@backblaze-labs/b2-sdk 0.1.0 → 0.2.0

package/dist/types/encryption.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.cjs","sources":["../../src/types/encryption.ts"],"sourcesContent":["/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /** Base64-encoded 256-bit encryption key provided by the customer. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\n/**\n * Computes the MD5 digest of the given bytes as a base64 string. Prefers\n * `node:crypto` for native speed when available; falls back to a pure-JS\n * implementation in browser / edge runtimes because WebCrypto's\n * `crypto.subtle.digest` deliberately does not support MD5.\n *\n * MD5 is used here only for SSE-C key integrity (matching the B2 wire\n * protocol). It is **not** a security boundary; the customer key itself is\n * the secret. Bundling a pure-JS fallback keeps `EncryptionKey.fromBytes`\n * isomorphic.\n *\n * @param bytes - The bytes to digest.\n *\n * @returns The base64-encoded MD5 digest.\n */\nasync function md5Base64(bytes: Uint8Array): Promise<string> {\n  try {\n    const { createHash } = await import('node:crypto')\n    // Vite's browser shim resolves the import but does not implement\n    // `createHash`. Probe explicitly so we fall through to the pure-JS path.\n    if (typeof createHash !== 'function') throw new Error('createHash unavailable')\n    return createHash('md5').update(bytes).digest('base64')\n    /* v8 ignore next 3 -- fallback only reachable in non-Node runtimes */\n  } catch {\n    return bytesToBase64(md5Bytes(bytes))\n  }\n}\n\n/**\n * Pure-JS MD5 implementation per RFC 1321. Returns the 16-byte digest of the\n * input. Used as a browser fallback for SSE-C key MD5 computation; not\n * intended for security-sensitive purposes (MD5 is broken cryptographically).\n *\n * @param data - The bytes to hash.\n *\n * @returns The 16-byte MD5 digest.\n */\nfunction md5Bytes(data: Uint8Array): Uint8Array {\n  // Padding: append 0x80, then zeros, then the original length in bits as a\n  // little-endian 64-bit integer, so the total length is a multiple of 64.\n  const originalBitLength = data.byteLength * 8\n  const padLength = ((data.byteLength + 8) >>> 6) + 1\n  const padded = new Uint8Array(padLength * 64)\n  padded.set(data)\n  padded[data.byteLength] = 0x80\n  // Write the 64-bit length (little-endian). JS bitwise ops are 32-bit, so\n  // split into low/high halves.\n  const lowBits = originalBitLength >>> 0\n  const highBits = Math.floor(originalBitLength / 0x1_0000_0000) >>> 0\n  const lengthView = new DataView(padded.buffer, padded.byteLength - 8, 8)\n  lengthView.setUint32(0, lowBits, true)\n  lengthView.setUint32(4, highBits, true)\n\n  // Per-round shift amounts.\n  const s = [\n    7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9,\n    14, 20, 5, 9, 14, 20, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21,\n    6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,\n  ]\n  // Per-round sine-derived constants K[i] = floor(2^32 * abs(sin(i + 1))).\n  const k = new Uint32Array([\n    0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,\n    0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,\n    0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,\n    0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,\n    0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,\n    0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,\n    0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,\n    0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,\n  ])\n\n  let a0 = 0x67452301\n  let b0 = 0xefcdab89\n  let c0 = 0x98badcfe\n  let d0 = 0x10325476\n\n  const m = new Uint32Array(16)\n  const view = new DataView(padded.buffer)\n  for (let block = 0; block < padded.byteLength; block += 64) {\n    for (let i = 0; i < 16; i++) m[i] = view.getUint32(block + i * 4, true)\n    let A = a0\n    let B = b0\n    let C = c0\n    let D = d0\n    for (let i = 0; i < 64; i++) {\n      let f: number\n      let g: number\n      if (i < 16) {\n        f = (B & C) | (~B & D)\n        g = i\n      } else if (i < 32) {\n        f = (D & B) | (~D & C)\n        g = (5 * i + 1) % 16\n      } else if (i < 48) {\n        f = B ^ C ^ D\n        g = (3 * i + 5) % 16\n      } else {\n        f = C ^ (B | ~D)\n        g = (7 * i) % 16\n      }\n      const temp = D\n      D = C\n      C = B\n      const sum = (A + f + (k[i] ?? 0) + (m[g] ?? 0)) >>> 0\n      const shift = s[i] ?? 0\n      const rotated = ((sum << shift) | (sum >>> (32 - shift))) >>> 0\n      B = (B + rotated) >>> 0\n      A = temp\n    }\n    a0 = (a0 + A) >>> 0\n    b0 = (b0 + B) >>> 0\n    c0 = (c0 + C) >>> 0\n    d0 = (d0 + D) >>> 0\n  }\n\n  const out = new Uint8Array(16)\n  const outView = new DataView(out.buffer)\n  outView.setUint32(0, a0, true)\n  outView.setUint32(4, b0, true)\n  outView.setUint32(8, c0, true)\n  outView.setUint32(12, d0, true)\n  return out\n}\n\nconst KEY_REDACTED = '[redacted SSE-C key]'\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return {\n      mode: this.mode,\n      algorithm: this.algorithm,\n      customerKey: KEY_REDACTED,\n      customerKeyMd5: KEY_REDACTED,\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return `[EncryptionKey SSE-C ${KEY_REDACTED}]`\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AACO,MAAM,sBAAsB;AAAA;AAAA,EAEjC,QAAQ;AACV;AAcO,MAAM,iBAAiB;AAAA;AAAA,EAE5B,OAAO;AAAA;AAAA,EAEP,MAAM;AAAA;AAAA,EAEN,MAAM;AACR;AAmCO,MAAM,SAAuB,EAAE,MAAM,UAAU,WAAW,SAAA;AAG1D,MAAM,WAAyB,EAAE,MAAM,OAAA;AASvC,SAAS,YAAY,aAAqB,gBAA6C;AAC5F,SAAO,EAAE,MAAM,SAAS,WAAW,UAAU,aAAa,eAAA;AAC5D;AASA,SAAS,cAAc,OAA2B;AAKhD,QAAM,IAAI;AAGV,MAAI,EAAE,QAAQ;AACZ,WAAO,EAAE,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,EAC/C;AACA,MAAI,SAAS;AACb,aAAW,KAAK,MAAO,WAAU,OAAO,aAAa,CAAC;AACtD,SAAO,KAAK,MAAM;AACpB;AAiBA,eAAe,UAAU,OAAoC;AAC3D,MAAI;AACF,UAAM,EAAE,WAAA,IAAe,MAAM,OAAO,aAAa;AAGjD,QAAI,OAAO,eAAe,WAAY,OAAM,IAAI,MAAM,wBAAwB;AAC9E,WAAO,WAAW,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,QAAQ;AAAA,EAExD,QAAQ;AACN,WAAO,cAAc,SAAS,KAAK,CAAC;AAAA,EACtC;AACF;AAWA,SAAS,SAAS,MAA8B;AAG9C,QAAM,oBAAoB,KAAK,aAAa;AAC5C,QAAM,aAAc,KAAK,aAAa,MAAO,KAAK;AAClD,QAAM,SAAS,IAAI,WAAW,YAAY,EAAE;AAC5C,SAAO,IAAI,IAAI;AACf,SAAO,KAAK,UAAU,IAAI;AAG1B,QAAM,UAAU,sBAAsB;AACtC,QAAM,WAAW,KAAK,MAAM,oBAAoB,UAAa,MAAM;AACnE,QAAM,aAAa,IAAI,SAAS,OAAO,QAAQ,OAAO,aAAa,GAAG,CAAC;AACvE,aAAW,UAAU,GAAG,SAAS,IAAI;AACrC,aAAW,UAAU,GAAG,UAAU,IAAI;AAGtC,QAAM,IAAI;AAAA,IACR;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAC3F;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAC7F;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,EAAA;AAG3C,QAAM,IAAI,IAAI,YAAY;AAAA,IACxB;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,EAAA,CACrF;AAED,MAAI,KAAK;AACT,MAAI,KAAK;AACT,MAAI,KAAK;AACT,MAAI,KAAK;AAET,QAAM,IAAI,IAAI,YAAY,EAAE;AAC5B,QAAM,OAAO,IAAI,SAAS,OAAO,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,OAAO,YAAY,SAAS,IAAI;AAC1D,aAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,UAAU,QAAQ,IAAI,GAAG,IAAI;AACtE,QAAI,IAAI;AACR,QAAI,IAAI;AACR,QAAI,IAAI;AACR,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAI;AACJ,UAAI;AACJ,UAAI,IAAI,IAAI;AACV,YAAK,IAAI,IAAM,CAAC,IAAI;AACpB,YAAI;AAAA,MACN,WAAW,IAAI,IAAI;AACjB,YAAK,IAAI,IAAM,CAAC,IAAI;AACpB,aAAK,IAAI,IAAI,KAAK;AAAA,MACpB,WAAW,IAAI,IAAI;AACjB,YAAI,IAAI,IAAI;AACZ,aAAK,IAAI,IAAI,KAAK;AAAA,MACpB,OAAO;AACL,YAAI,KAAK,IAAI,CAAC;AACd,YAAK,IAAI,IAAK;AAAA,MAChB;AACA,YAAM,OAAO;AACb,UAAI;AACJ,UAAI;AACJ,YAAM,MAAO,IAAI,KAAK,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,KAAK,OAAQ;AACpD,YAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,YAAM,WAAY,OAAO,QAAU,QAAS,KAAK,WAAa;AAC9D,UAAK,IAAI,YAAa;AACtB,UAAI;AAAA,IACN;AACA,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAAA,EACpB;AAEA,QAAM,MAAM,IAAI,WAAW,EAAE;AAC7B,QAAM,UAAU,IAAI,SAAS,IAAI,MAAM;AACvC,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,IAAI,IAAI,IAAI;AAC9B,SAAO;AACT;AAEA,MAAM,eAAe;AAOd,MAAM,cAAc;AAAA;AAAA,EAEhB,OAAO;AAAA;AAAA,EAEP,YAAiC;AAAA;AAAA,EAEjC;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWD,YAAY,aAAqB,gBAAwB;AAC/D,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,UAAU,QAA4C;AACjE,QAAI,OAAO,eAAe,IAAI;AAC5B,YAAM,IAAI,MAAM,sDAAsD,OAAO,UAAU,GAAG;AAAA,IAC5F;AACA,UAAM,cAAc,cAAc,MAAM;AACxC,UAAM,iBAAiB,MAAM,UAAU,MAAM;AAC7C,WAAO,IAAI,cAAc,aAAa,cAAc;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,WAAW,aAAqB,gBAAuC;AAC5E,WAAO,IAAI,cAAc,aAAa,cAAc;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SASE;AACA,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,WAAW,KAAK;AAAA,MAChB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAAA;AAAA,EAEpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAmB;AACjB,WAAO,wBAAwB,YAAY;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,CAAC,OAAO,IAAI,4BAA4B,CAAC,IAAY;AACnD,WAAO,KAAK,SAAA;AAAA,EACd;AACF;;;;;;;"}
+{"version":3,"file":"encryption.cjs","names":[],"sources":["../../src/types/encryption.ts"],"sourcesContent":["/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /** Base64-encoded 256-bit encryption key provided by the customer. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Server-side encryption using customer-provided keys as returned by B2 responses. */\nexport interface SseCPublicSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** No-encryption shape returned by B2 response objects. */\nexport interface NoEncryptionWireSetting {\n  /** Encryption mode discriminator. B2 response payloads use null for no encryption. */\n  readonly mode: null\n  /** Encryption algorithm. B2 response payloads use null when no encryption is applied. */\n  readonly algorithm: null\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Server-side encryption setting returned by B2 response objects. */\nexport type PublicEncryptionSetting =\n  | SseB2Setting\n  | SseCPublicSetting\n  | NoEncryption\n  | NoEncryptionWireSetting\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\n/**\n * Computes the MD5 digest of the given bytes as a base64 string. Prefers\n * `node:crypto` for native speed when available; falls back to a pure-JS\n * implementation in browser / edge runtimes because WebCrypto's\n * `crypto.subtle.digest` deliberately does not support MD5.\n *\n * MD5 is used here only for SSE-C key integrity (matching the B2 wire\n * protocol). It is **not** a security boundary; the customer key itself is\n * the secret. Bundling a pure-JS fallback keeps `EncryptionKey.fromBytes`\n * isomorphic.\n *\n * @param bytes - The bytes to digest.\n *\n * @returns The base64-encoded MD5 digest.\n */\nasync function md5Base64(bytes: Uint8Array): Promise<string> {\n  try {\n    const { createHash } = await import('node:crypto')\n    // Vite's browser shim resolves the import but does not implement\n    // `createHash`. Probe explicitly so we fall through to the pure-JS path.\n    if (typeof createHash !== 'function') throw new Error('createHash unavailable')\n    return createHash('md5').update(bytes).digest('base64')\n    /* v8 ignore next 3 -- fallback only reachable in non-Node runtimes */\n  } catch {\n    return bytesToBase64(md5Bytes(bytes))\n  }\n}\n\n/**\n * Pure-JS MD5 implementation per RFC 1321. Returns the 16-byte digest of the\n * input. Used as a browser fallback for SSE-C key MD5 computation; not\n * intended for security-sensitive purposes (MD5 is broken cryptographically).\n *\n * @param data - The bytes to hash.\n *\n * @returns The 16-byte MD5 digest.\n */\nfunction md5Bytes(data: Uint8Array): Uint8Array {\n  // Padding: append 0x80, then zeros, then the original length in bits as a\n  // little-endian 64-bit integer, so the total length is a multiple of 64.\n  const originalBitLength = data.byteLength * 8\n  const padLength = ((data.byteLength + 8) >>> 6) + 1\n  const padded = new Uint8Array(padLength * 64)\n  padded.set(data)\n  padded[data.byteLength] = 0x80\n  // Write the 64-bit length (little-endian). JS bitwise ops are 32-bit, so\n  // split into low/high halves.\n  const lowBits = originalBitLength >>> 0\n  const highBits = Math.floor(originalBitLength / 0x1_0000_0000) >>> 0\n  const lengthView = new DataView(padded.buffer, padded.byteLength - 8, 8)\n  lengthView.setUint32(0, lowBits, true)\n  lengthView.setUint32(4, highBits, true)\n\n  // Per-round shift amounts.\n  const s = [\n    7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9,\n    14, 20, 5, 9, 14, 20, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21,\n    6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,\n  ]\n  // Per-round sine-derived constants K[i] = floor(2^32 * abs(sin(i + 1))).\n  const k = new Uint32Array([\n    0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,\n    0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,\n    0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,\n    0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,\n    0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,\n    0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,\n    0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,\n    0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,\n  ])\n\n  let a0 = 0x67452301\n  let b0 = 0xefcdab89\n  let c0 = 0x98badcfe\n  let d0 = 0x10325476\n\n  const m = new Uint32Array(16)\n  const view = new DataView(padded.buffer)\n  for (let block = 0; block < padded.byteLength; block += 64) {\n    for (let i = 0; i < 16; i++) m[i] = view.getUint32(block + i * 4, true)\n    let A = a0\n    let B = b0\n    let C = c0\n    let D = d0\n    for (let i = 0; i < 64; i++) {\n      let f: number\n      let g: number\n      if (i < 16) {\n        f = (B & C) | (~B & D)\n        g = i\n      } else if (i < 32) {\n        f = (D & B) | (~D & C)\n        g = (5 * i + 1) % 16\n      } else if (i < 48) {\n        f = B ^ C ^ D\n        g = (3 * i + 5) % 16\n      } else {\n        f = C ^ (B | ~D)\n        g = (7 * i) % 16\n      }\n      const temp = D\n      D = C\n      C = B\n      const sum = (A + f + (k[i] ?? 0) + (m[g] ?? 0)) >>> 0\n      const shift = s[i] ?? 0\n      const rotated = ((sum << shift) | (sum >>> (32 - shift))) >>> 0\n      B = (B + rotated) >>> 0\n      A = temp\n    }\n    a0 = (a0 + A) >>> 0\n    b0 = (b0 + B) >>> 0\n    c0 = (c0 + C) >>> 0\n    d0 = (d0 + D) >>> 0\n  }\n\n  const out = new Uint8Array(16)\n  const outView = new DataView(out.buffer)\n  outView.setUint32(0, a0, true)\n  outView.setUint32(4, b0, true)\n  outView.setUint32(8, c0, true)\n  outView.setUint32(12, d0, true)\n  return out\n}\n\nconst KEY_REDACTED = '[redacted SSE-C key]'\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return {\n      mode: this.mode,\n      algorithm: this.algorithm,\n      customerKey: KEY_REDACTED,\n      customerKeyMd5: KEY_REDACTED,\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return `[EncryptionKey SSE-C ${KEY_REDACTED}]`\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n}\n"],"mappings":";;AACA,IAAa,sBAAsB;;AAEjC,QAAQ,SACV;;;;;;;;;;AAcA,IAAa,iBAAiB;;CAE5B,OAAO;;CAEP,MAAM;;CAEN,MAAM;AACR;;AA0DA,IAAa,SAAuB;CAAE,MAAM;CAAU,WAAW;AAAS;;AAG1E,IAAa,WAAyB,EAAE,MAAM,OAAO;;;;;;;;AASrD,SAAgB,YAAY,aAAqB,gBAA6C;CAC5F,OAAO;EAAE,MAAM;EAAS,WAAW;EAAU;EAAa;CAAe;AAC3E;;;;;;;;AASA,SAAS,cAAc,OAA2B;CAKhD,MAAM,IAAI;CAGV,IAAI,EAAE,QACJ,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;CAE/C,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;;;;;;;;;;;;;;;;AAiBA,eAAe,UAAU,OAAoC;CAC3D,IAAI;EACF,MAAM,EAAE,eAAe,MAAM,OAAO;EAGpC,IAAI,OAAO,eAAe,YAAY,MAAM,IAAI,MAAM,wBAAwB;EAC9E,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,QAAQ;CAExD,QAAQ;EACN,OAAO,cAAc,SAAS,KAAK,CAAC;CACtC;AACF;;;;;;;;;;AAWA,SAAS,SAAS,MAA8B;CAG9C,MAAM,oBAAoB,KAAK,aAAa;CAC5C,MAAM,aAAc,KAAK,aAAa,MAAO,KAAK;CAClD,MAAM,SAAS,IAAI,WAAW,YAAY,EAAE;CAC5C,OAAO,IAAI,IAAI;CACf,OAAO,KAAK,cAAc;CAG1B,MAAM,UAAU,sBAAsB;CACtC,MAAM,WAAW,KAAK,MAAM,oBAAoB,UAAa,MAAM;CACnE,MAAM,aAAa,IAAI,SAAS,OAAO,QAAQ,OAAO,aAAa,GAAG,CAAC;CACvE,WAAW,UAAU,GAAG,SAAS,IAAI;CACrC,WAAW,UAAU,GAAG,UAAU,IAAI;CAGtC,MAAM,IAAI;EACR;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;EAAI;EAAG;EAAG;EAAI;EAAI;EAAG;EAAG;EAAI;EAAI;EAAG;EAC3F;EAAI;EAAI;EAAG;EAAG;EAAI;EAAI;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;EAC7F;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;EAAI;EAAG;EAAI;EAAI;CAC3C;CAEA,MAAM,IAAI,IAAI,YAAY;EACxB;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EACpF;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EACpF;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EACpF;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EACpF;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EACpF;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EACpF;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EACpF;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;EAAY;CACtF,CAAC;CAED,IAAI,KAAK;CACT,IAAI,KAAK;CACT,IAAI,KAAK;CACT,IAAI,KAAK;CAET,MAAM,oBAAI,IAAI,YAAY,EAAE;CAC5B,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,YAAY,SAAS,IAAI;EAC1D,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,EAAE,KAAK,KAAK,UAAU,QAAQ,IAAI,GAAG,IAAI;EACtE,IAAI,IAAI;EACR,IAAI,IAAI;EACR,IAAI,IAAI;EACR,IAAI,IAAI;EACR,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GAC3B,IAAI;GACJ,IAAI;GACJ,IAAI,IAAI,IAAI;IACV,IAAK,IAAI,IAAM,CAAC,IAAI;IACpB,IAAI;GACN,OAAO,IAAI,IAAI,IAAI;IACjB,IAAK,IAAI,IAAM,CAAC,IAAI;IACpB,KAAK,IAAI,IAAI,KAAK;GACpB,OAAO,IAAI,IAAI,IAAI;IACjB,IAAI,IAAI,IAAI;IACZ,KAAK,IAAI,IAAI,KAAK;GACpB,OAAO;IACL,IAAI,KAAK,IAAI,CAAC;IACd,IAAK,IAAI,IAAK;GAChB;GACA,MAAM,OAAO;GACb,IAAI;GACJ,IAAI;GACJ,MAAM,MAAO,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE,MAAM,OAAQ;GACpD,MAAM,QAAQ,EAAE,MAAM;GACtB,MAAM,WAAY,OAAO,QAAU,QAAS,KAAK,WAAa;GAC9D,IAAK,IAAI,YAAa;GACtB,IAAI;EACN;EACA,KAAM,KAAK,MAAO;EAClB,KAAM,KAAK,MAAO;EAClB,KAAM,KAAK,MAAO;EAClB,KAAM,KAAK,MAAO;CACpB;CAEA,MAAM,sBAAM,IAAI,WAAW,EAAE;CAC7B,MAAM,UAAU,IAAI,SAAS,IAAI,MAAM;CACvC,QAAQ,UAAU,GAAG,IAAI,IAAI;CAC7B,QAAQ,UAAU,GAAG,IAAI,IAAI;CAC7B,QAAQ,UAAU,GAAG,IAAI,IAAI;CAC7B,QAAQ,UAAU,IAAI,IAAI,IAAI;CAC9B,OAAO;AACT;AAEA,IAAM,eAAe;;;;;;AAOrB,IAAa,gBAAb,MAAa,cAAc;;CAEzB,OAAgB;;CAEhB,YAA0C;;CAE1C;;CAEA;;;;;;;;;;CAWA,YAAoB,aAAqB,gBAAwB;EAC/D,KAAK,cAAc;EACnB,KAAK,iBAAiB;CACxB;;;;;;;;;;;CAYA,aAAa,UAAU,QAA4C;EACjE,IAAI,OAAO,eAAe,IACxB,MAAM,IAAI,MAAM,sDAAsD,OAAO,WAAW,EAAE;EAE5F,MAAM,cAAc,cAAc,MAAM;EACxC,MAAM,iBAAiB,MAAM,UAAU,MAAM;EAC7C,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;;;;CAWA,OAAO,WAAW,aAAqB,gBAAuC;EAC5E,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;CAQA,SASE;EACA,OAAO;GACL,MAAM,KAAK;GACX,WAAW,KAAK;GAChB,aAAa;GACb,gBAAgB;EAClB;CACF;;;;;;CAOA,WAAmB;EACjB,OAAO,wBAAwB,aAAa;CAC9C;;;;;;CAOA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO,KAAK,SAAS;CACvB;AACF"}

package/dist/types/encryption.d.cts

@@ -42,13 +42,29 @@ export interface SseCCustomerSetting {
     /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */
     readonly customerKeyMd5: string;
 }
+/** Server-side encryption using customer-provided keys as returned by B2 responses. */
+export interface SseCPublicSetting {
+    /** Encryption mode discriminator. Always `'SSE-C'`. */
+    readonly mode: 'SSE-C';
+    /** Encryption algorithm. Always `'AES256'`. */
+    readonly algorithm: EncryptionAlgorithm;
+}
 /** Indicates no server-side encryption is applied. */
 export interface NoEncryption {
     /** Encryption mode discriminator. Always `'none'`. */
     readonly mode: 'none';
 }
+/** No-encryption shape returned by B2 response objects. */
+export interface NoEncryptionWireSetting {
+    /** Encryption mode discriminator. B2 response payloads use null for no encryption. */
+    readonly mode: null;
+    /** Encryption algorithm. B2 response payloads use null when no encryption is applied. */
+    readonly algorithm: null;
+}
 /** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */
 export type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption;
+/** Server-side encryption setting returned by B2 response objects. */
+export type PublicEncryptionSetting = SseB2Setting | SseCPublicSetting | NoEncryption | NoEncryptionWireSetting;
 /** Pre-built SSE-B2 encryption setting using AES-256. */
 export declare const SSE_B2: SseB2Setting;
 /** Pre-built setting indicating no server-side encryption. */

package/dist/types/encryption.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAuJD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;CAYnB"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAC/B,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,uBAAuB,CAAA;AAE3B,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAuJD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;CAYnB"}

package/dist/types/encryption.d.ts

@@ -42,13 +42,29 @@ export interface SseCCustomerSetting {
     /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */
     readonly customerKeyMd5: string;
 }
+/** Server-side encryption using customer-provided keys as returned by B2 responses. */
+export interface SseCPublicSetting {
+    /** Encryption mode discriminator. Always `'SSE-C'`. */
+    readonly mode: 'SSE-C';
+    /** Encryption algorithm. Always `'AES256'`. */
+    readonly algorithm: EncryptionAlgorithm;
+}
 /** Indicates no server-side encryption is applied. */
 export interface NoEncryption {
     /** Encryption mode discriminator. Always `'none'`. */
     readonly mode: 'none';
 }
+/** No-encryption shape returned by B2 response objects. */
+export interface NoEncryptionWireSetting {
+    /** Encryption mode discriminator. B2 response payloads use null for no encryption. */
+    readonly mode: null;
+    /** Encryption algorithm. B2 response payloads use null when no encryption is applied. */
+    readonly algorithm: null;
+}
 /** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */
 export type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption;
+/** Server-side encryption setting returned by B2 response objects. */
+export type PublicEncryptionSetting = SseB2Setting | SseCPublicSetting | NoEncryption | NoEncryptionWireSetting;
 /** Pre-built SSE-B2 encryption setting using AES-256. */
 export declare const SSE_B2: SseB2Setting;
 /** Pre-built setting indicating no server-side encryption. */

package/dist/types/encryption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAuJD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;CAYnB"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAC/B,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,uBAAuB,CAAA;AAE3B,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAuJD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;CAYnB"}