@backblaze-labs/b2-sdk 0.1.0 → 0.3.0

package/dist/types/encryption.js

@@ -1,321 +1,202 @@
-const EncryptionAlgorithm = {
-  /** AES with a 256-bit key. The only algorithm B2 currently supports. */
-  Aes256: "AES256"
+import { md5Base64 } from "../util/md5.js";
+//#region src/types/encryption.ts
+/** Named constants for the supported server-side encryption algorithms. */
+var EncryptionAlgorithm = { 
+/** AES with a 256-bit key. The only algorithm B2 currently supports. */
+Aes256: "AES256" };
+/**
+* Named constants for the server-side encryption mode used by a file.
+*
+* Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and
+* {@link sseCustomer} helpers below which return complete
+* {@link EncryptionSetting} objects. These constants are useful when you
+* need the bare mode discriminator (e.g., when introspecting a file's
+* current encryption setting).
+*/
+var EncryptionMode = {
+	/** B2-managed encryption keys. */
+	SseB2: "SSE-B2",
+	/** Customer-provided encryption keys. */
+	SseC: "SSE-C",
+	/** No encryption. */
+	None: "none"
 };
-const EncryptionMode = {
-  /** B2-managed encryption keys. */
-  SseB2: "SSE-B2",
-  /** Customer-provided encryption keys. */
-  SseC: "SSE-C",
-  /** No encryption. */
-  None: "none"
+/** Pre-built SSE-B2 encryption setting using AES-256. */
+var SSE_B2 = {
+	mode: "SSE-B2",
+	algorithm: "AES256"
 };
-const SSE_B2 = { mode: "SSE-B2", algorithm: "AES256" };
-const SSE_NONE = { mode: "none" };
+/** Pre-built setting indicating no server-side encryption. */
+var SSE_NONE = { mode: "none" };
+/**
+* Creates an SSE-C encryption setting with a customer-provided key.
+* @param customerKey - Base64-encoded 256-bit encryption key.
+* @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+*
+* @returns An SSE-C encryption setting ready to pass to upload or download calls.
+*/
 function sseCustomer(customerKey, customerKeyMd5) {
-  return { mode: "SSE-C", algorithm: "AES256", customerKey, customerKeyMd5 };
+	return {
+		mode: "SSE-C",
+		algorithm: "AES256",
+		customerKey,
+		customerKeyMd5
+	};
 }
+/**
+* Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).
+*
+* @param bytes - The raw bytes to encode.
+*
+* @returns The base64-encoded string.
+*/
 function bytesToBase64(bytes) {
-  const g = globalThis;
-  if (g.Buffer) {
-    return g.Buffer.from(bytes).toString("base64");
-  }
-  let binary = "";
-  for (const b of bytes) binary += String.fromCharCode(b);
-  return btoa(binary);
+	const g = globalThis;
+	if (g.Buffer) return g.Buffer.from(bytes).toString("base64");
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary);
 }
-async function md5Base64(bytes) {
-  try {
-    const { createHash } = await import("node:crypto");
-    if (typeof createHash !== "function") throw new Error("createHash unavailable");
-    return createHash("md5").update(bytes).digest("base64");
-  } catch {
-    return bytesToBase64(md5Bytes(bytes));
-  }
+var SSE_C_KEY_REDACTION = "[redacted SSE-C key]";
+var NODE_INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+function sseCKeyRedactedJson(key, options) {
+	return {
+		...options.mode !== void 0 ? { mode: options.mode } : {},
+		algorithm: key.algorithm,
+		customerKey: SSE_C_KEY_REDACTION,
+		customerKeyMd5: SSE_C_KEY_REDACTION
+	};
 }
-function md5Bytes(data) {
-  const originalBitLength = data.byteLength * 8;
-  const padLength = (data.byteLength + 8 >>> 6) + 1;
-  const padded = new Uint8Array(padLength * 64);
-  padded.set(data);
-  padded[data.byteLength] = 128;
-  const lowBits = originalBitLength >>> 0;
-  const highBits = Math.floor(originalBitLength / 4294967296) >>> 0;
-  const lengthView = new DataView(padded.buffer, padded.byteLength - 8, 8);
-  lengthView.setUint32(0, lowBits, true);
-  lengthView.setUint32(4, highBits, true);
-  const s = [
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    7,
-    12,
-    17,
-    22,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    5,
-    9,
-    14,
-    20,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    4,
-    11,
-    16,
-    23,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21,
-    6,
-    10,
-    15,
-    21
-  ];
-  const k = new Uint32Array([
-    3614090360,
-    3905402710,
-    606105819,
-    3250441966,
-    4118548399,
-    1200080426,
-    2821735955,
-    4249261313,
-    1770035416,
-    2336552879,
-    4294925233,
-    2304563134,
-    1804603682,
-    4254626195,
-    2792965006,
-    1236535329,
-    4129170786,
-    3225465664,
-    643717713,
-    3921069994,
-    3593408605,
-    38016083,
-    3634488961,
-    3889429448,
-    568446438,
-    3275163606,
-    4107603335,
-    1163531501,
-    2850285829,
-    4243563512,
-    1735328473,
-    2368359562,
-    4294588738,
-    2272392833,
-    1839030562,
-    4259657740,
-    2763975236,
-    1272893353,
-    4139469664,
-    3200236656,
-    681279174,
-    3936430074,
-    3572445317,
-    76029189,
-    3654602809,
-    3873151461,
-    530742520,
-    3299628645,
-    4096336452,
-    1126891415,
-    2878612391,
-    4237533241,
-    1700485571,
-    2399980690,
-    4293915773,
-    2240044497,
-    1873313359,
-    4264355552,
-    2734768916,
-    1309151649,
-    4149444226,
-    3174756917,
-    718787259,
-    3951481745
-  ]);
-  let a0 = 1732584193;
-  let b0 = 4023233417;
-  let c0 = 2562383102;
-  let d0 = 271733878;
-  const m = new Uint32Array(16);
-  const view = new DataView(padded.buffer);
-  for (let block = 0; block < padded.byteLength; block += 64) {
-    for (let i = 0; i < 16; i++) m[i] = view.getUint32(block + i * 4, true);
-    let A = a0;
-    let B = b0;
-    let C = c0;
-    let D = d0;
-    for (let i = 0; i < 64; i++) {
-      let f;
-      let g;
-      if (i < 16) {
-        f = B & C | ~B & D;
-        g = i;
-      } else if (i < 32) {
-        f = D & B | ~D & C;
-        g = (5 * i + 1) % 16;
-      } else if (i < 48) {
-        f = B ^ C ^ D;
-        g = (3 * i + 5) % 16;
-      } else {
-        f = C ^ (B | ~D);
-        g = 7 * i % 16;
-      }
-      const temp = D;
-      D = C;
-      C = B;
-      const sum = A + f + (k[i] ?? 0) + (m[g] ?? 0) >>> 0;
-      const shift = s[i] ?? 0;
-      const rotated = (sum << shift | sum >>> 32 - shift) >>> 0;
-      B = B + rotated >>> 0;
-      A = temp;
-    }
-    a0 = a0 + A >>> 0;
-    b0 = b0 + B >>> 0;
-    c0 = c0 + C >>> 0;
-    d0 = d0 + D >>> 0;
-  }
-  const out = new Uint8Array(16);
-  const outView = new DataView(out.buffer);
-  outView.setUint32(0, a0, true);
-  outView.setUint32(4, b0, true);
-  outView.setUint32(8, c0, true);
-  outView.setUint32(12, d0, true);
-  return out;
+function sseCKeyRedactedString(options) {
+	return `[${options.label} ${SSE_C_KEY_REDACTION}]`;
 }
-const KEY_REDACTED = "[redacted SSE-C key]";
-class EncryptionKey {
-  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */
-  mode = "SSE-C";
-  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */
-  algorithm = "AES256";
-  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */
-  customerKey;
-  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */
-  customerKeyMd5;
-  /**
-   * Internal constructor. Use {@link EncryptionKey.fromBytes} or
-   * {@link EncryptionKey.fromBase64} instead.
-   *
-   * @param customerKey - Base64-encoded 256-bit encryption key.
-   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
-   *
-   * @internal
-   */
-  constructor(customerKey, customerKeyMd5) {
-    this.customerKey = customerKey;
-    this.customerKeyMd5 = customerKeyMd5;
-  }
-  /**
-   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
-   * required base64 MD5 digest internally.
-   *
-   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.
-   *
-   * @returns A safely-wrapped EncryptionKey ready for upload/download.
-   *
-   * @throws If the key is not exactly 32 bytes.
-   */
-  static async fromBytes(rawKey) {
-    if (rawKey.byteLength !== 32) {
-      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`);
-    }
-    const customerKey = bytesToBase64(rawKey);
-    const customerKeyMd5 = await md5Base64(rawKey);
-    return new EncryptionKey(customerKey, customerKeyMd5);
-  }
-  /**
-   * Builds an EncryptionKey from precomputed base64 strings. Use this in
-   * environments where MD5 must be computed externally (e.g., browsers).
-   *
-   * @param customerKey - Base64-encoded 256-bit encryption key.
-   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
-   *
-   * @returns A safely-wrapped EncryptionKey ready for upload/download.
-   */
-  static fromBase64(customerKey, customerKeyMd5) {
-    return new EncryptionKey(customerKey, customerKeyMd5);
-  }
-  /**
-   * Hides the key bytes from `JSON.stringify`.
-   *
-   * @returns A redacted shape: same mode and algorithm, but the key and MD5
-   *   replaced with a placeholder string.
-   */
-  toJSON() {
-    return {
-      mode: this.mode,
-      algorithm: this.algorithm,
-      customerKey: KEY_REDACTED,
-      customerKeyMd5: KEY_REDACTED
-    };
-  }
-  /**
-   * Hides the key bytes from default `toString()`.
-   *
-   * @returns A short opaque label indicating this is an SSE-C key.
-   */
-  toString() {
-    return `[EncryptionKey SSE-C ${KEY_REDACTED}]`;
-  }
-  /**
-   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).
-   *
-   * @returns A short opaque label indicating this is an SSE-C key.
-   */
-  [Symbol.for("nodejs.util.inspect.custom")]() {
-    return this.toString();
-  }
+/**
+* Wraps SSE-C key material so diagnostic stringification redacts key fields.
+*
+* The returned object keeps `customerKey` and `customerKeyMd5` readable by
+* property access for request header construction, but makes them
+* non-enumerable so object spread and generic serializers do not copy them.
+* Callers that need wire headers must read those fields directly.
+*
+* @param key - SSE-C key material to wrap.
+* @param options - Redaction label and optional encryption mode discriminator.
+*
+* @returns A redacted view with the same readable key fields.
+*/
+function redactSseCKeyMaterial(key, options) {
+	const redacted = {
+		...options.mode !== void 0 ? { mode: options.mode } : {},
+		algorithm: key.algorithm
+	};
+	Object.defineProperties(redacted, {
+		customerKey: {
+			value: key.customerKey,
+			enumerable: false
+		},
+		customerKeyMd5: {
+			value: key.customerKeyMd5,
+			enumerable: false
+		},
+		toJSON: {
+			value: () => sseCKeyRedactedJson(key, options),
+			enumerable: false
+		},
+		toString: {
+			value: () => sseCKeyRedactedString(options),
+			enumerable: false
+		}
+	});
+	Object.defineProperty(redacted, NODE_INSPECT_CUSTOM, {
+		value: () => sseCKeyRedactedString(options),
+		enumerable: false
+	});
+	return redacted;
 }
-export {
-  EncryptionAlgorithm,
-  EncryptionKey,
-  EncryptionMode,
-  SSE_B2,
-  SSE_NONE,
-  sseCustomer
+/**
+* Safe wrapper around an SSE-C customer key. Hides the key bytes from
+* `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}
+* to construct one from a raw 32-byte key; the MD5 digest is computed internally.
+*/
+var EncryptionKey = class EncryptionKey {
+	/** Encryption mode discriminant. Always `'SSE-C'` for this class. */
+	mode = "SSE-C";
+	/** Encryption algorithm. B2's S3-compatible API only supports AES-256. */
+	algorithm = "AES256";
+	/** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */
+	customerKey;
+	/** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */
+	customerKeyMd5;
+	/**
+	* Internal constructor. Use {@link EncryptionKey.fromBytes} or
+	* {@link EncryptionKey.fromBase64} instead.
+	*
+	* @param customerKey - Base64-encoded 256-bit encryption key.
+	* @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+	*
+	* @internal
+	*/
+	constructor(customerKey, customerKeyMd5) {
+		this.customerKey = customerKey;
+		this.customerKeyMd5 = customerKeyMd5;
+	}
+	/**
+	* Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
+	* required base64 MD5 digest internally.
+	*
+	* @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.
+	*
+	* @returns A safely-wrapped EncryptionKey ready for upload/download.
+	*
+	* @throws If the key is not exactly 32 bytes.
+	*/
+	static async fromBytes(rawKey) {
+		if (rawKey.byteLength !== 32) throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`);
+		const customerKey = bytesToBase64(rawKey);
+		const customerKeyMd5 = await md5Base64(rawKey);
+		return new EncryptionKey(customerKey, customerKeyMd5);
+	}
+	/**
+	* Builds an EncryptionKey from precomputed base64 strings. Use this in
+	* environments where MD5 must be computed externally (e.g., browsers).
+	*
+	* @param customerKey - Base64-encoded 256-bit encryption key.
+	* @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+	*
+	* @returns A safely-wrapped EncryptionKey ready for upload/download.
+	*/
+	static fromBase64(customerKey, customerKeyMd5) {
+		return new EncryptionKey(customerKey, customerKeyMd5);
+	}
+	/**
+	* Hides the key bytes from `JSON.stringify`.
+	*
+	* @returns A redacted shape: same mode and algorithm, but the key and MD5
+	*   replaced with a placeholder string.
+	*/
+	toJSON() {
+		return sseCKeyRedactedJson(this, {
+			label: "EncryptionKey SSE-C",
+			mode: this.mode
+		});
+	}
+	/**
+	* Hides the key bytes from default `toString()`.
+	*
+	* @returns A short opaque label indicating this is an SSE-C key.
+	*/
+	toString() {
+		return sseCKeyRedactedString({ label: "EncryptionKey SSE-C" });
+	}
+	/**
+	* Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).
+	*
+	* @returns A short opaque label indicating this is an SSE-C key.
+	*/
+	[NODE_INSPECT_CUSTOM]() {
+		return this.toString();
+	}
 };
-//# sourceMappingURL=encryption.js.map
+//#endregion
+export { EncryptionAlgorithm, EncryptionKey, EncryptionMode, SSE_B2, SSE_C_KEY_REDACTION, SSE_NONE, redactSseCKeyMaterial, sseCustomer };
+
+//# sourceMappingURL=encryption.js.map

package/dist/types/encryption.js.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.js","sources":["../../src/types/encryption.ts"],"sourcesContent":["/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /** Base64-encoded 256-bit encryption key provided by the customer. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\n/**\n * Computes the MD5 digest of the given bytes as a base64 string. Prefers\n * `node:crypto` for native speed when available; falls back to a pure-JS\n * implementation in browser / edge runtimes because WebCrypto's\n * `crypto.subtle.digest` deliberately does not support MD5.\n *\n * MD5 is used here only for SSE-C key integrity (matching the B2 wire\n * protocol). It is **not** a security boundary; the customer key itself is\n * the secret. Bundling a pure-JS fallback keeps `EncryptionKey.fromBytes`\n * isomorphic.\n *\n * @param bytes - The bytes to digest.\n *\n * @returns The base64-encoded MD5 digest.\n */\nasync function md5Base64(bytes: Uint8Array): Promise<string> {\n  try {\n    const { createHash } = await import('node:crypto')\n    // Vite's browser shim resolves the import but does not implement\n    // `createHash`. Probe explicitly so we fall through to the pure-JS path.\n    if (typeof createHash !== 'function') throw new Error('createHash unavailable')\n    return createHash('md5').update(bytes).digest('base64')\n    /* v8 ignore next 3 -- fallback only reachable in non-Node runtimes */\n  } catch {\n    return bytesToBase64(md5Bytes(bytes))\n  }\n}\n\n/**\n * Pure-JS MD5 implementation per RFC 1321. Returns the 16-byte digest of the\n * input. Used as a browser fallback for SSE-C key MD5 computation; not\n * intended for security-sensitive purposes (MD5 is broken cryptographically).\n *\n * @param data - The bytes to hash.\n *\n * @returns The 16-byte MD5 digest.\n */\nfunction md5Bytes(data: Uint8Array): Uint8Array {\n  // Padding: append 0x80, then zeros, then the original length in bits as a\n  // little-endian 64-bit integer, so the total length is a multiple of 64.\n  const originalBitLength = data.byteLength * 8\n  const padLength = ((data.byteLength + 8) >>> 6) + 1\n  const padded = new Uint8Array(padLength * 64)\n  padded.set(data)\n  padded[data.byteLength] = 0x80\n  // Write the 64-bit length (little-endian). JS bitwise ops are 32-bit, so\n  // split into low/high halves.\n  const lowBits = originalBitLength >>> 0\n  const highBits = Math.floor(originalBitLength / 0x1_0000_0000) >>> 0\n  const lengthView = new DataView(padded.buffer, padded.byteLength - 8, 8)\n  lengthView.setUint32(0, lowBits, true)\n  lengthView.setUint32(4, highBits, true)\n\n  // Per-round shift amounts.\n  const s = [\n    7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9,\n    14, 20, 5, 9, 14, 20, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21,\n    6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,\n  ]\n  // Per-round sine-derived constants K[i] = floor(2^32 * abs(sin(i + 1))).\n  const k = new Uint32Array([\n    0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,\n    0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,\n    0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,\n    0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,\n    0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,\n    0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,\n    0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,\n    0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,\n  ])\n\n  let a0 = 0x67452301\n  let b0 = 0xefcdab89\n  let c0 = 0x98badcfe\n  let d0 = 0x10325476\n\n  const m = new Uint32Array(16)\n  const view = new DataView(padded.buffer)\n  for (let block = 0; block < padded.byteLength; block += 64) {\n    for (let i = 0; i < 16; i++) m[i] = view.getUint32(block + i * 4, true)\n    let A = a0\n    let B = b0\n    let C = c0\n    let D = d0\n    for (let i = 0; i < 64; i++) {\n      let f: number\n      let g: number\n      if (i < 16) {\n        f = (B & C) | (~B & D)\n        g = i\n      } else if (i < 32) {\n        f = (D & B) | (~D & C)\n        g = (5 * i + 1) % 16\n      } else if (i < 48) {\n        f = B ^ C ^ D\n        g = (3 * i + 5) % 16\n      } else {\n        f = C ^ (B | ~D)\n        g = (7 * i) % 16\n      }\n      const temp = D\n      D = C\n      C = B\n      const sum = (A + f + (k[i] ?? 0) + (m[g] ?? 0)) >>> 0\n      const shift = s[i] ?? 0\n      const rotated = ((sum << shift) | (sum >>> (32 - shift))) >>> 0\n      B = (B + rotated) >>> 0\n      A = temp\n    }\n    a0 = (a0 + A) >>> 0\n    b0 = (b0 + B) >>> 0\n    c0 = (c0 + C) >>> 0\n    d0 = (d0 + D) >>> 0\n  }\n\n  const out = new Uint8Array(16)\n  const outView = new DataView(out.buffer)\n  outView.setUint32(0, a0, true)\n  outView.setUint32(4, b0, true)\n  outView.setUint32(8, c0, true)\n  outView.setUint32(12, d0, true)\n  return out\n}\n\nconst KEY_REDACTED = '[redacted SSE-C key]'\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return {\n      mode: this.mode,\n      algorithm: this.algorithm,\n      customerKey: KEY_REDACTED,\n      customerKeyMd5: KEY_REDACTED,\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return `[EncryptionKey SSE-C ${KEY_REDACTED}]`\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n}\n"],"names":[],"mappings":"AACO,MAAM,sBAAsB;AAAA;AAAA,EAEjC,QAAQ;AACV;AAcO,MAAM,iBAAiB;AAAA;AAAA,EAE5B,OAAO;AAAA;AAAA,EAEP,MAAM;AAAA;AAAA,EAEN,MAAM;AACR;AAmCO,MAAM,SAAuB,EAAE,MAAM,UAAU,WAAW,SAAA;AAG1D,MAAM,WAAyB,EAAE,MAAM,OAAA;AASvC,SAAS,YAAY,aAAqB,gBAA6C;AAC5F,SAAO,EAAE,MAAM,SAAS,WAAW,UAAU,aAAa,eAAA;AAC5D;AASA,SAAS,cAAc,OAA2B;AAKhD,QAAM,IAAI;AAGV,MAAI,EAAE,QAAQ;AACZ,WAAO,EAAE,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,EAC/C;AACA,MAAI,SAAS;AACb,aAAW,KAAK,MAAO,WAAU,OAAO,aAAa,CAAC;AACtD,SAAO,KAAK,MAAM;AACpB;AAiBA,eAAe,UAAU,OAAoC;AAC3D,MAAI;AACF,UAAM,EAAE,WAAA,IAAe,MAAM,OAAO,aAAa;AAGjD,QAAI,OAAO,eAAe,WAAY,OAAM,IAAI,MAAM,wBAAwB;AAC9E,WAAO,WAAW,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,QAAQ;AAAA,EAExD,QAAQ;AACN,WAAO,cAAc,SAAS,KAAK,CAAC;AAAA,EACtC;AACF;AAWA,SAAS,SAAS,MAA8B;AAG9C,QAAM,oBAAoB,KAAK,aAAa;AAC5C,QAAM,aAAc,KAAK,aAAa,MAAO,KAAK;AAClD,QAAM,SAAS,IAAI,WAAW,YAAY,EAAE;AAC5C,SAAO,IAAI,IAAI;AACf,SAAO,KAAK,UAAU,IAAI;AAG1B,QAAM,UAAU,sBAAsB;AACtC,QAAM,WAAW,KAAK,MAAM,oBAAoB,UAAa,MAAM;AACnE,QAAM,aAAa,IAAI,SAAS,OAAO,QAAQ,OAAO,aAAa,GAAG,CAAC;AACvE,aAAW,UAAU,GAAG,SAAS,IAAI;AACrC,aAAW,UAAU,GAAG,UAAU,IAAI;AAGtC,QAAM,IAAI;AAAA,IACR;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAC3F;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAC7F;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,EAAA;AAG3C,QAAM,IAAI,IAAI,YAAY;AAAA,IACxB;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,EAAA,CACrF;AAED,MAAI,KAAK;AACT,MAAI,KAAK;AACT,MAAI,KAAK;AACT,MAAI,KAAK;AAET,QAAM,IAAI,IAAI,YAAY,EAAE;AAC5B,QAAM,OAAO,IAAI,SAAS,OAAO,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,OAAO,YAAY,SAAS,IAAI;AAC1D,aAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,UAAU,QAAQ,IAAI,GAAG,IAAI;AACtE,QAAI,IAAI;AACR,QAAI,IAAI;AACR,QAAI,IAAI;AACR,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAI;AACJ,UAAI;AACJ,UAAI,IAAI,IAAI;AACV,YAAK,IAAI,IAAM,CAAC,IAAI;AACpB,YAAI;AAAA,MACN,WAAW,IAAI,IAAI;AACjB,YAAK,IAAI,IAAM,CAAC,IAAI;AACpB,aAAK,IAAI,IAAI,KAAK;AAAA,MACpB,WAAW,IAAI,IAAI;AACjB,YAAI,IAAI,IAAI;AACZ,aAAK,IAAI,IAAI,KAAK;AAAA,MACpB,OAAO;AACL,YAAI,KAAK,IAAI,CAAC;AACd,YAAK,IAAI,IAAK;AAAA,MAChB;AACA,YAAM,OAAO;AACb,UAAI;AACJ,UAAI;AACJ,YAAM,MAAO,IAAI,KAAK,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,KAAK,OAAQ;AACpD,YAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,YAAM,WAAY,OAAO,QAAU,QAAS,KAAK,WAAa;AAC9D,UAAK,IAAI,YAAa;AACtB,UAAI;AAAA,IACN;AACA,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAAA,EACpB;AAEA,QAAM,MAAM,IAAI,WAAW,EAAE;AAC7B,QAAM,UAAU,IAAI,SAAS,IAAI,MAAM;AACvC,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,IAAI,IAAI,IAAI;AAC9B,SAAO;AACT;AAEA,MAAM,eAAe;AAOd,MAAM,cAAc;AAAA;AAAA,EAEhB,OAAO;AAAA;AAAA,EAEP,YAAiC;AAAA;AAAA,EAEjC;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWD,YAAY,aAAqB,gBAAwB;AAC/D,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,UAAU,QAA4C;AACjE,QAAI,OAAO,eAAe,IAAI;AAC5B,YAAM,IAAI,MAAM,sDAAsD,OAAO,UAAU,GAAG;AAAA,IAC5F;AACA,UAAM,cAAc,cAAc,MAAM;AACxC,UAAM,iBAAiB,MAAM,UAAU,MAAM;AAC7C,WAAO,IAAI,cAAc,aAAa,cAAc;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,WAAW,aAAqB,gBAAuC;AAC5E,WAAO,IAAI,cAAc,aAAa,cAAc;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SASE;AACA,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,WAAW,KAAK;AAAA,MAChB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAAA;AAAA,EAEpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAmB;AACjB,WAAO,wBAAwB,YAAY;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,CAAC,OAAO,IAAI,4BAA4B,CAAC,IAAY;AACnD,WAAO,KAAK,SAAA;AAAA,EACd;AACF;"}
+{"version":3,"file":"encryption.js","names":[],"sources":["../../src/types/encryption.ts"],"sourcesContent":["import { md5Base64 } from '../util/md5.ts'\n\n/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /** Base64-encoded 256-bit encryption key provided by the customer. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Server-side encryption using customer-provided keys as returned by B2 responses. */\nexport interface SseCPublicSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** No-encryption shape returned by B2 response objects. */\nexport interface NoEncryptionWireSetting {\n  /** Encryption mode discriminator. B2 response payloads use null for no encryption. */\n  readonly mode: null\n  /** Encryption algorithm. B2 response payloads use null when no encryption is applied. */\n  readonly algorithm: null\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Server-side encryption setting returned by B2 response objects. */\nexport type PublicEncryptionSetting =\n  | SseB2Setting\n  | SseCPublicSetting\n  | NoEncryption\n  | NoEncryptionWireSetting\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\nexport const SSE_C_KEY_REDACTION = '[redacted SSE-C key]'\n\nconst NODE_INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom')\n\ninterface SseCKeyMaterial {\n  readonly algorithm: EncryptionAlgorithm\n  readonly customerKey: string\n  readonly customerKeyMd5: string\n}\n\ninterface SseCKeyRedactionOptions {\n  readonly label: string\n  readonly mode?: 'SSE-C'\n}\n\ninterface RedactedSseCKeyJson {\n  readonly mode?: 'SSE-C'\n  readonly algorithm: EncryptionAlgorithm\n  readonly customerKey: string\n  readonly customerKeyMd5: string\n}\n\nfunction sseCKeyRedactedJson(\n  key: SseCKeyMaterial,\n  options: SseCKeyRedactionOptions,\n): RedactedSseCKeyJson {\n  return {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n    customerKey: SSE_C_KEY_REDACTION,\n    // The MD5 is not secret key material, but it is still derived from a\n    // customer-provided key. Keep logged key views fully opaque by default.\n    customerKeyMd5: SSE_C_KEY_REDACTION,\n  }\n}\n\nfunction sseCKeyRedactedString(options: SseCKeyRedactionOptions): string {\n  return `[${options.label} ${SSE_C_KEY_REDACTION}]`\n}\n\n/**\n * Wraps SSE-C key material so diagnostic stringification redacts key fields.\n *\n * The returned object keeps `customerKey` and `customerKeyMd5` readable by\n * property access for request header construction, but makes them\n * non-enumerable so object spread and generic serializers do not copy them.\n * Callers that need wire headers must read those fields directly.\n *\n * @param key - SSE-C key material to wrap.\n * @param options - Redaction label and optional encryption mode discriminator.\n *\n * @returns A redacted view with the same readable key fields.\n */\nexport function redactSseCKeyMaterial<T extends SseCKeyMaterial>(\n  key: T,\n  options: SseCKeyRedactionOptions,\n): T {\n  const redacted = {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n  } as T & {\n    toJSON(): RedactedSseCKeyJson\n    toString(): string\n  }\n\n  Object.defineProperties(redacted, {\n    customerKey: { value: key.customerKey, enumerable: false },\n    customerKeyMd5: { value: key.customerKeyMd5, enumerable: false },\n    toJSON: { value: () => sseCKeyRedactedJson(key, options), enumerable: false },\n    toString: { value: () => sseCKeyRedactedString(options), enumerable: false },\n  })\n  Object.defineProperty(redacted, NODE_INSPECT_CUSTOM, {\n    value: () => sseCKeyRedactedString(options),\n    enumerable: false,\n  })\n\n  return redacted\n}\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return sseCKeyRedactedJson(this, { label: 'EncryptionKey SSE-C', mode: this.mode }) as {\n      mode: 'SSE-C'\n      algorithm: EncryptionAlgorithm\n      customerKey: string\n      customerKeyMd5: string\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return sseCKeyRedactedString({ label: 'EncryptionKey SSE-C' })\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [NODE_INSPECT_CUSTOM](): string {\n    return this.toString()\n  }\n}\n"],"mappings":";;;AAGA,IAAa,sBAAsB;;AAEjC,QAAQ,SACV;;;;;;;;;;AAcA,IAAa,iBAAiB;;CAE5B,OAAO;;CAEP,MAAM;;CAEN,MAAM;AACR;;AA0DA,IAAa,SAAuB;CAAE,MAAM;CAAU,WAAW;AAAS;;AAG1E,IAAa,WAAyB,EAAE,MAAM,OAAO;;;;;;;;AASrD,SAAgB,YAAY,aAAqB,gBAA6C;CAC5F,OAAO;EAAE,MAAM;EAAS,WAAW;EAAU;EAAa;CAAe;AAC3E;;;;;;;;AASA,SAAS,cAAc,OAA2B;CAKhD,MAAM,IAAI;CAGV,IAAI,EAAE,QACJ,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;CAE/C,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;AAEA,IAAa,sBAAsB;AAEnC,IAAM,sBAAsB,OAAO,IAAI,4BAA4B;AAoBnE,SAAS,oBACP,KACA,SACqB;CACrB,OAAO;EACL,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;EACf,aAAa;EAGb,gBAAgB;CAClB;AACF;AAEA,SAAS,sBAAsB,SAA0C;CACvE,OAAO,IAAI,QAAQ,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;;;;;;;AAeA,SAAgB,sBACd,KACA,SACG;CACH,MAAM,WAAW;EACf,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;CACjB;CAKA,OAAO,iBAAiB,UAAU;EAChC,aAAa;GAAE,OAAO,IAAI;GAAa,YAAY;EAAM;EACzD,gBAAgB;GAAE,OAAO,IAAI;GAAgB,YAAY;EAAM;EAC/D,QAAQ;GAAE,aAAa,oBAAoB,KAAK,OAAO;GAAG,YAAY;EAAM;EAC5E,UAAU;GAAE,aAAa,sBAAsB,OAAO;GAAG,YAAY;EAAM;CAC7E,CAAC;CACD,OAAO,eAAe,UAAU,qBAAqB;EACnD,aAAa,sBAAsB,OAAO;EAC1C,YAAY;CACd,CAAC;CAED,OAAO;AACT;;;;;;AAOA,IAAa,gBAAb,MAAa,cAAc;;CAEzB,OAAgB;;CAEhB,YAA0C;;CAE1C;;CAEA;;;;;;;;;;CAWA,YAAoB,aAAqB,gBAAwB;EAC/D,KAAK,cAAc;EACnB,KAAK,iBAAiB;CACxB;;;;;;;;;;;CAYA,aAAa,UAAU,QAA4C;EACjE,IAAI,OAAO,eAAe,IACxB,MAAM,IAAI,MAAM,sDAAsD,OAAO,WAAW,EAAE;EAE5F,MAAM,cAAc,cAAc,MAAM;EACxC,MAAM,iBAAiB,MAAM,UAAU,MAAM;EAC7C,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;;;;CAWA,OAAO,WAAW,aAAqB,gBAAuC;EAC5E,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;CAQA,SASE;EACA,OAAO,oBAAoB,MAAM;GAAE,OAAO;GAAuB,MAAM,KAAK;EAAK,CAAC;CAMpF;;;;;;CAOA,WAAmB;EACjB,OAAO,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;CAC/D;;;;;;CAOA,CAAC,uBAA+B;EAC9B,OAAO,KAAK,SAAS;CACvB;AACF"}

package/dist/types/errors.cjs

@@ -0,0 +1,56 @@
+//#region src/types/errors.ts
+/**
+* B2 API error codes documented by the SDK.
+* This list drives `KnownB2ErrorCode`; `B2ErrorCode` adds a string fallback
+* so callers can receive unknown future server codes while keeping autocomplete
+* for known values.
+*/
+var KNOWN_B2_ERROR_CODES = [
+	"expired_auth_token",
+	"bad_auth_token",
+	"unauthorized",
+	"bad_request",
+	"bad_bucket_name",
+	"bad_bucket_id",
+	"not_found",
+	"method_not_allowed",
+	"request_timeout",
+	"too_many_requests",
+	"conflict",
+	"duplicate_bucket_name",
+	"too_many_buckets",
+	"too_many_files",
+	"too_many_members",
+	"cap_exceeded",
+	"storage_cap_exceeded",
+	"transaction_cap_exceeded",
+	"download_cap_exceeded",
+	"access_denied",
+	"service_unavailable",
+	"internal_error",
+	"bad_json",
+	"invalid_account_id",
+	"invalid_bucket_id",
+	"invalid_bucket_name",
+	"invalid_bucket_info",
+	"invalid_computer_id",
+	"invalid_email",
+	"invalid_group_id",
+	"invalid_member_account_id",
+	"invalid_region",
+	"invalid_sms_phone",
+	"file_not_present",
+	"no_such_file",
+	"out_of_range",
+	"range_not_satisfiable",
+	"invalid_file_id",
+	"invalid_file_name",
+	"invalid_file_info",
+	"invalid_part_number",
+	"method_failure",
+	"bad_sha1_checksum"
+];
+//#endregion
+exports.KNOWN_B2_ERROR_CODES = KNOWN_B2_ERROR_CODES;
+
+//# sourceMappingURL=errors.cjs.map

package/dist/types/errors.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.cjs","names":[],"sources":["../../src/types/errors.ts"],"sourcesContent":["/**\n * B2 API error codes documented by the SDK.\n * This list drives `KnownB2ErrorCode`; `B2ErrorCode` adds a string fallback\n * so callers can receive unknown future server codes while keeping autocomplete\n * for known values.\n */\nexport const KNOWN_B2_ERROR_CODES = [\n  'expired_auth_token',\n  'bad_auth_token',\n  'unauthorized',\n  'bad_request',\n  'bad_bucket_name',\n  'bad_bucket_id',\n  'not_found',\n  'method_not_allowed',\n  'request_timeout',\n  'too_many_requests',\n  'conflict',\n  'duplicate_bucket_name',\n  'too_many_buckets',\n  'too_many_files',\n  'too_many_members',\n  'cap_exceeded',\n  'storage_cap_exceeded',\n  'transaction_cap_exceeded',\n  'download_cap_exceeded',\n  'access_denied',\n  'service_unavailable',\n  'internal_error',\n  'bad_json',\n  'invalid_account_id',\n  'invalid_bucket_id',\n  'invalid_bucket_name',\n  'invalid_bucket_info',\n  'invalid_computer_id',\n  'invalid_email',\n  'invalid_group_id',\n  'invalid_member_account_id',\n  'invalid_region',\n  'invalid_sms_phone',\n  'file_not_present',\n  'no_such_file',\n  'out_of_range',\n  'range_not_satisfiable',\n  'invalid_file_id',\n  'invalid_file_name',\n  'invalid_file_info',\n  'invalid_part_number',\n  'method_failure',\n  'bad_sha1_checksum',\n] as const\n\n/** B2 error codes documented by the SDK and classified exhaustively. */\nexport type KnownB2ErrorCode = (typeof KNOWN_B2_ERROR_CODES)[number]\n\n/**\n * B2 API error code value.\n * Known codes are enumerated for autocomplete; unknown future server codes are\n * still accepted as strings.\n */\nexport type B2ErrorCode = KnownB2ErrorCode | (string & {})\n\n/** Standard error response body returned by the B2 API on failure. */\nexport interface B2ErrorResponse {\n  /** HTTP status code from the B2 API response. */\n  readonly status: number\n  /** Machine-readable error code identifying the specific failure. */\n  readonly code: B2ErrorCode\n  /** Human-readable description of the error. */\n  readonly message: string\n}\n"],"mappings":";;;;;;;AAMA,IAAa,uBAAuB;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}