kBAAkB,KAAK,0BAA0B,CAAC;EAC3F,OAAO,KAAK,IAAI,0BACd,cACA,WACA,SACA,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC/D;CACF;;;;;;CAOA,SAA4B;EAC1B,OAAO;GACL,MAAM;GACN,aAAa;GACb,eACE,KAAK,mBAAmB,QAAQ,MAAM,OAAO,mBAAmB;GAClE,YAAY,KAAK,mBAAmB,QAAQ,MAAM;GAClD,yBAAyB,KAAK,UAAU,mBAAmB,KAAK;EAClE;CACF;;;;;;CAOA,WAAmB;EACjB,OAAO,kBAAkB,oBAAoB;CAC/C;;;;;;CAOA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO,KAAK,SAAS;CACvB;CAEA,4BAA8D;EAC5D,MAAM,OAAO,KAAK,mBAAmB,QAAQ;EAC7C,IAAI,SAAS,MACX,MAAM,IAAI,4BAA4B,uDAAuD;EAE/F,MAAM,WAAW,KAAK,SAAS,yBAAyB,IAAI;EAC5D,KAAK,IAAI,8BAA8B,QAAQ;EAC/C,OAAO;CACT;CAEA,kBAA0B,MAA0D;EAClF,MAAM,eAAe,KAAK,QAAQ,WAAW;EAC7C,IAAI,iBAAiB,KAAA,GACnB,MAAM,IAAI,4BACR,2FACF;EAEF,OAAO;GACL;GACA,WAAW,KAAK;GAChB,gBAAgB,KAAK;EACvB;CACF;AACF"}
+{"version":3,"file":"client.js","names":[],"sources":["../../src/partner/client.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { RetryOptions } from '../http/retry.ts'\nimport type { HttpTransport } from '../http/transport.ts'\nimport type { UrlGuard } from '../http/url-guard.ts'\nimport type { AccountId, GroupId, PartnerToken } from '../types/ids.ts'\nimport type {\n  CreateGroupMemberResponse,\n  EjectGroupMemberResponse,\n  ListedGroupMember,\n  ListGroupMembersResponse,\n  ListGroupsResponse,\n  PartnerAuthorizeResponse,\n  PartnerGroup,\n  Region,\n  ReserveTrialCreateAccountRequest,\n  ReserveTrialCreateAccountResponse,\n} from '../types/partner.ts'\nimport { paginateItems } from '../util/paginator.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { PartnerAuthCore } from './auth-core.ts'\nimport type { PartnerRawClient } from './raw.ts'\nimport { PARTNER_TOKEN_REDACTED } from './redaction.ts'\n\nconst MASTER_KEY_REDACTED = '[redacted Master Application Key]'\n\n/**\n * Configuration options for creating a {@link PartnerClient}.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface PartnerClientOptions {\n  /** The Master Application Key ID for the partner administrator account. */\n  readonly masterKeyId: string\n  /** The Master Application Key secret. */\n  readonly masterKey: string\n  /**\n   * B2 realm to authenticate against. Accepts a known realm-map key\n   * (`\"production\"` or `\"staging\"`) or a direct base URL. Custom HTTPS hosts\n   * are trusted with the Master Application Key during authorize, so never\n   * derive `realm` from untrusted input. URL values must use HTTPS, or\n   * loopback IP literal HTTP for local testing only; Master Application Key\n   * credentials are sent unencrypted over loopback HTTP. Unsupported schemes,\n   * malformed URLs, non-URL strings, plaintext HTTP hostnames such as\n   * `localhost`, and non-loopback plaintext HTTP are rejected before\n   * credentials are sent. URL values must not include userinfo, query strings,\n   * or fragments. Defaults to `\"production\"`.\n   */\n  readonly realm?: string\n  /**\n   * Storage backend for Partner authorization state. Defaults to\n   * {@link InMemoryPartnerAccountInfo}. Cached authorization whose endpoint\n   * URLs fail the configured realm policy is ignored by this client until\n   * `authorize()` replaces it; shared stores are not cleared during\n   * construction.\n   */\n  readonly partnerAccountInfo?: PartnerAccountInfo\n  /** Custom HTTP transport. Defaults to `FetchTransport`. Wrapped by `RetryTransport`. */\n  readonly transport?: HttpTransport\n  /** Override retry behavior (max retries, backoff, and per-attempt timeout). */\n  readonly retry?: Partial<RetryOptions>\n  /** Custom user-agent string prepended to the SDK default. */\n  readonly userAgent?: string\n  /**\n   * Additional SSRF allow-list host suffixes. By default the SDK locks the\n   * default transport to host suffixes derived from the Partner authorize\n   * response. Pass an explicit list to add trusted hosts, for example a test\n   * proxy. An empty array adds no hosts and leaves the default guard enabled.\n   *\n   * Only consulted when {@link PartnerClientOptions.transport} is unset; a\n   * custom transport is the user's responsibility to harden.\n   */\n  readonly additionalAllowedHostSuffixes?: readonly string[]\n  /**\n   * Explicitly disable the default SSRF guard after authorize.\n   *\n   * This is intended only for controlled simulator/private-proxy tests. Never\n   * enable it for URLs derived from untrusted input or production credentials.\n   * Only consulted when {@link PartnerClientOptions.transport} is unset.\n   */\n  readonly disableSsrfGuard?: boolean\n  /**\n   * Follow same-origin GET/HEAD redirects in the default fetch transport after\n   * checking each target with the SSRF guard. POST redirects remain blocked.\n   * Defaults to true.\n   */\n  readonly followSameOriginRedirects?: boolean\n  /**\n   * Allow direct custom authorize realms for tests or private proxies.\n   * Leave disabled unless the configured host is trusted with the Master\n   * Application Key.\n   */\n  readonly allowCustomAuthorizeRealm?: boolean\n}\n\n/**\n * Options for Partner authorization.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface PartnerAuthorizeOptions {\n  /** Abort signal for cancelling the authorize request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for listing Partner groups.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface ListGroupsOptions {\n  /** Optional group name filter. Multiple groups may share the same name. */\n  readonly groupName?: string\n  /** Group ID to start listing from for pagination. */\n  readonly startGroupId?: GroupId\n  /** Maximum groups to return in this page. Forwarded to `maxGroupCount`. */\n  readonly pageSize?: number\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for paginating Partner groups.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface PaginateGroupsOptions extends Omit<ListGroupsOptions, 'startGroupId'> {\n  /**\n   * Aborts the iteration between page fetches. The signal is also forwarded to\n   * each underlying list request.\n   */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for listing Partner group members.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface ListGroupMembersOptions {\n  /** Group ID whose active members should be listed. */\n  readonly groupId: GroupId\n  /** First member email address to return for pagination. */\n  readonly startEmail?: string\n  /** Maximum members to return in this page. Forwarded to `maxMemberCount`. */\n  readonly pageSize?: number\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for paginating Partner group members.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface PaginateGroupMembersOptions extends Omit<ListGroupMembersOptions, 'startEmail'> {\n  /**\n   * Aborts the iteration between page fetches. The signal is also forwarded to\n   * each underlying list request.\n   */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for creating a Partner group member.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface CreateGroupMemberOptions {\n  /** Group ID that the new Backblaze account will join. */\n  readonly groupId: GroupId\n  /** Email address for the new group member account. */\n  readonly memberEmail: string\n  /** Region for the new account's data, or null to use the current default region. */\n  readonly region?: Region | null\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for ejecting a Partner group member.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface EjectGroupMemberOptions {\n  /** Group ID that currently contains the member. */\n  readonly groupId: GroupId\n  /** Account ID of the group member being ejected. */\n  readonly memberAccountId: AccountId\n  /** Replacement email for the ejected account, or null to keep the current email address. */\n  readonly email?: string | null\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for reserving a B2 Reserve trial account.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport interface ReserveTrialAccountOptions {\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n}\n\n/**\n * Options for reserving a B2 Reserve trial account.\n *\n * @deprecated Use {@link ReserveTrialAccountOptions}.\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport type ReserveTrialAccountsOptions = ReserveTrialAccountOptions\n\n/** Coordinates needed for Partner groups API requests. */\ninterface PartnerGroupsCoordinates {\n  readonly groupsApiUrl: string\n  readonly authToken: PartnerToken\n  readonly adminAccountId: AccountId\n}\n\n/** Redacted JSON diagnostic shape emitted by {@link PartnerClient.toJSON}. */\nexport interface PartnerClientJson {\n  /** Object kind for log consumers. */\n  readonly type: 'PartnerClient'\n  /** Redacted Master Application Key credential placeholder. */\n  readonly credentials: string\n  /** Redacted Partner token placeholder, or unauthorized state. */\n  readonly authorization: string\n  /** Whether this client currently has Partner authorization state. */\n  readonly authorized: boolean\n  /** Current default URL guard suffixes, or null when a custom transport owns guarding. */\n  readonly urlGuardAllowedSuffixes: readonly string[] | null\n}\n\n/**\n * High-level Partner API client for groups, members, and B2 Reserve trials.\n *\n * @example\n * ```ts\n * const partner = new PartnerClient({\n *   masterKeyId: process.env.B2_MASTER_KEY_ID,\n *   masterKey: process.env.B2_MASTER_KEY,\n * })\n * await partner.authorize()\n * for await (const group of partner.paginateGroups()) {\n *   console.log(group.groupName)\n * }\n * ```\n *\n * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n */\nexport class PartnerClient {\n  /** Low-level client for direct Partner API calls. */\n  readonly raw: PartnerRawClient\n  /** Partner authorization state storage (tokens, URLs, capabilities). */\n  readonly partnerAccountInfo: PartnerAccountInfo\n  /**\n   * SSRF allow-list applied by the default transport. `null` when\n   * a custom transport was supplied; in that case the SDK does not own the\n   * guard.\n   */\n  readonly urlGuard: UrlGuard | null\n  private readonly authCore: PartnerAuthCore\n\n  /**\n   * Creates a new PartnerClient. Call {@link authorize} before making API requests.\n   *\n   * @param options - Configuration including credentials, realm, and transport settings.\n   */\n  constructor(options: PartnerClientOptions) {\n    this.authCore = new PartnerAuthCore(options)\n    this.raw = this.authCore.raw\n    this.partnerAccountInfo = this.authCore.partnerAccountInfo\n    this.urlGuard = this.authCore.urlGuard\n  }\n\n  /**\n   * Authenticates with B2 Partner authorization and stores the authorization state.\n   *\n   * @param options - Optional abort signal.\n   *\n   * @returns The Partner authorization response containing tokens, URLs, and capabilities.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async authorize(options?: PartnerAuthorizeOptions): Promise<PartnerAuthorizeResponse> {\n    return this.authCore.authorize(options)\n  }\n\n  /**\n   * Lists Partner groups for the authorized partner administrator account.\n   *\n   * @param options - Optional group filter and pagination settings.\n   *\n   * @returns A page of Partner groups with an optional continuation cursor.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async listGroups(options?: ListGroupsOptions): Promise<ListGroupsResponse> {\n    const { groupsApiUrl, authToken, adminAccountId } = this.groupsCoordinates(\n      this.ensureGroupsAuthorization(),\n    )\n    return this.raw.listGroups(\n      groupsApiUrl,\n      authToken,\n      {\n        adminAccountId,\n        ...(options?.groupName !== undefined ? { groupName: options.groupName } : {}),\n        ...(options?.startGroupId !== undefined ? { startGroupId: options.startGroupId } : {}),\n        ...(options?.pageSize !== undefined ? { maxGroupCount: options.pageSize } : {}),\n      },\n      options?.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Async iterator that yields every Partner group for the authorized account.\n   *\n   * @param options - Optional group filter, page size, and abort signal.\n   *\n   * @returns An async iterable of {@link PartnerGroup} entries.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  paginateGroups(options?: PaginateGroupsOptions): AsyncIterableIterator<PartnerGroup> {\n    return paginateItems(\n      async (cursor: GroupId | undefined) => {\n        const resp = await this.listGroups({\n          ...(options?.groupName !== undefined ? { groupName: options.groupName } : {}),\n          ...(options?.pageSize !== undefined ? { pageSize: options.pageSize } : {}),\n          ...(cursor !== undefined ? { startGroupId: cursor } : {}),\n          ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n        })\n        return { page: resp, nextCursor: resp.nextGroupId ?? undefined }\n      },\n      (page) => page.groups,\n      options?.signal,\n    )\n  }\n\n  /**\n   * Lists active members for a Partner group.\n   *\n   * @param options - Group ID plus optional pagination settings.\n   *\n   * @returns A page of group-member results with an optional continuation cursor.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async listGroupMembers(options: ListGroupMembersOptions): Promise<ListGroupMembersResponse> {\n    const { groupsApiUrl, authToken, adminAccountId } = this.groupsCoordinates(\n      this.ensureGroupsAuthorization(),\n    )\n    return this.raw.listGroupMembers(\n      groupsApiUrl,\n      authToken,\n      {\n        adminAccountId,\n        groupId: options.groupId,\n        ...(options.startEmail !== undefined ? { startEmail: options.startEmail } : {}),\n        ...(options.pageSize !== undefined ? { maxMemberCount: options.pageSize } : {}),\n      },\n      options.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Async iterator that yields every active member for a Partner group.\n   *\n   * @param options - Group ID plus optional page size and abort signal.\n   *\n   * @returns An async iterable of {@link ListedGroupMember} entries.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  paginateGroupMembers(\n    options: PaginateGroupMembersOptions,\n  ): AsyncIterableIterator<ListedGroupMember> {\n    return paginateItems(\n      async (cursor: string | undefined) => {\n        const resp = await this.listGroupMembers({\n          groupId: options.groupId,\n          ...(options.pageSize !== undefined ? { pageSize: options.pageSize } : {}),\n          ...(cursor !== undefined ? { startEmail: cursor } : {}),\n          ...(options.signal !== undefined ? { signal: options.signal } : {}),\n        })\n        return {\n          page: resp,\n          nextCursor: resp.nextEmail ?? undefined,\n        }\n      },\n      (page) => [...page.groupMembers],\n      options.signal,\n    )\n  }\n\n  /**\n   * Creates a new Backblaze account and adds it to a Partner group.\n   *\n   * This mutation is non-idempotent. Automatic retries and expired-token\n   * reauthorization are disabled; long-running batch callers must catch token\n   * expiry, call {@link authorize}, and decide whether to issue a new request.\n   *\n   * @param options - Group ID, member email, and optional region.\n   *\n   * @returns The created member result, including the member application key.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async createGroupMember(options: CreateGroupMemberOptions): Promise<CreateGroupMemberResponse> {\n    const { groupsApiUrl, authToken, adminAccountId } = this.groupsCoordinates(\n      this.ensureGroupsAuthorization(),\n    )\n    return this.raw.createGroupMember(\n      groupsApiUrl,\n      authToken,\n      {\n        adminAccountId,\n        groupId: options.groupId,\n        memberEmail: options.memberEmail,\n        ...(options.region !== undefined ? { region: options.region } : {}),\n      },\n      options.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Ejects an active member from a Partner group without deleting the account.\n   *\n   * This mutation is non-idempotent. Automatic retries and expired-token\n   * reauthorization are disabled; long-running batch callers must catch token\n   * expiry, call {@link authorize}, and decide whether to issue a new request.\n   *\n   * @param options - Group ID, member account ID, and optional replacement email.\n   *\n   * @returns The ejected member object.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async ejectGroupMember(options: EjectGroupMemberOptions): Promise<EjectGroupMemberResponse> {\n    const { groupsApiUrl, authToken, adminAccountId } = this.groupsCoordinates(\n      this.ensureGroupsAuthorization(),\n    )\n    return this.raw.ejectGroupMember(\n      groupsApiUrl,\n      authToken,\n      {\n        adminAccountId,\n        groupId: options.groupId,\n        memberAccountId: options.memberAccountId,\n        ...(options.email !== undefined ? { email: options.email } : {}),\n      },\n      options.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Reserves a new B2 Reserve trial account.\n   *\n   * This operation is non-idempotent and automatic retries/expired-token\n   * reauthorization are disabled at the raw layer. If the request fails after\n   * the server processes it, the returned application key may be unrecoverable;\n   * reconcile account state before reissuing a request for the same email.\n   *\n   * @param request - Email, trial duration, storage, and optional region for the account to create.\n   * @param options - Optional abort signal.\n   *\n   * @returns The created reserve-trial account result.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async reserveTrialAccount(\n    request: ReserveTrialCreateAccountRequest,\n    options?: ReserveTrialAccountOptions,\n  ): Promise<ReserveTrialCreateAccountResponse> {\n    const { groupsApiUrl, authToken } = this.groupsCoordinates(this.ensureGroupsAuthorization())\n    return this.raw.reserveTrialCreateAccount(\n      groupsApiUrl,\n      authToken,\n      request,\n      options?.signal !== undefined ? { signal: options.signal } : undefined,\n    )\n  }\n\n  /**\n   * Reserves a new B2 Reserve trial account.\n   *\n   * @param request - Email, trial duration, storage, and optional region for the account to create.\n   * @param options - Optional abort signal.\n   *\n   * @returns The created reserve-trial account result.\n   *\n   * @deprecated Use {@link reserveTrialAccount}. This plural alias is kept for\n   * callers that picked up the original experimental facade name.\n   *\n   * @experimental Partner API surface; shape may change as the Partner API docs evolve.\n   */\n  async reserveTrialAccounts(\n    request: ReserveTrialCreateAccountRequest,\n    options?: ReserveTrialAccountsOptions,\n  ): Promise<ReserveTrialCreateAccountResponse> {\n    return this.reserveTrialAccount(request, options)\n  }\n\n  /**\n   * Hides credentials and Partner tokens from `JSON.stringify(client)`.\n   *\n   * @returns A redacted diagnostic object.\n   */\n  toJSON(): PartnerClientJson {\n    return {\n      type: 'PartnerClient',\n      credentials: MASTER_KEY_REDACTED,\n      authorization:\n        this.partnerAccountInfo.getAuth() === null ? '[unauthorized]' : PARTNER_TOKEN_REDACTED,\n      authorized: this.partnerAccountInfo.getAuth() !== null,\n      urlGuardAllowedSuffixes: this.urlGuard?.getAllowedSuffixes() ?? null,\n    }\n  }\n\n  /**\n   * Hides credentials and Partner tokens from default stringification.\n   *\n   * @returns A short redacted label.\n   */\n  toString(): string {\n    return `[PartnerClient ${MASTER_KEY_REDACTED}]`\n  }\n\n  /**\n   * Hides credentials and Partner tokens from Node's `util.inspect`.\n   *\n   * @returns A short redacted label.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n\n  private ensureGroupsAuthorization(): PartnerAuthorizeResponse {\n    const auth = this.partnerAccountInfo.getAuth()\n    if (auth === null) {\n      throw new B2PartnerAuthorizationError('Not authorized. Call PartnerClient.authorize() first.')\n    }\n    const suffixes = this.authCore.activateEndpointSuffixes(auth)\n    this.raw.setAuthorizedEndpointSuffixes(suffixes)\n    return auth\n  }\n\n  private groupsCoordinates(auth: PartnerAuthorizeResponse): PartnerGroupsCoordinates {\n    const groupsApiUrl = auth.apiInfo.groupsApi?.groupsApiUrl\n    if (groupsApiUrl === undefined) {\n      throw new B2PartnerAuthorizationError(\n        'Partner API is not available; PartnerClient.authorize() did not return apiInfo.groupsApi.',\n      )\n    }\n    return {\n      groupsApiUrl,\n      authToken: auth.authorizationToken,\n      adminAccountId: auth.accountId,\n    }\n  }\n}\n"],"mappings":";;;;;AAuBA,IAAM,sBAAsB;;;;;;;;;;;;;;;;;;AAoO5B,IAAa,gBAAb,MAA2B;;CAEzB;;CAEA;;;;;;CAMA;CACA;;;;;;CAOA,YAAY,SAA+B;EACzC,KAAK,WAAW,IAAI,gBAAgB,OAAO;EAC3C,KAAK,MAAM,KAAK,SAAS;EACzB,KAAK,qBAAqB,KAAK,SAAS;EACxC,KAAK,WAAW,KAAK,SAAS;CAChC;;;;;;;;;;CAWA,MAAM,UAAU,SAAsE;EACpF,OAAO,KAAK,SAAS,UAAU,OAAO;CACxC;;;;;;;;;;CAWA,MAAM,WAAW,SAA0D;EACzE,MAAM,EAAE,cAAc,WAAW,mBAAmB,KAAK,kBACvD,KAAK,0BAA0B,CACjC;EACA,OAAO,KAAK,IAAI,WACd,cACA,WACA;GACE;GACA,GAAI,SAAS,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;GAC3E,GAAI,SAAS,iBAAiB,KAAA,IAAY,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;GACpF,GAAI,SAAS,aAAa,KAAA,IAAY,EAAE,eAAe,QAAQ,SAAS,IAAI,CAAC;EAC/E,GACA,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC/D;CACF;;;;;;;;;;CAWA,eAAe,SAAsE;EACnF,OAAO,cACL,OAAO,WAAgC;GACrC,MAAM,OAAO,MAAM,KAAK,WAAW;IACjC,GAAI,SAAS,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC3E,GAAI,SAAS,aAAa,KAAA,IAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;IACxE,GAAI,WAAW,KAAA,IAAY,EAAE,cAAc,OAAO,IAAI,CAAC;IACvD,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACpE,CAAC;GACD,OAAO;IAAE,MAAM;IAAM,YAAY,KAAK,eAAe,KAAA;GAAU;EACjE,IACC,SAAS,KAAK,QACf,SAAS,MACX;CACF;;;;;;;;;;CAWA,MAAM,iBAAiB,SAAqE;EAC1F,MAAM,EAAE,cAAc,WAAW,mBAAmB,KAAK,kBACvD,KAAK,0BAA0B,CACjC;EACA,OAAO,KAAK,IAAI,iBACd,cACA,WACA;GACE;GACA,SAAS,QAAQ;GACjB,GAAI,QAAQ,eAAe,KAAA,IAAY,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;GAC7E,GAAI,QAAQ,aAAa,KAAA,IAAY,EAAE,gBAAgB,QAAQ,SAAS,IAAI,CAAC;EAC/E,GACA,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC9D;CACF;;;;;;;;;;CAWA,qBACE,SAC0C;EAC1C,OAAO,cACL,OAAO,WAA+B;GACpC,MAAM,OAAO,MAAM,KAAK,iBAAiB;IACvC,SAAS,QAAQ;IACjB,GAAI,QAAQ,aAAa,KAAA,IAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;IACvE,GAAI,WAAW,KAAA,IAAY,EAAE,YAAY,OAAO,IAAI,CAAC;IACrD,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACnE,CAAC;GACD,OAAO;IACL,MAAM;IACN,YAAY,KAAK,aAAa,KAAA;GAChC;EACF,IACC,SAAS,CAAC,GAAG,KAAK,YAAY,GAC/B,QAAQ,MACV;CACF;;;;;;;;;;;;;;CAeA,MAAM,kBAAkB,SAAuE;EAC7F,MAAM,EAAE,cAAc,WAAW,mBAAmB,KAAK,kBACvD,KAAK,0BAA0B,CACjC;EACA,OAAO,KAAK,IAAI,kBACd,cACA,WACA;GACE;GACA,SAAS,QAAQ;GACjB,aAAa,QAAQ;GACrB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnE,GACA,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC9D;CACF;;;;;;;;;;;;;;CAeA,MAAM,iBAAiB,SAAqE;EAC1F,MAAM,EAAE,cAAc,WAAW,mBAAmB,KAAK,kBACvD,KAAK,0BAA0B,CACjC;EACA,OAAO,KAAK,IAAI,iBACd,cACA,WACA;GACE;GACA,SAAS,QAAQ;GACjB,iBAAiB,QAAQ;GACzB,GAAI,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EAChE,GACA,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC9D;CACF;;;;;;;;;;;;;;;;CAiBA,MAAM,oBACJ,SACA,SAC4C;EAC5C,MAAM,EAAE,cAAc,cAAc,KAAK,kBAAkB,KAAK,0BAA0B,CAAC;EAC3F,OAAO,KAAK,IAAI,0BACd,cACA,WACA,SACA,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAC/D;CACF;;;;;;;;;;;;;;CAeA,MAAM,qBACJ,SACA,SAC4C;EAC5C,OAAO,KAAK,oBAAoB,SAAS,OAAO;CAClD;;;;;;CAOA,SAA4B;EAC1B,OAAO;GACL,MAAM;GACN,aAAa;GACb,eACE,KAAK,mBAAmB,QAAQ,MAAM,OAAO,mBAAmB;GAClE,YAAY,KAAK,mBAAmB,QAAQ,MAAM;GAClD,yBAAyB,KAAK,UAAU,mBAAmB,KAAK;EAClE;CACF;;;;;;CAOA,WAAmB;EACjB,OAAO,kBAAkB,oBAAoB;CAC/C;;;;;;CAOA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO,KAAK,SAAS;CACvB;CAEA,4BAA8D;EAC5D,MAAM,OAAO,KAAK,mBAAmB,QAAQ;EAC7C,IAAI,SAAS,MACX,MAAM,IAAI,4BAA4B,uDAAuD;EAE/F,MAAM,WAAW,KAAK,SAAS,yBAAyB,IAAI;EAC5D,KAAK,IAAI,8BAA8B,QAAQ;EAC/C,OAAO;CACT;CAEA,kBAA0B,MAA0D;EAClF,MAAM,eAAe,KAAK,QAAQ,WAAW;EAC7C,IAAI,iBAAiB,KAAA,GACnB,MAAM,IAAI,4BACR,2FACF;EAEF,OAAO;GACL;GACA,WAAW,KAAK;GAChB,gBAAgB,KAAK;EACvB;CACF;AACF"}

package/dist/partner/endpoint-url.cjs

@@ -93,6 +93,7 @@ function withQueryString(url, query) {
 function nonRetryingMutationRequestOptions(options) {
 	return {
 		...options?.signal !== void 0 ? { signal: options.signal } : {},
+		idempotent: false,
 		retry: {
 			...options?.retry ?? {},
 			maxRetries: 0

package/dist/partner/endpoint-url.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-url.cjs","names":[],"sources":["../../src/partner/endpoint-url.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { RetryOptions } from '../http/retry.ts'\nimport { getTransportUrlGuard, type HttpTransport } from '../http/transport.ts'\nimport { hostMatchesAllowedSuffix, UrlGuard } from '../http/url-guard.ts'\n\n/** Partner authorize endpoint URL field names that are validated before token use. */\nexport type PartnerEndpointUrlField = 'groupsApiUrl' | 'backupApiUrl'\n\n/** Message copy for resolving endpoint suffixes from an authorized or guarded transport. */\nexport interface EndpointAllowedSuffixMessages {\n  /** Error message when no validated suffixes and no URL guard are available. */\n  readonly missingGuard: string\n  /** Error message when a URL guard exists but has not been locked to suffixes. */\n  readonly unlockedGuard: string\n}\n\n/** Query-string scalar value supported by Partner and Backup endpoint helpers. */\nexport type QueryValue = string | number\n/** Query-string parameter map supported by Partner and Backup endpoint helpers. */\nexport type QueryParams = Readonly<Record<string, QueryValue>>\n\n/** Shared request options shape for non-idempotent Partner and Backup mutations. */\nexport interface MutationRequestOptions {\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n  /** Per-request retry override. */\n  readonly retry?: Partial<RetryOptions>\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase()\n  if (host === '[::1]' || host === '::1') return true\n\n  const parts = host.split('.')\n  return (\n    parts.length === 4 &&\n    parts[0] === '127' &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  )\n}\n\nfunction hostAllowedBySuffixes(hostname: string, allowedSuffixes: readonly string[]): boolean {\n  return allowedSuffixes.some((suffix) => hostMatchesAllowedSuffix(hostname, suffix))\n}\n\n/**\n * Resolves endpoint host suffixes from fresh/cached Partner authorization or a locked transport guard.\n *\n * @param transport - Transport whose URL guard may already be locked.\n * @param authorizedSuffixes - Suffixes derived from validated Partner authorization.\n * @param messages - Surface-specific failure messages.\n *\n * @returns The suffixes safe for credential-bearing endpoint requests.\n *\n * @throws B2PartnerAuthorizationError if no locked guard or authorized suffixes exist.\n *\n * @internal\n */\nexport function endpointAllowedSuffixes(\n  transport: HttpTransport,\n  authorizedSuffixes: readonly string[],\n  messages: EndpointAllowedSuffixMessages,\n): readonly string[] {\n  if (authorizedSuffixes.length > 0) return authorizedSuffixes\n\n  const guard = getTransportUrlGuard(transport)\n  if (guard === undefined) {\n    throw new B2PartnerAuthorizationError(messages.missingGuard)\n  }\n\n  const suffixes = guard.getAllowedSuffixes()\n  if (suffixes.length === 0) {\n    throw new B2PartnerAuthorizationError(messages.unlockedGuard)\n  }\n\n  return suffixes\n}\n\n/**\n * Validates a Partner-derived endpoint URL before a Partner token is sent to it.\n *\n * @param rawUrl - Endpoint URL from Partner authorization or cache.\n * @param fieldName - Authorize-response field being validated.\n * @param allowedSuffixes - Host suffix allow-list derived from the trusted realm.\n *\n * @returns The original URL when it is safe to use.\n *\n * @throws B2PartnerAuthorizationError if the URL is malformed or unsafe.\n *\n * @internal\n */\nexport function validatePartnerEndpointUrl(\n  rawUrl: string,\n  fieldName: PartnerEndpointUrlField,\n  allowedSuffixes: readonly string[],\n): string {\n  let url: URL\n  try {\n    url = new URL(rawUrl)\n  } catch {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response included malformed ${fieldName}`,\n    )\n  }\n\n  const host = url.hostname.toLowerCase()\n  const isAllowedLoopbackHttp =\n    url.protocol === 'http:' && isLoopbackHost(host) && hostAllowedBySuffixes(host, allowedSuffixes)\n\n  if (url.protocol !== 'https:' && !isAllowedLoopbackHttp) {\n    throw new B2PartnerAuthorizationError(`Partner authorize response ${fieldName} must use HTTPS`)\n  }\n  if (url.username !== '' || url.password !== '') {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response ${fieldName} must not include userinfo`,\n    )\n  }\n  if (url.search !== '' || url.hash !== '') {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response ${fieldName} must not include query or fragment`,\n    )\n  }\n\n  if (isAllowedLoopbackHttp) return rawUrl\n\n  const guard = new UrlGuard()\n  guard.setAllowedSuffixes(allowedSuffixes)\n  try {\n    guard.check(rawUrl)\n  } catch (err) {\n    throw new B2PartnerAuthorizationError(\n      err instanceof Error\n        ? `Partner authorize response included unsafe ${fieldName}: ${err.message}`\n        : `Partner authorize response included unsafe ${fieldName}`,\n    )\n  }\n\n  return rawUrl\n}\n\n/**\n * Appends query parameters using the SDK's B2 URL encoding semantics.\n *\n * @param url - Base URL without query string.\n * @param query - Query keys and string/number values to append.\n *\n * @returns URL with encoded query parameters, or the original URL for an empty query.\n *\n * @internal\n */\nexport function withQueryString(url: string, query: QueryParams): string {\n  // Match the storage raw client's encodeURIComponent query semantics: spaces\n  // are `%20`, not form-style `+`.\n  const queryString = Object.entries(query)\n    .map(([key, value]) => `${key}=${encodeURIComponent(String(value))}`)\n    .join('&')\n  return queryString.length === 0 ? url : `${url}?${queryString}`\n}\n\n/**\n * Forces non-idempotent mutation calls to opt out of automatic request replay.\n *\n * @param options - Caller-provided request options.\n *\n * @returns Request options with `retry.maxRetries` set to zero.\n *\n * @internal\n */\nexport function nonRetryingMutationRequestOptions(\n  options: MutationRequestOptions | undefined,\n): MutationRequestOptions {\n  return {\n    ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n    retry: { ...(options?.retry ?? {}), maxRetries: 0 },\n  }\n}\n"],"mappings":";;;;AA6BA,SAAS,eAAe,UAA2B;CACjD,MAAM,OAAO,SAAS,YAAY;CAClC,IAAI,SAAS,WAAW,SAAS,OAAO,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,OACE,MAAM,WAAW,KACjB,MAAM,OAAO,SACb,MAAM,OAAO,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG;AAEnE;AAEA,SAAS,sBAAsB,UAAkB,iBAA6C;CAC5F,OAAO,gBAAgB,MAAM,WAAW,kBAAA,yBAAyB,UAAU,MAAM,CAAC;AACpF;;;;;;;;;;;;;;AAeA,SAAgB,wBACd,WACA,oBACA,UACmB;CACnB,IAAI,mBAAmB,SAAS,GAAG,OAAO;CAE1C,MAAM,QAAQ,kBAAA,qBAAqB,SAAS;CAC5C,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,qBAAA,4BAA4B,SAAS,YAAY;CAG7D,MAAM,WAAW,MAAM,mBAAmB;CAC1C,IAAI,SAAS,WAAW,GACtB,MAAM,IAAI,qBAAA,4BAA4B,SAAS,aAAa;CAG9D,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAgB,2BACd,QACA,WACA,iBACQ;CACR,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,MAAM;CACtB,QAAQ;EACN,MAAM,IAAI,qBAAA,4BACR,iDAAiD,WACnD;CACF;CAEA,MAAM,OAAO,IAAI,SAAS,YAAY;CACtC,MAAM,wBACJ,IAAI,aAAa,WAAW,eAAe,IAAI,KAAK,sBAAsB,MAAM,eAAe;CAEjG,IAAI,IAAI,aAAa,YAAY,CAAC,uBAChC,MAAM,IAAI,qBAAA,4BAA4B,8BAA8B,UAAU,gBAAgB;CAEhG,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,IAC1C,MAAM,IAAI,qBAAA,4BACR,8BAA8B,UAAU,2BAC1C;CAEF,IAAI,IAAI,WAAW,MAAM,IAAI,SAAS,IACpC,MAAM,IAAI,qBAAA,4BACR,8BAA8B,UAAU,oCAC1C;CAGF,IAAI,uBAAuB,OAAO;CAElC,MAAM,QAAQ,IAAI,kBAAA,SAAS;CAC3B,MAAM,mBAAmB,eAAe;CACxC,IAAI;EACF,MAAM,MAAM,MAAM;CACpB,SAAS,KAAK;EACZ,MAAM,IAAI,qBAAA,4BACR,eAAe,QACX,8CAA8C,UAAU,IAAI,IAAI,YAChE,8CAA8C,WACpD;CACF;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,gBAAgB,KAAa,OAA4B;CAGvE,MAAM,cAAc,OAAO,QAAQ,KAAK,CAAC,CACtC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,mBAAmB,OAAO,KAAK,CAAC,GAAG,CAAC,CACpE,KAAK,GAAG;CACX,OAAO,YAAY,WAAW,IAAI,MAAM,GAAG,IAAI,GAAG;AACpD;;;;;;;;;;AAWA,SAAgB,kCACd,SACwB;CACxB,OAAO;EACL,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClE,OAAO;GAAE,GAAI,SAAS,SAAS,CAAC;GAAI,YAAY;EAAE;CACpD;AACF"}
+{"version":3,"file":"endpoint-url.cjs","names":[],"sources":["../../src/partner/endpoint-url.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { RetryOptions } from '../http/retry.ts'\nimport { getTransportUrlGuard, type HttpTransport } from '../http/transport.ts'\nimport { hostMatchesAllowedSuffix, UrlGuard } from '../http/url-guard.ts'\n\n/** Partner authorize endpoint URL field names that are validated before token use. */\nexport type PartnerEndpointUrlField = 'groupsApiUrl' | 'backupApiUrl'\n\n/** Message copy for resolving endpoint suffixes from an authorized or guarded transport. */\nexport interface EndpointAllowedSuffixMessages {\n  /** Error message when no validated suffixes and no URL guard are available. */\n  readonly missingGuard: string\n  /** Error message when a URL guard exists but has not been locked to suffixes. */\n  readonly unlockedGuard: string\n}\n\n/** Query-string scalar value supported by Partner and Backup endpoint helpers. */\nexport type QueryValue = string | number\n/** Query-string parameter map supported by Partner and Backup endpoint helpers. */\nexport type QueryParams = Readonly<Record<string, QueryValue>>\n\n/** Shared request options shape for non-idempotent Partner and Backup mutations. */\nexport interface MutationRequestOptions {\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n  /** Per-request retry override. */\n  readonly retry?: Partial<RetryOptions>\n  /** Marks the request unsafe for transport-level retry or reauth replay. */\n  readonly idempotent?: false\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase()\n  if (host === '[::1]' || host === '::1') return true\n\n  const parts = host.split('.')\n  return (\n    parts.length === 4 &&\n    parts[0] === '127' &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  )\n}\n\nfunction hostAllowedBySuffixes(hostname: string, allowedSuffixes: readonly string[]): boolean {\n  return allowedSuffixes.some((suffix) => hostMatchesAllowedSuffix(hostname, suffix))\n}\n\n/**\n * Resolves endpoint host suffixes from fresh/cached Partner authorization or a locked transport guard.\n *\n * @param transport - Transport whose URL guard may already be locked.\n * @param authorizedSuffixes - Suffixes derived from validated Partner authorization.\n * @param messages - Surface-specific failure messages.\n *\n * @returns The suffixes safe for credential-bearing endpoint requests.\n *\n * @throws B2PartnerAuthorizationError if no locked guard or authorized suffixes exist.\n *\n * @internal\n */\nexport function endpointAllowedSuffixes(\n  transport: HttpTransport,\n  authorizedSuffixes: readonly string[],\n  messages: EndpointAllowedSuffixMessages,\n): readonly string[] {\n  if (authorizedSuffixes.length > 0) return authorizedSuffixes\n\n  const guard = getTransportUrlGuard(transport)\n  if (guard === undefined) {\n    throw new B2PartnerAuthorizationError(messages.missingGuard)\n  }\n\n  const suffixes = guard.getAllowedSuffixes()\n  if (suffixes.length === 0) {\n    throw new B2PartnerAuthorizationError(messages.unlockedGuard)\n  }\n\n  return suffixes\n}\n\n/**\n * Validates a Partner-derived endpoint URL before a Partner token is sent to it.\n *\n * @param rawUrl - Endpoint URL from Partner authorization or cache.\n * @param fieldName - Authorize-response field being validated.\n * @param allowedSuffixes - Host suffix allow-list derived from the trusted realm.\n *\n * @returns The original URL when it is safe to use.\n *\n * @throws B2PartnerAuthorizationError if the URL is malformed or unsafe.\n *\n * @internal\n */\nexport function validatePartnerEndpointUrl(\n  rawUrl: string,\n  fieldName: PartnerEndpointUrlField,\n  allowedSuffixes: readonly string[],\n): string {\n  let url: URL\n  try {\n    url = new URL(rawUrl)\n  } catch {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response included malformed ${fieldName}`,\n    )\n  }\n\n  const host = url.hostname.toLowerCase()\n  const isAllowedLoopbackHttp =\n    url.protocol === 'http:' && isLoopbackHost(host) && hostAllowedBySuffixes(host, allowedSuffixes)\n\n  if (url.protocol !== 'https:' && !isAllowedLoopbackHttp) {\n    throw new B2PartnerAuthorizationError(`Partner authorize response ${fieldName} must use HTTPS`)\n  }\n  if (url.username !== '' || url.password !== '') {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response ${fieldName} must not include userinfo`,\n    )\n  }\n  if (url.search !== '' || url.hash !== '') {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response ${fieldName} must not include query or fragment`,\n    )\n  }\n\n  if (isAllowedLoopbackHttp) return rawUrl\n\n  const guard = new UrlGuard()\n  guard.setAllowedSuffixes(allowedSuffixes)\n  try {\n    guard.check(rawUrl)\n  } catch (err) {\n    throw new B2PartnerAuthorizationError(\n      err instanceof Error\n        ? `Partner authorize response included unsafe ${fieldName}: ${err.message}`\n        : `Partner authorize response included unsafe ${fieldName}`,\n    )\n  }\n\n  return rawUrl\n}\n\n/**\n * Appends query parameters using the SDK's B2 URL encoding semantics.\n *\n * @param url - Base URL without query string.\n * @param query - Query keys and string/number values to append.\n *\n * @returns URL with encoded query parameters, or the original URL for an empty query.\n *\n * @internal\n */\nexport function withQueryString(url: string, query: QueryParams): string {\n  // Match the storage raw client's encodeURIComponent query semantics: spaces\n  // are `%20`, not form-style `+`.\n  const queryString = Object.entries(query)\n    .map(([key, value]) => `${key}=${encodeURIComponent(String(value))}`)\n    .join('&')\n  return queryString.length === 0 ? url : `${url}?${queryString}`\n}\n\n/**\n * Forces non-idempotent mutation calls to opt out of automatic request replay.\n *\n * @param options - Caller-provided request options.\n *\n * @returns Request options with `retry.maxRetries` set to zero.\n *\n * @internal\n */\nexport function nonRetryingMutationRequestOptions(\n  options: MutationRequestOptions | undefined,\n): MutationRequestOptions {\n  return {\n    ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n    idempotent: false,\n    retry: { ...(options?.retry ?? {}), maxRetries: 0 },\n  }\n}\n"],"mappings":";;;;AA+BA,SAAS,eAAe,UAA2B;CACjD,MAAM,OAAO,SAAS,YAAY;CAClC,IAAI,SAAS,WAAW,SAAS,OAAO,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,OACE,MAAM,WAAW,KACjB,MAAM,OAAO,SACb,MAAM,OAAO,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG;AAEnE;AAEA,SAAS,sBAAsB,UAAkB,iBAA6C;CAC5F,OAAO,gBAAgB,MAAM,WAAW,kBAAA,yBAAyB,UAAU,MAAM,CAAC;AACpF;;;;;;;;;;;;;;AAeA,SAAgB,wBACd,WACA,oBACA,UACmB;CACnB,IAAI,mBAAmB,SAAS,GAAG,OAAO;CAE1C,MAAM,QAAQ,kBAAA,qBAAqB,SAAS;CAC5C,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,qBAAA,4BAA4B,SAAS,YAAY;CAG7D,MAAM,WAAW,MAAM,mBAAmB;CAC1C,IAAI,SAAS,WAAW,GACtB,MAAM,IAAI,qBAAA,4BAA4B,SAAS,aAAa;CAG9D,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAgB,2BACd,QACA,WACA,iBACQ;CACR,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,MAAM;CACtB,QAAQ;EACN,MAAM,IAAI,qBAAA,4BACR,iDAAiD,WACnD;CACF;CAEA,MAAM,OAAO,IAAI,SAAS,YAAY;CACtC,MAAM,wBACJ,IAAI,aAAa,WAAW,eAAe,IAAI,KAAK,sBAAsB,MAAM,eAAe;CAEjG,IAAI,IAAI,aAAa,YAAY,CAAC,uBAChC,MAAM,IAAI,qBAAA,4BAA4B,8BAA8B,UAAU,gBAAgB;CAEhG,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,IAC1C,MAAM,IAAI,qBAAA,4BACR,8BAA8B,UAAU,2BAC1C;CAEF,IAAI,IAAI,WAAW,MAAM,IAAI,SAAS,IACpC,MAAM,IAAI,qBAAA,4BACR,8BAA8B,UAAU,oCAC1C;CAGF,IAAI,uBAAuB,OAAO;CAElC,MAAM,QAAQ,IAAI,kBAAA,SAAS;CAC3B,MAAM,mBAAmB,eAAe;CACxC,IAAI;EACF,MAAM,MAAM,MAAM;CACpB,SAAS,KAAK;EACZ,MAAM,IAAI,qBAAA,4BACR,eAAe,QACX,8CAA8C,UAAU,IAAI,IAAI,YAChE,8CAA8C,WACpD;CACF;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,gBAAgB,KAAa,OAA4B;CAGvE,MAAM,cAAc,OAAO,QAAQ,KAAK,CAAC,CACtC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,mBAAmB,OAAO,KAAK,CAAC,GAAG,CAAC,CACpE,KAAK,GAAG;CACX,OAAO,YAAY,WAAW,IAAI,MAAM,GAAG,IAAI,GAAG;AACpD;;;;;;;;;;AAWA,SAAgB,kCACd,SACwB;CACxB,OAAO;EACL,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClE,YAAY;EACZ,OAAO;GAAE,GAAI,SAAS,SAAS,CAAC;GAAI,YAAY;EAAE;CACpD;AACF"}

package/dist/partner/endpoint-url.d.cts

@@ -19,6 +19,8 @@ export interface MutationRequestOptions {
     readonly signal?: AbortSignal;
     /** Per-request retry override. */
     readonly retry?: Partial<RetryOptions>;
+    /** Marks the request unsafe for transport-level retry or reauth replay. */
+    readonly idempotent?: false;
 }
 /**
  * Resolves endpoint host suffixes from fresh/cached Partner authorization or a locked transport guard.

package/dist/partner/endpoint-url.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-url.d.ts","sourceRoot":"","sources":["../../src/partner/endpoint-url.js"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAG/E,sFAAsF;AACtF,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG,cAAc,CAAA;AAErE,4FAA4F;AAC5F,MAAM,WAAW,6BAA6B;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;AACxC,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;AAE9D,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;CACvC;AAkBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,aAAa,EACxB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,QAAQ,EAAE,6BAA6B,GACtC,SAAS,MAAM,EAAE,CAcnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,uBAAuB,EAClC,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,MAAM,CA2CR;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAOvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,sBAAsB,GAAG,SAAS,GAC1C,sBAAsB,CAKxB"}
+{"version":3,"file":"endpoint-url.d.ts","sourceRoot":"","sources":["../../src/partner/endpoint-url.js"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAG/E,sFAAsF;AACtF,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG,cAAc,CAAA;AAErE,4FAA4F;AAC5F,MAAM,WAAW,6BAA6B;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;AACxC,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;AAE9D,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAA;CAC5B;AAkBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,aAAa,EACxB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,QAAQ,EAAE,6BAA6B,GACtC,SAAS,MAAM,EAAE,CAcnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,uBAAuB,EAClC,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,MAAM,CA2CR;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAOvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,sBAAsB,GAAG,SAAS,GAC1C,sBAAsB,CAMxB"}

package/dist/partner/endpoint-url.d.ts

@@ -19,6 +19,8 @@ export interface MutationRequestOptions {
     readonly signal?: AbortSignal;
     /** Per-request retry override. */
     readonly retry?: Partial<RetryOptions>;
+    /** Marks the request unsafe for transport-level retry or reauth replay. */
+    readonly idempotent?: false;
 }
 /**
  * Resolves endpoint host suffixes from fresh/cached Partner authorization or a locked transport guard.

package/dist/partner/endpoint-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-url.d.ts","sourceRoot":"","sources":["../../src/partner/endpoint-url.js"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAG/E,sFAAsF;AACtF,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG,cAAc,CAAA;AAErE,4FAA4F;AAC5F,MAAM,WAAW,6BAA6B;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;AACxC,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;AAE9D,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;CACvC;AAkBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,aAAa,EACxB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,QAAQ,EAAE,6BAA6B,GACtC,SAAS,MAAM,EAAE,CAcnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,uBAAuB,EAClC,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,MAAM,CA2CR;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAOvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,sBAAsB,GAAG,SAAS,GAC1C,sBAAsB,CAKxB"}
+{"version":3,"file":"endpoint-url.d.ts","sourceRoot":"","sources":["../../src/partner/endpoint-url.js"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAG/E,sFAAsF;AACtF,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG,cAAc,CAAA;AAErE,4FAA4F;AAC5F,MAAM,WAAW,6BAA6B;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;AACxC,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;AAE9D,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAA;CAC5B;AAkBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,aAAa,EACxB,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,QAAQ,EAAE,6BAA6B,GACtC,SAAS,MAAM,EAAE,CAcnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,uBAAuB,EAClC,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,MAAM,CA2CR;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAOvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,sBAAsB,GAAG,SAAS,GAC1C,sBAAsB,CAMxB"}

package/dist/partner/endpoint-url.js

@@ -93,6 +93,7 @@ function withQueryString(url, query) {
 function nonRetryingMutationRequestOptions(options) {
 	return {
 		...options?.signal !== void 0 ? { signal: options.signal } : {},
+		idempotent: false,
 		retry: {
 			...options?.retry ?? {},
 			maxRetries: 0

package/dist/partner/endpoint-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-url.js","names":[],"sources":["../../src/partner/endpoint-url.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { RetryOptions } from '../http/retry.ts'\nimport { getTransportUrlGuard, type HttpTransport } from '../http/transport.ts'\nimport { hostMatchesAllowedSuffix, UrlGuard } from '../http/url-guard.ts'\n\n/** Partner authorize endpoint URL field names that are validated before token use. */\nexport type PartnerEndpointUrlField = 'groupsApiUrl' | 'backupApiUrl'\n\n/** Message copy for resolving endpoint suffixes from an authorized or guarded transport. */\nexport interface EndpointAllowedSuffixMessages {\n  /** Error message when no validated suffixes and no URL guard are available. */\n  readonly missingGuard: string\n  /** Error message when a URL guard exists but has not been locked to suffixes. */\n  readonly unlockedGuard: string\n}\n\n/** Query-string scalar value supported by Partner and Backup endpoint helpers. */\nexport type QueryValue = string | number\n/** Query-string parameter map supported by Partner and Backup endpoint helpers. */\nexport type QueryParams = Readonly<Record<string, QueryValue>>\n\n/** Shared request options shape for non-idempotent Partner and Backup mutations. */\nexport interface MutationRequestOptions {\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n  /** Per-request retry override. */\n  readonly retry?: Partial<RetryOptions>\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase()\n  if (host === '[::1]' || host === '::1') return true\n\n  const parts = host.split('.')\n  return (\n    parts.length === 4 &&\n    parts[0] === '127' &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  )\n}\n\nfunction hostAllowedBySuffixes(hostname: string, allowedSuffixes: readonly string[]): boolean {\n  return allowedSuffixes.some((suffix) => hostMatchesAllowedSuffix(hostname, suffix))\n}\n\n/**\n * Resolves endpoint host suffixes from fresh/cached Partner authorization or a locked transport guard.\n *\n * @param transport - Transport whose URL guard may already be locked.\n * @param authorizedSuffixes - Suffixes derived from validated Partner authorization.\n * @param messages - Surface-specific failure messages.\n *\n * @returns The suffixes safe for credential-bearing endpoint requests.\n *\n * @throws B2PartnerAuthorizationError if no locked guard or authorized suffixes exist.\n *\n * @internal\n */\nexport function endpointAllowedSuffixes(\n  transport: HttpTransport,\n  authorizedSuffixes: readonly string[],\n  messages: EndpointAllowedSuffixMessages,\n): readonly string[] {\n  if (authorizedSuffixes.length > 0) return authorizedSuffixes\n\n  const guard = getTransportUrlGuard(transport)\n  if (guard === undefined) {\n    throw new B2PartnerAuthorizationError(messages.missingGuard)\n  }\n\n  const suffixes = guard.getAllowedSuffixes()\n  if (suffixes.length === 0) {\n    throw new B2PartnerAuthorizationError(messages.unlockedGuard)\n  }\n\n  return suffixes\n}\n\n/**\n * Validates a Partner-derived endpoint URL before a Partner token is sent to it.\n *\n * @param rawUrl - Endpoint URL from Partner authorization or cache.\n * @param fieldName - Authorize-response field being validated.\n * @param allowedSuffixes - Host suffix allow-list derived from the trusted realm.\n *\n * @returns The original URL when it is safe to use.\n *\n * @throws B2PartnerAuthorizationError if the URL is malformed or unsafe.\n *\n * @internal\n */\nexport function validatePartnerEndpointUrl(\n  rawUrl: string,\n  fieldName: PartnerEndpointUrlField,\n  allowedSuffixes: readonly string[],\n): string {\n  let url: URL\n  try {\n    url = new URL(rawUrl)\n  } catch {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response included malformed ${fieldName}`,\n    )\n  }\n\n  const host = url.hostname.toLowerCase()\n  const isAllowedLoopbackHttp =\n    url.protocol === 'http:' && isLoopbackHost(host) && hostAllowedBySuffixes(host, allowedSuffixes)\n\n  if (url.protocol !== 'https:' && !isAllowedLoopbackHttp) {\n    throw new B2PartnerAuthorizationError(`Partner authorize response ${fieldName} must use HTTPS`)\n  }\n  if (url.username !== '' || url.password !== '') {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response ${fieldName} must not include userinfo`,\n    )\n  }\n  if (url.search !== '' || url.hash !== '') {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response ${fieldName} must not include query or fragment`,\n    )\n  }\n\n  if (isAllowedLoopbackHttp) return rawUrl\n\n  const guard = new UrlGuard()\n  guard.setAllowedSuffixes(allowedSuffixes)\n  try {\n    guard.check(rawUrl)\n  } catch (err) {\n    throw new B2PartnerAuthorizationError(\n      err instanceof Error\n        ? `Partner authorize response included unsafe ${fieldName}: ${err.message}`\n        : `Partner authorize response included unsafe ${fieldName}`,\n    )\n  }\n\n  return rawUrl\n}\n\n/**\n * Appends query parameters using the SDK's B2 URL encoding semantics.\n *\n * @param url - Base URL without query string.\n * @param query - Query keys and string/number values to append.\n *\n * @returns URL with encoded query parameters, or the original URL for an empty query.\n *\n * @internal\n */\nexport function withQueryString(url: string, query: QueryParams): string {\n  // Match the storage raw client's encodeURIComponent query semantics: spaces\n  // are `%20`, not form-style `+`.\n  const queryString = Object.entries(query)\n    .map(([key, value]) => `${key}=${encodeURIComponent(String(value))}`)\n    .join('&')\n  return queryString.length === 0 ? url : `${url}?${queryString}`\n}\n\n/**\n * Forces non-idempotent mutation calls to opt out of automatic request replay.\n *\n * @param options - Caller-provided request options.\n *\n * @returns Request options with `retry.maxRetries` set to zero.\n *\n * @internal\n */\nexport function nonRetryingMutationRequestOptions(\n  options: MutationRequestOptions | undefined,\n): MutationRequestOptions {\n  return {\n    ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n    retry: { ...(options?.retry ?? {}), maxRetries: 0 },\n  }\n}\n"],"mappings":";;;;AA6BA,SAAS,eAAe,UAA2B;CACjD,MAAM,OAAO,SAAS,YAAY;CAClC,IAAI,SAAS,WAAW,SAAS,OAAO,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,OACE,MAAM,WAAW,KACjB,MAAM,OAAO,SACb,MAAM,OAAO,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG;AAEnE;AAEA,SAAS,sBAAsB,UAAkB,iBAA6C;CAC5F,OAAO,gBAAgB,MAAM,WAAW,yBAAyB,UAAU,MAAM,CAAC;AACpF;;;;;;;;;;;;;;AAeA,SAAgB,wBACd,WACA,oBACA,UACmB;CACnB,IAAI,mBAAmB,SAAS,GAAG,OAAO;CAE1C,MAAM,QAAQ,qBAAqB,SAAS;CAC5C,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,4BAA4B,SAAS,YAAY;CAG7D,MAAM,WAAW,MAAM,mBAAmB;CAC1C,IAAI,SAAS,WAAW,GACtB,MAAM,IAAI,4BAA4B,SAAS,aAAa;CAG9D,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAgB,2BACd,QACA,WACA,iBACQ;CACR,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,MAAM;CACtB,QAAQ;EACN,MAAM,IAAI,4BACR,iDAAiD,WACnD;CACF;CAEA,MAAM,OAAO,IAAI,SAAS,YAAY;CACtC,MAAM,wBACJ,IAAI,aAAa,WAAW,eAAe,IAAI,KAAK,sBAAsB,MAAM,eAAe;CAEjG,IAAI,IAAI,aAAa,YAAY,CAAC,uBAChC,MAAM,IAAI,4BAA4B,8BAA8B,UAAU,gBAAgB;CAEhG,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,IAC1C,MAAM,IAAI,4BACR,8BAA8B,UAAU,2BAC1C;CAEF,IAAI,IAAI,WAAW,MAAM,IAAI,SAAS,IACpC,MAAM,IAAI,4BACR,8BAA8B,UAAU,oCAC1C;CAGF,IAAI,uBAAuB,OAAO;CAElC,MAAM,QAAQ,IAAI,SAAS;CAC3B,MAAM,mBAAmB,eAAe;CACxC,IAAI;EACF,MAAM,MAAM,MAAM;CACpB,SAAS,KAAK;EACZ,MAAM,IAAI,4BACR,eAAe,QACX,8CAA8C,UAAU,IAAI,IAAI,YAChE,8CAA8C,WACpD;CACF;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,gBAAgB,KAAa,OAA4B;CAGvE,MAAM,cAAc,OAAO,QAAQ,KAAK,CAAC,CACtC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,mBAAmB,OAAO,KAAK,CAAC,GAAG,CAAC,CACpE,KAAK,GAAG;CACX,OAAO,YAAY,WAAW,IAAI,MAAM,GAAG,IAAI,GAAG;AACpD;;;;;;;;;;AAWA,SAAgB,kCACd,SACwB;CACxB,OAAO;EACL,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClE,OAAO;GAAE,GAAI,SAAS,SAAS,CAAC;GAAI,YAAY;EAAE;CACpD;AACF"}
+{"version":3,"file":"endpoint-url.js","names":[],"sources":["../../src/partner/endpoint-url.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { RetryOptions } from '../http/retry.ts'\nimport { getTransportUrlGuard, type HttpTransport } from '../http/transport.ts'\nimport { hostMatchesAllowedSuffix, UrlGuard } from '../http/url-guard.ts'\n\n/** Partner authorize endpoint URL field names that are validated before token use. */\nexport type PartnerEndpointUrlField = 'groupsApiUrl' | 'backupApiUrl'\n\n/** Message copy for resolving endpoint suffixes from an authorized or guarded transport. */\nexport interface EndpointAllowedSuffixMessages {\n  /** Error message when no validated suffixes and no URL guard are available. */\n  readonly missingGuard: string\n  /** Error message when a URL guard exists but has not been locked to suffixes. */\n  readonly unlockedGuard: string\n}\n\n/** Query-string scalar value supported by Partner and Backup endpoint helpers. */\nexport type QueryValue = string | number\n/** Query-string parameter map supported by Partner and Backup endpoint helpers. */\nexport type QueryParams = Readonly<Record<string, QueryValue>>\n\n/** Shared request options shape for non-idempotent Partner and Backup mutations. */\nexport interface MutationRequestOptions {\n  /** Abort signal for cancelling the request. */\n  readonly signal?: AbortSignal\n  /** Per-request retry override. */\n  readonly retry?: Partial<RetryOptions>\n  /** Marks the request unsafe for transport-level retry or reauth replay. */\n  readonly idempotent?: false\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase()\n  if (host === '[::1]' || host === '::1') return true\n\n  const parts = host.split('.')\n  return (\n    parts.length === 4 &&\n    parts[0] === '127' &&\n    parts.every((part) => /^\\d+$/.test(part) && Number(part) <= 255)\n  )\n}\n\nfunction hostAllowedBySuffixes(hostname: string, allowedSuffixes: readonly string[]): boolean {\n  return allowedSuffixes.some((suffix) => hostMatchesAllowedSuffix(hostname, suffix))\n}\n\n/**\n * Resolves endpoint host suffixes from fresh/cached Partner authorization or a locked transport guard.\n *\n * @param transport - Transport whose URL guard may already be locked.\n * @param authorizedSuffixes - Suffixes derived from validated Partner authorization.\n * @param messages - Surface-specific failure messages.\n *\n * @returns The suffixes safe for credential-bearing endpoint requests.\n *\n * @throws B2PartnerAuthorizationError if no locked guard or authorized suffixes exist.\n *\n * @internal\n */\nexport function endpointAllowedSuffixes(\n  transport: HttpTransport,\n  authorizedSuffixes: readonly string[],\n  messages: EndpointAllowedSuffixMessages,\n): readonly string[] {\n  if (authorizedSuffixes.length > 0) return authorizedSuffixes\n\n  const guard = getTransportUrlGuard(transport)\n  if (guard === undefined) {\n    throw new B2PartnerAuthorizationError(messages.missingGuard)\n  }\n\n  const suffixes = guard.getAllowedSuffixes()\n  if (suffixes.length === 0) {\n    throw new B2PartnerAuthorizationError(messages.unlockedGuard)\n  }\n\n  return suffixes\n}\n\n/**\n * Validates a Partner-derived endpoint URL before a Partner token is sent to it.\n *\n * @param rawUrl - Endpoint URL from Partner authorization or cache.\n * @param fieldName - Authorize-response field being validated.\n * @param allowedSuffixes - Host suffix allow-list derived from the trusted realm.\n *\n * @returns The original URL when it is safe to use.\n *\n * @throws B2PartnerAuthorizationError if the URL is malformed or unsafe.\n *\n * @internal\n */\nexport function validatePartnerEndpointUrl(\n  rawUrl: string,\n  fieldName: PartnerEndpointUrlField,\n  allowedSuffixes: readonly string[],\n): string {\n  let url: URL\n  try {\n    url = new URL(rawUrl)\n  } catch {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response included malformed ${fieldName}`,\n    )\n  }\n\n  const host = url.hostname.toLowerCase()\n  const isAllowedLoopbackHttp =\n    url.protocol === 'http:' && isLoopbackHost(host) && hostAllowedBySuffixes(host, allowedSuffixes)\n\n  if (url.protocol !== 'https:' && !isAllowedLoopbackHttp) {\n    throw new B2PartnerAuthorizationError(`Partner authorize response ${fieldName} must use HTTPS`)\n  }\n  if (url.username !== '' || url.password !== '') {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response ${fieldName} must not include userinfo`,\n    )\n  }\n  if (url.search !== '' || url.hash !== '') {\n    throw new B2PartnerAuthorizationError(\n      `Partner authorize response ${fieldName} must not include query or fragment`,\n    )\n  }\n\n  if (isAllowedLoopbackHttp) return rawUrl\n\n  const guard = new UrlGuard()\n  guard.setAllowedSuffixes(allowedSuffixes)\n  try {\n    guard.check(rawUrl)\n  } catch (err) {\n    throw new B2PartnerAuthorizationError(\n      err instanceof Error\n        ? `Partner authorize response included unsafe ${fieldName}: ${err.message}`\n        : `Partner authorize response included unsafe ${fieldName}`,\n    )\n  }\n\n  return rawUrl\n}\n\n/**\n * Appends query parameters using the SDK's B2 URL encoding semantics.\n *\n * @param url - Base URL without query string.\n * @param query - Query keys and string/number values to append.\n *\n * @returns URL with encoded query parameters, or the original URL for an empty query.\n *\n * @internal\n */\nexport function withQueryString(url: string, query: QueryParams): string {\n  // Match the storage raw client's encodeURIComponent query semantics: spaces\n  // are `%20`, not form-style `+`.\n  const queryString = Object.entries(query)\n    .map(([key, value]) => `${key}=${encodeURIComponent(String(value))}`)\n    .join('&')\n  return queryString.length === 0 ? url : `${url}?${queryString}`\n}\n\n/**\n * Forces non-idempotent mutation calls to opt out of automatic request replay.\n *\n * @param options - Caller-provided request options.\n *\n * @returns Request options with `retry.maxRetries` set to zero.\n *\n * @internal\n */\nexport function nonRetryingMutationRequestOptions(\n  options: MutationRequestOptions | undefined,\n): MutationRequestOptions {\n  return {\n    ...(options?.signal !== undefined ? { signal: options.signal } : {}),\n    idempotent: false,\n    retry: { ...(options?.retry ?? {}), maxRetries: 0 },\n  }\n}\n"],"mappings":";;;;AA+BA,SAAS,eAAe,UAA2B;CACjD,MAAM,OAAO,SAAS,YAAY;CAClC,IAAI,SAAS,WAAW,SAAS,OAAO,OAAO;CAE/C,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,OACE,MAAM,WAAW,KACjB,MAAM,OAAO,SACb,MAAM,OAAO,SAAS,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG;AAEnE;AAEA,SAAS,sBAAsB,UAAkB,iBAA6C;CAC5F,OAAO,gBAAgB,MAAM,WAAW,yBAAyB,UAAU,MAAM,CAAC;AACpF;;;;;;;;;;;;;;AAeA,SAAgB,wBACd,WACA,oBACA,UACmB;CACnB,IAAI,mBAAmB,SAAS,GAAG,OAAO;CAE1C,MAAM,QAAQ,qBAAqB,SAAS;CAC5C,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,4BAA4B,SAAS,YAAY;CAG7D,MAAM,WAAW,MAAM,mBAAmB;CAC1C,IAAI,SAAS,WAAW,GACtB,MAAM,IAAI,4BAA4B,SAAS,aAAa;CAG9D,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAgB,2BACd,QACA,WACA,iBACQ;CACR,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,MAAM;CACtB,QAAQ;EACN,MAAM,IAAI,4BACR,iDAAiD,WACnD;CACF;CAEA,MAAM,OAAO,IAAI,SAAS,YAAY;CACtC,MAAM,wBACJ,IAAI,aAAa,WAAW,eAAe,IAAI,KAAK,sBAAsB,MAAM,eAAe;CAEjG,IAAI,IAAI,aAAa,YAAY,CAAC,uBAChC,MAAM,IAAI,4BAA4B,8BAA8B,UAAU,gBAAgB;CAEhG,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,IAC1C,MAAM,IAAI,4BACR,8BAA8B,UAAU,2BAC1C;CAEF,IAAI,IAAI,WAAW,MAAM,IAAI,SAAS,IACpC,MAAM,IAAI,4BACR,8BAA8B,UAAU,oCAC1C;CAGF,IAAI,uBAAuB,OAAO;CAElC,MAAM,QAAQ,IAAI,SAAS;CAC3B,MAAM,mBAAmB,eAAe;CACxC,IAAI;EACF,MAAM,MAAM,MAAM;CACpB,SAAS,KAAK;EACZ,MAAM,IAAI,4BACR,eAAe,QACX,8CAA8C,UAAU,IAAI,IAAI,YAChE,8CAA8C,WACpD;CACF;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,gBAAgB,KAAa,OAA4B;CAGvE,MAAM,cAAc,OAAO,QAAQ,KAAK,CAAC,CACtC,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,mBAAmB,OAAO,KAAK,CAAC,GAAG,CAAC,CACpE,KAAK,GAAG;CACX,OAAO,YAAY,WAAW,IAAI,MAAM,GAAG,IAAI,GAAG;AACpD;;;;;;;;;;AAWA,SAAgB,kCACd,SACwB;CACxB,OAAO;EACL,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClE,YAAY;EACZ,OAAO;GAAE,GAAI,SAAS,SAAS,CAAC;GAAI,YAAY;EAAE;CACpD;AACF"}

package/dist/partner/in-memory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"in-memory.cjs","names":["#auth"],"sources":["../../src/partner/in-memory.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { AccountId, PartnerToken } from '../types/ids.ts'\nimport type { PartnerAuthorizeResponse, PartnerCapability } from '../types/partner.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { clonePartnerAuthorizeResponse } from './auth-clone.ts'\nimport {\n  PARTNER_TOKEN_REDACTED,\n  partnerAuthorizeResponseToRedactedJson,\n  type RedactedPartnerAuthorizeResponseJson,\n  redactPartnerAuthorizeResponse,\n} from './redaction.ts'\n\n/** Redacted JSON diagnostic shape emitted by {@link InMemoryPartnerAccountInfo.toJSON}. */\nexport interface InMemoryPartnerAccountInfoJson {\n  /** Redacted cached authorization state, or null before authorization. */\n  readonly auth: RedactedPartnerAuthorizeResponseJson | null\n}\n\nfunction clonePartnerAuth(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse {\n  return redactPartnerAuthorizeResponse(clonePartnerAuthorizeResponse(auth))\n}\n\n/**\n * In-memory implementation of {@link PartnerAccountInfo}.\n * Suitable for short-lived processes or tests; state is lost when the process exits.\n */\nexport class InMemoryPartnerAccountInfo implements PartnerAccountInfo {\n  /** Cached Partner authorization response, or null before authorizePartner() is called. */\n  #auth: PartnerAuthorizeResponse | null = null\n\n  /**\n   * Store a fresh Partner authorization response, replacing any previous state.\n   *\n   * @param auth - The Partner authorize response to store.\n   */\n  setAuth(auth: PartnerAuthorizeResponse): void {\n    this.#auth = clonePartnerAuth(auth)\n  }\n\n  /**\n   * Return the current Partner authorization response, or null if not authorized.\n   *\n   * @returns The cached Partner authorization response, or null if not yet authorized.\n   */\n  getAuth(): PartnerAuthorizeResponse | null {\n    return this.#auth\n  }\n\n  /** Discard all cached Partner authorization state. */\n  clear(): void {\n    this.#auth = null\n  }\n\n  /**\n   * Current Partner/Backup authorization token.\n   *\n   * @returns The current Partner token.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getPartnerToken(): PartnerToken {\n    return this.requireAuth().authorizationToken\n  }\n\n  /**\n   * Base URL for Partner API calls.\n   *\n   * @returns The base URL for Partner API calls.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getGroupsApiUrl(): string | null {\n    return this.requireAuth().apiInfo.groupsApi?.groupsApiUrl ?? null\n  }\n\n  /**\n   * Base URL for Computer Backup API calls, or null when the suite is unavailable.\n   *\n   * @returns The Computer Backup API URL, or null.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getBackupApiUrl(): string | null {\n    return this.requireAuth().backupApiUrl ?? null\n  }\n\n  /**\n   * The authorized partner administrator account ID.\n   *\n   * @returns The authorized account identifier.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getAccountId(): AccountId {\n    return this.requireAuth().accountId\n  }\n\n  /**\n   * Capabilities granted for Partner API calls.\n   *\n   * @returns The Partner API capabilities.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getGroupsCapabilities(): readonly PartnerCapability[] | null {\n    return this.requireAuth().apiInfo.groupsApi?.capabilities ?? null\n  }\n\n  /**\n   * Capabilities granted for Computer Backup API calls, or null when the suite is unavailable.\n   *\n   * @returns The Computer Backup API capabilities, or null.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getBackupCapabilities(): readonly PartnerCapability[] | null {\n    return this.requireAuth().backupCapabilities ?? null\n  }\n\n  /**\n   * Hides the Partner token from `JSON.stringify(accountInfo)`.\n   *\n   * @returns Redacted Partner auth state, or null when not authorized.\n   */\n  toJSON(): InMemoryPartnerAccountInfoJson {\n    return {\n      auth: this.#auth === null ? null : partnerAuthorizeResponseToRedactedJson(this.#auth),\n    }\n  }\n\n  /**\n   * Hides the Partner token from default stringification.\n   *\n   * @returns A short opaque label for this account info store.\n   */\n  toString(): string {\n    return this.#auth === null\n      ? '[InMemoryPartnerAccountInfo unauthorized]'\n      : `[InMemoryPartnerAccountInfo ${PARTNER_TOKEN_REDACTED}]`\n  }\n\n  /**\n   * Hides the Partner token from Node's `util.inspect`.\n   *\n   * @returns A short opaque label for this account info store.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n\n  /**\n   * Retrieve the cached auth response or throw if not yet authorized.\n   *\n   * @returns The cached authorization response.\n   *\n   * @throws B2PartnerAuthorizationError if authorizePartner() has not been called.\n   */\n  private requireAuth(): PartnerAuthorizeResponse {\n    if (!this.#auth) {\n      throw new B2PartnerAuthorizationError('Not authorized. Call authorizePartner() first.')\n    }\n    return this.#auth\n  }\n}\n"],"mappings":";;;;;AAkBA,SAAS,iBAAiB,MAA0D;CAClF,OAAO,kBAAA,+BAA+B,mBAAA,8BAA8B,IAAI,CAAC;AAC3E;;;;;AAMA,IAAa,6BAAb,MAAsE;;CAEpE,QAAyC;;;;;;CAOzC,QAAQ,MAAsC;EAC5C,KAAKA,QAAQ,iBAAiB,IAAI;CACpC;;;;;;CAOA,UAA2C;EACzC,OAAO,KAAKA;CACd;;CAGA,QAAc;EACZ,KAAKA,QAAQ;CACf;;;;;;;;CASA,kBAAgC;EAC9B,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,kBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW,gBAAgB;CAC/D;;;;;;;;CASA,kBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,gBAAgB;CAC5C;;;;;;;;CASA,eAA0B;EACxB,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,wBAA6D;EAC3D,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW,gBAAgB;CAC/D;;;;;;;;CASA,wBAA6D;EAC3D,OAAO,KAAK,YAAY,CAAC,CAAC,sBAAsB;CAClD;;;;;;CAOA,SAAyC;EACvC,OAAO,EACL,MAAM,KAAKA,UAAU,OAAO,OAAO,kBAAA,uCAAuC,KAAKA,KAAK,EACtF;CACF;;;;;;CAOA,WAAmB;EACjB,OAAO,KAAKA,UAAU,OAClB,8CACA,+BAA+B,+BAAA,uBAAuB;CAC5D;;;;;;CAOA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO,KAAK,SAAS;CACvB;;;;;;;;CASA,cAAgD;EAC9C,IAAI,CAAC,KAAKA,OACR,MAAM,IAAI,qBAAA,4BAA4B,gDAAgD;EAExF,OAAO,KAAKA;CACd;AACF"}
+{"version":3,"file":"in-memory.cjs","names":[],"sources":["../../src/partner/in-memory.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { AccountId, PartnerToken } from '../types/ids.ts'\nimport type { PartnerAuthorizeResponse, PartnerCapability } from '../types/partner.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { clonePartnerAuthorizeResponse } from './auth-clone.ts'\nimport {\n  PARTNER_TOKEN_REDACTED,\n  partnerAuthorizeResponseToRedactedJson,\n  type RedactedPartnerAuthorizeResponseJson,\n  redactPartnerAuthorizeResponse,\n} from './redaction.ts'\n\n/** Redacted JSON diagnostic shape emitted by {@link InMemoryPartnerAccountInfo.toJSON}. */\nexport interface InMemoryPartnerAccountInfoJson {\n  /** Redacted cached authorization state, or null before authorization. */\n  readonly auth: RedactedPartnerAuthorizeResponseJson | null\n}\n\nfunction clonePartnerAuth(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse {\n  return redactPartnerAuthorizeResponse(clonePartnerAuthorizeResponse(auth))\n}\n\n/**\n * In-memory implementation of {@link PartnerAccountInfo}.\n * Suitable for short-lived processes or tests; state is lost when the process exits.\n */\nexport class InMemoryPartnerAccountInfo implements PartnerAccountInfo {\n  /** Cached Partner authorization response, or null before authorizePartner() is called. */\n  #auth: PartnerAuthorizeResponse | null = null\n\n  /**\n   * Store a fresh Partner authorization response, replacing any previous state.\n   *\n   * @param auth - The Partner authorize response to store.\n   */\n  setAuth(auth: PartnerAuthorizeResponse): void {\n    this.#auth = clonePartnerAuth(auth)\n  }\n\n  /**\n   * Return the current Partner authorization response, or null if not authorized.\n   *\n   * @returns The cached Partner authorization response, or null if not yet authorized.\n   */\n  getAuth(): PartnerAuthorizeResponse | null {\n    return this.#auth\n  }\n\n  /** Discard all cached Partner authorization state. */\n  clear(): void {\n    this.#auth = null\n  }\n\n  /**\n   * Current Partner/Backup authorization token.\n   *\n   * @returns The current Partner token.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getPartnerToken(): PartnerToken {\n    return this.requireAuth().authorizationToken\n  }\n\n  /**\n   * Base URL for Partner API calls.\n   *\n   * @returns The base URL for Partner API calls.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getGroupsApiUrl(): string | null {\n    return this.requireAuth().apiInfo.groupsApi?.groupsApiUrl ?? null\n  }\n\n  /**\n   * Base URL for Computer Backup API calls, or null when the suite is unavailable.\n   *\n   * @returns The Computer Backup API URL, or null.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getBackupApiUrl(): string | null {\n    return this.requireAuth().backupApiUrl ?? null\n  }\n\n  /**\n   * The authorized partner administrator account ID.\n   *\n   * @returns The authorized account identifier.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getAccountId(): AccountId {\n    return this.requireAuth().accountId\n  }\n\n  /**\n   * Capabilities granted for Partner API calls.\n   *\n   * @returns The Partner API capabilities.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getGroupsCapabilities(): readonly PartnerCapability[] | null {\n    return this.requireAuth().apiInfo.groupsApi?.capabilities ?? null\n  }\n\n  /**\n   * Capabilities granted for Computer Backup API calls, or null when the suite is unavailable.\n   *\n   * @returns The Computer Backup API capabilities, or null.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getBackupCapabilities(): readonly PartnerCapability[] | null {\n    return this.requireAuth().backupCapabilities ?? null\n  }\n\n  /**\n   * Hides the Partner token from `JSON.stringify(accountInfo)`.\n   *\n   * @returns Redacted Partner auth state, or null when not authorized.\n   */\n  toJSON(): InMemoryPartnerAccountInfoJson {\n    return {\n      auth: this.#auth === null ? null : partnerAuthorizeResponseToRedactedJson(this.#auth),\n    }\n  }\n\n  /**\n   * Hides the Partner token from default stringification.\n   *\n   * @returns A short opaque label for this account info store.\n   */\n  toString(): string {\n    return this.#auth === null\n      ? '[InMemoryPartnerAccountInfo unauthorized]'\n      : `[InMemoryPartnerAccountInfo ${PARTNER_TOKEN_REDACTED}]`\n  }\n\n  /**\n   * Hides the Partner token from Node's `util.inspect`.\n   *\n   * @returns A short opaque label for this account info store.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n\n  /**\n   * Retrieve the cached auth response or throw if not yet authorized.\n   *\n   * @returns The cached authorization response.\n   *\n   * @throws B2PartnerAuthorizationError if authorizePartner() has not been called.\n   */\n  private requireAuth(): PartnerAuthorizeResponse {\n    if (!this.#auth) {\n      throw new B2PartnerAuthorizationError('Not authorized. Call authorizePartner() first.')\n    }\n    return this.#auth\n  }\n}\n"],"mappings":";;;;;AAkBA,SAAS,iBAAiB,MAA0D;CAClF,OAAO,kBAAA,+BAA+B,mBAAA,8BAA8B,IAAI,CAAC;AAC3E;;;;;AAMA,IAAa,6BAAb,MAAsE;;CAEpE,QAAyC;;;;;;CAOzC,QAAQ,MAAsC;EAC5C,KAAK,QAAQ,iBAAiB,IAAI;CACpC;;;;;;CAOA,UAA2C;EACzC,OAAO,KAAK;CACd;;CAGA,QAAc;EACZ,KAAK,QAAQ;CACf;;;;;;;;CASA,kBAAgC;EAC9B,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,kBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW,gBAAgB;CAC/D;;;;;;;;CASA,kBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,gBAAgB;CAC5C;;;;;;;;CASA,eAA0B;EACxB,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,wBAA6D;EAC3D,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW,gBAAgB;CAC/D;;;;;;;;CASA,wBAA6D;EAC3D,OAAO,KAAK,YAAY,CAAC,CAAC,sBAAsB;CAClD;;;;;;CAOA,SAAyC;EACvC,OAAO,EACL,MAAM,KAAK,UAAU,OAAO,OAAO,kBAAA,uCAAuC,KAAK,KAAK,EACtF;CACF;;;;;;CAOA,WAAmB;EACjB,OAAO,KAAK,UAAU,OAClB,8CACA,+BAA+B,+BAAA,uBAAuB;CAC5D;;;;;;CAOA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO,KAAK,SAAS;CACvB;;;;;;;;CASA,cAAgD;EAC9C,IAAI,CAAC,KAAK,OACR,MAAM,IAAI,qBAAA,4BAA4B,gDAAgD;EAExF,OAAO,KAAK;CACd;AACF"}

package/dist/partner/in-memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"in-memory.js","names":["#auth"],"sources":["../../src/partner/in-memory.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { AccountId, PartnerToken } from '../types/ids.ts'\nimport type { PartnerAuthorizeResponse, PartnerCapability } from '../types/partner.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { clonePartnerAuthorizeResponse } from './auth-clone.ts'\nimport {\n  PARTNER_TOKEN_REDACTED,\n  partnerAuthorizeResponseToRedactedJson,\n  type RedactedPartnerAuthorizeResponseJson,\n  redactPartnerAuthorizeResponse,\n} from './redaction.ts'\n\n/** Redacted JSON diagnostic shape emitted by {@link InMemoryPartnerAccountInfo.toJSON}. */\nexport interface InMemoryPartnerAccountInfoJson {\n  /** Redacted cached authorization state, or null before authorization. */\n  readonly auth: RedactedPartnerAuthorizeResponseJson | null\n}\n\nfunction clonePartnerAuth(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse {\n  return redactPartnerAuthorizeResponse(clonePartnerAuthorizeResponse(auth))\n}\n\n/**\n * In-memory implementation of {@link PartnerAccountInfo}.\n * Suitable for short-lived processes or tests; state is lost when the process exits.\n */\nexport class InMemoryPartnerAccountInfo implements PartnerAccountInfo {\n  /** Cached Partner authorization response, or null before authorizePartner() is called. */\n  #auth: PartnerAuthorizeResponse | null = null\n\n  /**\n   * Store a fresh Partner authorization response, replacing any previous state.\n   *\n   * @param auth - The Partner authorize response to store.\n   */\n  setAuth(auth: PartnerAuthorizeResponse): void {\n    this.#auth = clonePartnerAuth(auth)\n  }\n\n  /**\n   * Return the current Partner authorization response, or null if not authorized.\n   *\n   * @returns The cached Partner authorization response, or null if not yet authorized.\n   */\n  getAuth(): PartnerAuthorizeResponse | null {\n    return this.#auth\n  }\n\n  /** Discard all cached Partner authorization state. */\n  clear(): void {\n    this.#auth = null\n  }\n\n  /**\n   * Current Partner/Backup authorization token.\n   *\n   * @returns The current Partner token.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getPartnerToken(): PartnerToken {\n    return this.requireAuth().authorizationToken\n  }\n\n  /**\n   * Base URL for Partner API calls.\n   *\n   * @returns The base URL for Partner API calls.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getGroupsApiUrl(): string | null {\n    return this.requireAuth().apiInfo.groupsApi?.groupsApiUrl ?? null\n  }\n\n  /**\n   * Base URL for Computer Backup API calls, or null when the suite is unavailable.\n   *\n   * @returns The Computer Backup API URL, or null.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getBackupApiUrl(): string | null {\n    return this.requireAuth().backupApiUrl ?? null\n  }\n\n  /**\n   * The authorized partner administrator account ID.\n   *\n   * @returns The authorized account identifier.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getAccountId(): AccountId {\n    return this.requireAuth().accountId\n  }\n\n  /**\n   * Capabilities granted for Partner API calls.\n   *\n   * @returns The Partner API capabilities.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getGroupsCapabilities(): readonly PartnerCapability[] | null {\n    return this.requireAuth().apiInfo.groupsApi?.capabilities ?? null\n  }\n\n  /**\n   * Capabilities granted for Computer Backup API calls, or null when the suite is unavailable.\n   *\n   * @returns The Computer Backup API capabilities, or null.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getBackupCapabilities(): readonly PartnerCapability[] | null {\n    return this.requireAuth().backupCapabilities ?? null\n  }\n\n  /**\n   * Hides the Partner token from `JSON.stringify(accountInfo)`.\n   *\n   * @returns Redacted Partner auth state, or null when not authorized.\n   */\n  toJSON(): InMemoryPartnerAccountInfoJson {\n    return {\n      auth: this.#auth === null ? null : partnerAuthorizeResponseToRedactedJson(this.#auth),\n    }\n  }\n\n  /**\n   * Hides the Partner token from default stringification.\n   *\n   * @returns A short opaque label for this account info store.\n   */\n  toString(): string {\n    return this.#auth === null\n      ? '[InMemoryPartnerAccountInfo unauthorized]'\n      : `[InMemoryPartnerAccountInfo ${PARTNER_TOKEN_REDACTED}]`\n  }\n\n  /**\n   * Hides the Partner token from Node's `util.inspect`.\n   *\n   * @returns A short opaque label for this account info store.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n\n  /**\n   * Retrieve the cached auth response or throw if not yet authorized.\n   *\n   * @returns The cached authorization response.\n   *\n   * @throws B2PartnerAuthorizationError if authorizePartner() has not been called.\n   */\n  private requireAuth(): PartnerAuthorizeResponse {\n    if (!this.#auth) {\n      throw new B2PartnerAuthorizationError('Not authorized. Call authorizePartner() first.')\n    }\n    return this.#auth\n  }\n}\n"],"mappings":";;;;;AAkBA,SAAS,iBAAiB,MAA0D;CAClF,OAAO,+BAA+B,8BAA8B,IAAI,CAAC;AAC3E;;;;;AAMA,IAAa,6BAAb,MAAsE;;CAEpE,QAAyC;;;;;;CAOzC,QAAQ,MAAsC;EAC5C,KAAKA,QAAQ,iBAAiB,IAAI;CACpC;;;;;;CAOA,UAA2C;EACzC,OAAO,KAAKA;CACd;;CAGA,QAAc;EACZ,KAAKA,QAAQ;CACf;;;;;;;;CASA,kBAAgC;EAC9B,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,kBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW,gBAAgB;CAC/D;;;;;;;;CASA,kBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,gBAAgB;CAC5C;;;;;;;;CASA,eAA0B;EACxB,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,wBAA6D;EAC3D,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW,gBAAgB;CAC/D;;;;;;;;CASA,wBAA6D;EAC3D,OAAO,KAAK,YAAY,CAAC,CAAC,sBAAsB;CAClD;;;;;;CAOA,SAAyC;EACvC,OAAO,EACL,MAAM,KAAKA,UAAU,OAAO,OAAO,uCAAuC,KAAKA,KAAK,EACtF;CACF;;;;;;CAOA,WAAmB;EACjB,OAAO,KAAKA,UAAU,OAClB,8CACA,+BAA+B,uBAAuB;CAC5D;;;;;;CAOA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO,KAAK,SAAS;CACvB;;;;;;;;CASA,cAAgD;EAC9C,IAAI,CAAC,KAAKA,OACR,MAAM,IAAI,4BAA4B,gDAAgD;EAExF,OAAO,KAAKA;CACd;AACF"}
+{"version":3,"file":"in-memory.js","names":[],"sources":["../../src/partner/in-memory.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type { AccountId, PartnerToken } from '../types/ids.ts'\nimport type { PartnerAuthorizeResponse, PartnerCapability } from '../types/partner.ts'\nimport type { PartnerAccountInfo } from './account-info.ts'\nimport { clonePartnerAuthorizeResponse } from './auth-clone.ts'\nimport {\n  PARTNER_TOKEN_REDACTED,\n  partnerAuthorizeResponseToRedactedJson,\n  type RedactedPartnerAuthorizeResponseJson,\n  redactPartnerAuthorizeResponse,\n} from './redaction.ts'\n\n/** Redacted JSON diagnostic shape emitted by {@link InMemoryPartnerAccountInfo.toJSON}. */\nexport interface InMemoryPartnerAccountInfoJson {\n  /** Redacted cached authorization state, or null before authorization. */\n  readonly auth: RedactedPartnerAuthorizeResponseJson | null\n}\n\nfunction clonePartnerAuth(auth: PartnerAuthorizeResponse): PartnerAuthorizeResponse {\n  return redactPartnerAuthorizeResponse(clonePartnerAuthorizeResponse(auth))\n}\n\n/**\n * In-memory implementation of {@link PartnerAccountInfo}.\n * Suitable for short-lived processes or tests; state is lost when the process exits.\n */\nexport class InMemoryPartnerAccountInfo implements PartnerAccountInfo {\n  /** Cached Partner authorization response, or null before authorizePartner() is called. */\n  #auth: PartnerAuthorizeResponse | null = null\n\n  /**\n   * Store a fresh Partner authorization response, replacing any previous state.\n   *\n   * @param auth - The Partner authorize response to store.\n   */\n  setAuth(auth: PartnerAuthorizeResponse): void {\n    this.#auth = clonePartnerAuth(auth)\n  }\n\n  /**\n   * Return the current Partner authorization response, or null if not authorized.\n   *\n   * @returns The cached Partner authorization response, or null if not yet authorized.\n   */\n  getAuth(): PartnerAuthorizeResponse | null {\n    return this.#auth\n  }\n\n  /** Discard all cached Partner authorization state. */\n  clear(): void {\n    this.#auth = null\n  }\n\n  /**\n   * Current Partner/Backup authorization token.\n   *\n   * @returns The current Partner token.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getPartnerToken(): PartnerToken {\n    return this.requireAuth().authorizationToken\n  }\n\n  /**\n   * Base URL for Partner API calls.\n   *\n   * @returns The base URL for Partner API calls.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getGroupsApiUrl(): string | null {\n    return this.requireAuth().apiInfo.groupsApi?.groupsApiUrl ?? null\n  }\n\n  /**\n   * Base URL for Computer Backup API calls, or null when the suite is unavailable.\n   *\n   * @returns The Computer Backup API URL, or null.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getBackupApiUrl(): string | null {\n    return this.requireAuth().backupApiUrl ?? null\n  }\n\n  /**\n   * The authorized partner administrator account ID.\n   *\n   * @returns The authorized account identifier.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getAccountId(): AccountId {\n    return this.requireAuth().accountId\n  }\n\n  /**\n   * Capabilities granted for Partner API calls.\n   *\n   * @returns The Partner API capabilities.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getGroupsCapabilities(): readonly PartnerCapability[] | null {\n    return this.requireAuth().apiInfo.groupsApi?.capabilities ?? null\n  }\n\n  /**\n   * Capabilities granted for Computer Backup API calls, or null when the suite is unavailable.\n   *\n   * @returns The Computer Backup API capabilities, or null.\n   *\n   * @throws B2PartnerAuthorizationError if not yet authorized.\n   */\n  getBackupCapabilities(): readonly PartnerCapability[] | null {\n    return this.requireAuth().backupCapabilities ?? null\n  }\n\n  /**\n   * Hides the Partner token from `JSON.stringify(accountInfo)`.\n   *\n   * @returns Redacted Partner auth state, or null when not authorized.\n   */\n  toJSON(): InMemoryPartnerAccountInfoJson {\n    return {\n      auth: this.#auth === null ? null : partnerAuthorizeResponseToRedactedJson(this.#auth),\n    }\n  }\n\n  /**\n   * Hides the Partner token from default stringification.\n   *\n   * @returns A short opaque label for this account info store.\n   */\n  toString(): string {\n    return this.#auth === null\n      ? '[InMemoryPartnerAccountInfo unauthorized]'\n      : `[InMemoryPartnerAccountInfo ${PARTNER_TOKEN_REDACTED}]`\n  }\n\n  /**\n   * Hides the Partner token from Node's `util.inspect`.\n   *\n   * @returns A short opaque label for this account info store.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n\n  /**\n   * Retrieve the cached auth response or throw if not yet authorized.\n   *\n   * @returns The cached authorization response.\n   *\n   * @throws B2PartnerAuthorizationError if authorizePartner() has not been called.\n   */\n  private requireAuth(): PartnerAuthorizeResponse {\n    if (!this.#auth) {\n      throw new B2PartnerAuthorizationError('Not authorized. Call authorizePartner() first.')\n    }\n    return this.#auth\n  }\n}\n"],"mappings":";;;;;AAkBA,SAAS,iBAAiB,MAA0D;CAClF,OAAO,+BAA+B,8BAA8B,IAAI,CAAC;AAC3E;;;;;AAMA,IAAa,6BAAb,MAAsE;;CAEpE,QAAyC;;;;;;CAOzC,QAAQ,MAAsC;EAC5C,KAAK,QAAQ,iBAAiB,IAAI;CACpC;;;;;;CAOA,UAA2C;EACzC,OAAO,KAAK;CACd;;CAGA,QAAc;EACZ,KAAK,QAAQ;CACf;;;;;;;;CASA,kBAAgC;EAC9B,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,kBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW,gBAAgB;CAC/D;;;;;;;;CASA,kBAAiC;EAC/B,OAAO,KAAK,YAAY,CAAC,CAAC,gBAAgB;CAC5C;;;;;;;;CASA,eAA0B;EACxB,OAAO,KAAK,YAAY,CAAC,CAAC;CAC5B;;;;;;;;CASA,wBAA6D;EAC3D,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,WAAW,gBAAgB;CAC/D;;;;;;;;CASA,wBAA6D;EAC3D,OAAO,KAAK,YAAY,CAAC,CAAC,sBAAsB;CAClD;;;;;;CAOA,SAAyC;EACvC,OAAO,EACL,MAAM,KAAK,UAAU,OAAO,OAAO,uCAAuC,KAAK,KAAK,EACtF;CACF;;;;;;CAOA,WAAmB;EACjB,OAAO,KAAK,UAAU,OAClB,8CACA,+BAA+B,uBAAuB;CAC5D;;;;;;CAOA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO,KAAK,SAAS;CACvB;;;;;;;;CASA,cAAgD;EAC9C,IAAI,CAAC,KAAK,OACR,MAAM,IAAI,4BAA4B,gDAAgD;EAExF,OAAO,KAAK;CACd;AACF"}

package/dist/partner/index.cjs

@@ -1,11 +1,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_ids = require("../types/ids.cjs");
 const require_partner = require("../types/partner.cjs");
+const require_redaction_placeholders = require("./redaction-placeholders.cjs");
 const require_auth_clone = require("./auth-clone.cjs");
+const require_redaction = require("./redaction.cjs");
 const require_in_memory = require("./in-memory.cjs");
 const require_raw = require("./raw.cjs");
 const require_client = require("./client.cjs");
+exports.APPLICATION_KEY_REDACTED = require_redaction_placeholders.APPLICATION_KEY_REDACTED;
 exports.InMemoryPartnerAccountInfo = require_in_memory.InMemoryPartnerAccountInfo;
+exports.PARTNER_TOKEN_REDACTED = require_redaction_placeholders.PARTNER_TOKEN_REDACTED;
 exports.PartnerCapability = require_partner.PartnerCapability;
 exports.PartnerClient = require_client.PartnerClient;
 exports.PartnerRawClient = require_raw.PartnerRawClient;
@@ -13,6 +17,11 @@ exports.Region = require_partner.Region;
 exports.accountId = require_ids.accountId;
 exports.applicationKeyId = require_ids.applicationKeyId;
 exports.computerId = require_ids.computerId;
+exports.createGroupMemberResponseToRedactedJson = require_redaction.createGroupMemberResponseToRedactedJson;
+exports.createGroupMemberResultToRedactedJson = require_redaction.createGroupMemberResultToRedactedJson;
 exports.groupId = require_ids.groupId;
 exports.partnerAuthorizeResponseForPersistence = require_auth_clone.partnerAuthorizeResponseForPersistence;
+exports.partnerAuthorizeResponseToRedactedJson = require_redaction.partnerAuthorizeResponseToRedactedJson;
 exports.partnerToken = require_ids.partnerToken;
+exports.reserveTrialCreateAccountResponseToRedactedJson = require_redaction.reserveTrialCreateAccountResponseToRedactedJson;
+exports.reserveTrialCreateAccountResultToRedactedJson = require_redaction.reserveTrialCreateAccountResultToRedactedJson;

package/dist/partner/index.d.cts

@@ -7,6 +7,14 @@
  * prerequisites required by the Partner API operation you are calling. Partner
  * authorization is separate from storage authorization and returns Partner API
  * and Computer Backup endpoint information through {@link PartnerAccountInfo}.
+ * Pure redacted-projection helpers such as
+ * {@link partnerAuthorizeResponseToRedactedJson},
+ * {@link createGroupMemberResponseToRedactedJson}, and
+ * {@link reserveTrialCreateAccountResponseToRedactedJson} return JSON-safe
+ * copies for logs, audit records, and other untrusted output without exposing
+ * Partner tokens or one-time application key secrets. The SDK's in-place
+ * serialization hook installers remain internal to the client and raw binding
+ * implementations.
  *
  * @packageDocumentation
  */
@@ -16,8 +24,9 @@ export type { CreateGroupMemberRequest, CreateGroupMemberResponse, CreateGroupMe
 export { computerId, groupId, PartnerCapability, Region } from '../types/partner.js';
 export type { PartnerAccountInfo } from './account-info.js';
 export { partnerAuthorizeResponseForPersistence } from './auth-clone.js';
-export { type CreateGroupMemberOptions, type EjectGroupMemberOptions, type ListGroupMembersOptions, type ListGroupsOptions, type PaginateGroupMembersOptions, type PaginateGroupsOptions, type PartnerAuthorizeOptions, PartnerClient, type PartnerClientJson, type PartnerClientOptions, type ReserveTrialAccountsOptions, } from './client.js';
+export { type CreateGroupMemberOptions, type EjectGroupMemberOptions, type ListGroupMembersOptions, type ListGroupsOptions, type PaginateGroupMembersOptions, type PaginateGroupsOptions, type PartnerAuthorizeOptions, PartnerClient, type PartnerClientJson, type PartnerClientOptions, type ReserveTrialAccountOptions, type ReserveTrialAccountsOptions, } from './client.js';
 export { InMemoryPartnerAccountInfo, type InMemoryPartnerAccountInfoJson, } from './in-memory.js';
 export { PartnerRawClient, type PartnerRawClientOptions, type PartnerRawRequestOptions, } from './raw.js';
-export type { RedactedPartnerAuthorizeResponseJson } from './redaction.js';
+export type { RedactedCreateGroupMemberResponseJson, RedactedCreateGroupMemberResultJson, RedactedPartnerAuthorizeResponseJson, RedactedReserveTrialCreateAccountResponseJson, RedactedReserveTrialCreateAccountResultJson, } from './redaction.js';
+export { APPLICATION_KEY_REDACTED, createGroupMemberResponseToRedactedJson, createGroupMemberResultToRedactedJson, PARTNER_TOKEN_REDACTED, partnerAuthorizeResponseToRedactedJson, reserveTrialCreateAccountResponseToRedactedJson, reserveTrialCreateAccountResultToRedactedJson, } from './redaction.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/partner/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/partner/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,GACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC3E,YAAY,EACV,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,6BAA6B,EAC7B,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qCAAqC,EACrC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACpF,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,sCAAsC,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,GACjC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,GACpC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,oCAAoC,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/partner/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,GACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC3E,YAAY,EACV,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,6BAA6B,EAC7B,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qCAAqC,EACrC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACpF,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,sCAAsC,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,GACjC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,GACpC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,qCAAqC,EACrC,mCAAmC,EACnC,oCAAoC,EACpC,6CAA6C,EAC7C,2CAA2C,GAC5C,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,uCAAuC,EACvC,qCAAqC,EACrC,sBAAsB,EACtB,sCAAsC,EACtC,+CAA+C,EAC/C,6CAA6C,GAC9C,MAAM,gBAAgB,CAAA"}

package/dist/partner/index.d.ts

@@ -7,6 +7,14 @@
  * prerequisites required by the Partner API operation you are calling. Partner
  * authorization is separate from storage authorization and returns Partner API
  * and Computer Backup endpoint information through {@link PartnerAccountInfo}.
+ * Pure redacted-projection helpers such as
+ * {@link partnerAuthorizeResponseToRedactedJson},
+ * {@link createGroupMemberResponseToRedactedJson}, and
+ * {@link reserveTrialCreateAccountResponseToRedactedJson} return JSON-safe
+ * copies for logs, audit records, and other untrusted output without exposing
+ * Partner tokens or one-time application key secrets. The SDK's in-place
+ * serialization hook installers remain internal to the client and raw binding
+ * implementations.
  *
  * @packageDocumentation
  */
@@ -16,8 +24,9 @@ export type { CreateGroupMemberRequest, CreateGroupMemberResponse, CreateGroupMe
 export { computerId, groupId, PartnerCapability, Region } from '../types/partner.js';
 export type { PartnerAccountInfo } from './account-info.js';
 export { partnerAuthorizeResponseForPersistence } from './auth-clone.js';
-export { type CreateGroupMemberOptions, type EjectGroupMemberOptions, type ListGroupMembersOptions, type ListGroupsOptions, type PaginateGroupMembersOptions, type PaginateGroupsOptions, type PartnerAuthorizeOptions, PartnerClient, type PartnerClientJson, type PartnerClientOptions, type ReserveTrialAccountsOptions, } from './client.js';
+export { type CreateGroupMemberOptions, type EjectGroupMemberOptions, type ListGroupMembersOptions, type ListGroupsOptions, type PaginateGroupMembersOptions, type PaginateGroupsOptions, type PartnerAuthorizeOptions, PartnerClient, type PartnerClientJson, type PartnerClientOptions, type ReserveTrialAccountOptions, type ReserveTrialAccountsOptions, } from './client.js';
 export { InMemoryPartnerAccountInfo, type InMemoryPartnerAccountInfoJson, } from './in-memory.js';
 export { PartnerRawClient, type PartnerRawClientOptions, type PartnerRawRequestOptions, } from './raw.js';
-export type { RedactedPartnerAuthorizeResponseJson } from './redaction.js';
+export type { RedactedCreateGroupMemberResponseJson, RedactedCreateGroupMemberResultJson, RedactedPartnerAuthorizeResponseJson, RedactedReserveTrialCreateAccountResponseJson, RedactedReserveTrialCreateAccountResultJson, } from './redaction.js';
+export { APPLICATION_KEY_REDACTED, createGroupMemberResponseToRedactedJson, createGroupMemberResultToRedactedJson, PARTNER_TOKEN_REDACTED, partnerAuthorizeResponseToRedactedJson, reserveTrialCreateAccountResponseToRedactedJson, reserveTrialCreateAccountResultToRedactedJson, } from './redaction.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/partner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/partner/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,GACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC3E,YAAY,EACV,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,6BAA6B,EAC7B,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qCAAqC,EACrC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACpF,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,sCAAsC,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,GACjC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,GACpC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,oCAAoC,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/partner/index.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,GACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC3E,YAAY,EACV,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,6BAA6B,EAC7B,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qCAAqC,EACrC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACpF,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,sCAAsC,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,GACjC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,0BAA0B,EAC1B,KAAK,8BAA8B,GACpC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,qCAAqC,EACrC,mCAAmC,EACnC,oCAAoC,EACpC,6CAA6C,EAC7C,2CAA2C,GAC5C,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,uCAAuC,EACvC,qCAAqC,EACrC,sBAAsB,EACtB,sCAAsC,EACtC,+CAA+C,EAC/C,6CAA6C,GAC9C,MAAM,gBAAgB,CAAA"}

package/dist/partner/index.js

@@ -1,7 +1,9 @@
 import { accountId, applicationKeyId, computerId, groupId, partnerToken } from "../types/ids.js";
 import { PartnerCapability, Region } from "../types/partner.js";
+import { APPLICATION_KEY_REDACTED, PARTNER_TOKEN_REDACTED } from "./redaction-placeholders.js";
 import { partnerAuthorizeResponseForPersistence } from "./auth-clone.js";
+import { createGroupMemberResponseToRedactedJson, createGroupMemberResultToRedactedJson, partnerAuthorizeResponseToRedactedJson, reserveTrialCreateAccountResponseToRedactedJson, reserveTrialCreateAccountResultToRedactedJson } from "./redaction.js";
 import { InMemoryPartnerAccountInfo } from "./in-memory.js";
 import { PartnerRawClient } from "./raw.js";
 import { PartnerClient } from "./client.js";
-export { InMemoryPartnerAccountInfo, PartnerCapability, PartnerClient, PartnerRawClient, Region, accountId, applicationKeyId, computerId, groupId, partnerAuthorizeResponseForPersistence, partnerToken };
+export { APPLICATION_KEY_REDACTED, InMemoryPartnerAccountInfo, PARTNER_TOKEN_REDACTED, PartnerCapability, PartnerClient, PartnerRawClient, Region, accountId, applicationKeyId, computerId, createGroupMemberResponseToRedactedJson, createGroupMemberResultToRedactedJson, groupId, partnerAuthorizeResponseForPersistence, partnerAuthorizeResponseToRedactedJson, partnerToken, reserveTrialCreateAccountResponseToRedactedJson, reserveTrialCreateAccountResultToRedactedJson };