@backblaze-labs/b2-sdk 0.1.0

package/dist/types/encryption.d.cts

@@ -0,0 +1,132 @@
+/** Named constants for the supported server-side encryption algorithms. */
+export declare const EncryptionAlgorithm: {
+    /** AES with a 256-bit key. The only algorithm B2 currently supports. */
+    readonly Aes256: "AES256";
+};
+/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */
+export type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm];
+/**
+ * Named constants for the server-side encryption mode used by a file.
+ *
+ * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and
+ * {@link sseCustomer} helpers below which return complete
+ * {@link EncryptionSetting} objects. These constants are useful when you
+ * need the bare mode discriminator (e.g., when introspecting a file's
+ * current encryption setting).
+ */
+export declare const EncryptionMode: {
+    /** B2-managed encryption keys. */
+    readonly SseB2: "SSE-B2";
+    /** Customer-provided encryption keys. */
+    readonly SseC: "SSE-C";
+    /** No encryption. */
+    readonly None: "none";
+};
+/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */
+export type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode];
+/** Server-side encryption using B2-managed keys (SSE-B2). */
+export interface SseB2Setting {
+    /** Encryption mode discriminator. Always `'SSE-B2'`. */
+    readonly mode: 'SSE-B2';
+    /** Encryption algorithm. Always `'AES256'`. */
+    readonly algorithm: EncryptionAlgorithm;
+}
+/** Server-side encryption using customer-provided keys (SSE-C). */
+export interface SseCCustomerSetting {
+    /** Encryption mode discriminator. Always `'SSE-C'`. */
+    readonly mode: 'SSE-C';
+    /** Encryption algorithm. Always `'AES256'`. */
+    readonly algorithm: EncryptionAlgorithm;
+    /** Base64-encoded 256-bit encryption key provided by the customer. */
+    readonly customerKey: string;
+    /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */
+    readonly customerKeyMd5: string;
+}
+/** Indicates no server-side encryption is applied. */
+export interface NoEncryption {
+    /** Encryption mode discriminator. Always `'none'`. */
+    readonly mode: 'none';
+}
+/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */
+export type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption;
+/** Pre-built SSE-B2 encryption setting using AES-256. */
+export declare const SSE_B2: SseB2Setting;
+/** Pre-built setting indicating no server-side encryption. */
+export declare const SSE_NONE: NoEncryption;
+/**
+ * Creates an SSE-C encryption setting with a customer-provided key.
+ * @param customerKey - Base64-encoded 256-bit encryption key.
+ * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+ *
+ * @returns An SSE-C encryption setting ready to pass to upload or download calls.
+ */
+export declare function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting;
+/**
+ * Safe wrapper around an SSE-C customer key. Hides the key bytes from
+ * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}
+ * to construct one from a raw 32-byte key; the MD5 digest is computed internally.
+ */
+export declare class EncryptionKey {
+    /** Encryption mode discriminant. Always `'SSE-C'` for this class. */
+    readonly mode: "SSE-C";
+    /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */
+    readonly algorithm: EncryptionAlgorithm;
+    /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */
+    readonly customerKey: string;
+    /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */
+    readonly customerKeyMd5: string;
+    /**
+     * Internal constructor. Use {@link EncryptionKey.fromBytes} or
+     * {@link EncryptionKey.fromBase64} instead.
+     *
+     * @param customerKey - Base64-encoded 256-bit encryption key.
+     * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+     *
+     * @internal
+     */
+    private constructor();
+    /**
+     * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
+     * required base64 MD5 digest internally.
+     *
+     * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.
+     *
+     * @returns A safely-wrapped EncryptionKey ready for upload/download.
+     *
+     * @throws If the key is not exactly 32 bytes.
+     */
+    static fromBytes(rawKey: Uint8Array): Promise<EncryptionKey>;
+    /**
+     * Builds an EncryptionKey from precomputed base64 strings. Use this in
+     * environments where MD5 must be computed externally (e.g., browsers).
+     *
+     * @param customerKey - Base64-encoded 256-bit encryption key.
+     * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+     *
+     * @returns A safely-wrapped EncryptionKey ready for upload/download.
+     */
+    static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey;
+    /**
+     * Hides the key bytes from `JSON.stringify`.
+     *
+     * @returns A redacted shape: same mode and algorithm, but the key and MD5
+     *   replaced with a placeholder string.
+     */
+    toJSON(): {
+        /** Encryption mode discriminant. */
+        mode: 'SSE-C';
+        /** Encryption algorithm. */
+        algorithm: EncryptionAlgorithm;
+        /** Always the literal redaction placeholder; the real key never leaves the instance. */
+        customerKey: string;
+        /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */
+        customerKeyMd5: string;
+    };
+    /**
+     * Hides the key bytes from default `toString()`.
+     *
+     * @returns A short opaque label indicating this is an SSE-C key.
+     */
+    toString(): string;
+}
+//# sourceMappingURL=encryption.d.ts.map

package/dist/types/encryption.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAuJD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;CAYnB"}

package/dist/types/encryption.d.ts

@@ -0,0 +1,132 @@
+/** Named constants for the supported server-side encryption algorithms. */
+export declare const EncryptionAlgorithm: {
+    /** AES with a 256-bit key. The only algorithm B2 currently supports. */
+    readonly Aes256: "AES256";
+};
+/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */
+export type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm];
+/**
+ * Named constants for the server-side encryption mode used by a file.
+ *
+ * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and
+ * {@link sseCustomer} helpers below which return complete
+ * {@link EncryptionSetting} objects. These constants are useful when you
+ * need the bare mode discriminator (e.g., when introspecting a file's
+ * current encryption setting).
+ */
+export declare const EncryptionMode: {
+    /** B2-managed encryption keys. */
+    readonly SseB2: "SSE-B2";
+    /** Customer-provided encryption keys. */
+    readonly SseC: "SSE-C";
+    /** No encryption. */
+    readonly None: "none";
+};
+/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */
+export type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode];
+/** Server-side encryption using B2-managed keys (SSE-B2). */
+export interface SseB2Setting {
+    /** Encryption mode discriminator. Always `'SSE-B2'`. */
+    readonly mode: 'SSE-B2';
+    /** Encryption algorithm. Always `'AES256'`. */
+    readonly algorithm: EncryptionAlgorithm;
+}
+/** Server-side encryption using customer-provided keys (SSE-C). */
+export interface SseCCustomerSetting {
+    /** Encryption mode discriminator. Always `'SSE-C'`. */
+    readonly mode: 'SSE-C';
+    /** Encryption algorithm. Always `'AES256'`. */
+    readonly algorithm: EncryptionAlgorithm;
+    /** Base64-encoded 256-bit encryption key provided by the customer. */
+    readonly customerKey: string;
+    /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */
+    readonly customerKeyMd5: string;
+}
+/** Indicates no server-side encryption is applied. */
+export interface NoEncryption {
+    /** Encryption mode discriminator. Always `'none'`. */
+    readonly mode: 'none';
+}
+/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */
+export type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption;
+/** Pre-built SSE-B2 encryption setting using AES-256. */
+export declare const SSE_B2: SseB2Setting;
+/** Pre-built setting indicating no server-side encryption. */
+export declare const SSE_NONE: NoEncryption;
+/**
+ * Creates an SSE-C encryption setting with a customer-provided key.
+ * @param customerKey - Base64-encoded 256-bit encryption key.
+ * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+ *
+ * @returns An SSE-C encryption setting ready to pass to upload or download calls.
+ */
+export declare function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting;
+/**
+ * Safe wrapper around an SSE-C customer key. Hides the key bytes from
+ * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}
+ * to construct one from a raw 32-byte key; the MD5 digest is computed internally.
+ */
+export declare class EncryptionKey {
+    /** Encryption mode discriminant. Always `'SSE-C'` for this class. */
+    readonly mode: "SSE-C";
+    /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */
+    readonly algorithm: EncryptionAlgorithm;
+    /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */
+    readonly customerKey: string;
+    /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */
+    readonly customerKeyMd5: string;
+    /**
+     * Internal constructor. Use {@link EncryptionKey.fromBytes} or
+     * {@link EncryptionKey.fromBase64} instead.
+     *
+     * @param customerKey - Base64-encoded 256-bit encryption key.
+     * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+     *
+     * @internal
+     */
+    private constructor();
+    /**
+     * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
+     * required base64 MD5 digest internally.
+     *
+     * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.
+     *
+     * @returns A safely-wrapped EncryptionKey ready for upload/download.
+     *
+     * @throws If the key is not exactly 32 bytes.
+     */
+    static fromBytes(rawKey: Uint8Array): Promise<EncryptionKey>;
+    /**
+     * Builds an EncryptionKey from precomputed base64 strings. Use this in
+     * environments where MD5 must be computed externally (e.g., browsers).
+     *
+     * @param customerKey - Base64-encoded 256-bit encryption key.
+     * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+     *
+     * @returns A safely-wrapped EncryptionKey ready for upload/download.
+     */
+    static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey;
+    /**
+     * Hides the key bytes from `JSON.stringify`.
+     *
+     * @returns A redacted shape: same mode and algorithm, but the key and MD5
+     *   replaced with a placeholder string.
+     */
+    toJSON(): {
+        /** Encryption mode discriminant. */
+        mode: 'SSE-C';
+        /** Encryption algorithm. */
+        algorithm: EncryptionAlgorithm;
+        /** Always the literal redaction placeholder; the real key never leaves the instance. */
+        customerKey: string;
+        /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */
+        customerKeyMd5: string;
+    };
+    /**
+     * Hides the key bytes from default `toString()`.
+     *
+     * @returns A short opaque label indicating this is an SSE-C key.
+     */
+    toString(): string;
+}
+//# sourceMappingURL=encryption.d.ts.map

package/dist/types/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAuJD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;CAYnB"}

package/dist/types/encryption.js

@@ -0,0 +1,321 @@
+const EncryptionAlgorithm = {
+  /** AES with a 256-bit key. The only algorithm B2 currently supports. */
+  Aes256: "AES256"
+};
+const EncryptionMode = {
+  /** B2-managed encryption keys. */
+  SseB2: "SSE-B2",
+  /** Customer-provided encryption keys. */
+  SseC: "SSE-C",
+  /** No encryption. */
+  None: "none"
+};
+const SSE_B2 = { mode: "SSE-B2", algorithm: "AES256" };
+const SSE_NONE = { mode: "none" };
+function sseCustomer(customerKey, customerKeyMd5) {
+  return { mode: "SSE-C", algorithm: "AES256", customerKey, customerKeyMd5 };
+}
+function bytesToBase64(bytes) {
+  const g = globalThis;
+  if (g.Buffer) {
+    return g.Buffer.from(bytes).toString("base64");
+  }
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+async function md5Base64(bytes) {
+  try {
+    const { createHash } = await import("node:crypto");
+    if (typeof createHash !== "function") throw new Error("createHash unavailable");
+    return createHash("md5").update(bytes).digest("base64");
+  } catch {
+    return bytesToBase64(md5Bytes(bytes));
+  }
+}
+function md5Bytes(data) {
+  const originalBitLength = data.byteLength * 8;
+  const padLength = (data.byteLength + 8 >>> 6) + 1;
+  const padded = new Uint8Array(padLength * 64);
+  padded.set(data);
+  padded[data.byteLength] = 128;
+  const lowBits = originalBitLength >>> 0;
+  const highBits = Math.floor(originalBitLength / 4294967296) >>> 0;
+  const lengthView = new DataView(padded.buffer, padded.byteLength - 8, 8);
+  lengthView.setUint32(0, lowBits, true);
+  lengthView.setUint32(4, highBits, true);
+  const s = [
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21
+  ];
+  const k = new Uint32Array([
+    3614090360,
+    3905402710,
+    606105819,
+    3250441966,
+    4118548399,
+    1200080426,
+    2821735955,
+    4249261313,
+    1770035416,
+    2336552879,
+    4294925233,
+    2304563134,
+    1804603682,
+    4254626195,
+    2792965006,
+    1236535329,
+    4129170786,
+    3225465664,
+    643717713,
+    3921069994,
+    3593408605,
+    38016083,
+    3634488961,
+    3889429448,
+    568446438,
+    3275163606,
+    4107603335,
+    1163531501,
+    2850285829,
+    4243563512,
+    1735328473,
+    2368359562,
+    4294588738,
+    2272392833,
+    1839030562,
+    4259657740,
+    2763975236,
+    1272893353,
+    4139469664,
+    3200236656,
+    681279174,
+    3936430074,
+    3572445317,
+    76029189,
+    3654602809,
+    3873151461,
+    530742520,
+    3299628645,
+    4096336452,
+    1126891415,
+    2878612391,
+    4237533241,
+    1700485571,
+    2399980690,
+    4293915773,
+    2240044497,
+    1873313359,
+    4264355552,
+    2734768916,
+    1309151649,
+    4149444226,
+    3174756917,
+    718787259,
+    3951481745
+  ]);
+  let a0 = 1732584193;
+  let b0 = 4023233417;
+  let c0 = 2562383102;
+  let d0 = 271733878;
+  const m = new Uint32Array(16);
+  const view = new DataView(padded.buffer);
+  for (let block = 0; block < padded.byteLength; block += 64) {
+    for (let i = 0; i < 16; i++) m[i] = view.getUint32(block + i * 4, true);
+    let A = a0;
+    let B = b0;
+    let C = c0;
+    let D = d0;
+    for (let i = 0; i < 64; i++) {
+      let f;
+      let g;
+      if (i < 16) {
+        f = B & C | ~B & D;
+        g = i;
+      } else if (i < 32) {
+        f = D & B | ~D & C;
+        g = (5 * i + 1) % 16;
+      } else if (i < 48) {
+        f = B ^ C ^ D;
+        g = (3 * i + 5) % 16;
+      } else {
+        f = C ^ (B | ~D);
+        g = 7 * i % 16;
+      }
+      const temp = D;
+      D = C;
+      C = B;
+      const sum = A + f + (k[i] ?? 0) + (m[g] ?? 0) >>> 0;
+      const shift = s[i] ?? 0;
+      const rotated = (sum << shift | sum >>> 32 - shift) >>> 0;
+      B = B + rotated >>> 0;
+      A = temp;
+    }
+    a0 = a0 + A >>> 0;
+    b0 = b0 + B >>> 0;
+    c0 = c0 + C >>> 0;
+    d0 = d0 + D >>> 0;
+  }
+  const out = new Uint8Array(16);
+  const outView = new DataView(out.buffer);
+  outView.setUint32(0, a0, true);
+  outView.setUint32(4, b0, true);
+  outView.setUint32(8, c0, true);
+  outView.setUint32(12, d0, true);
+  return out;
+}
+const KEY_REDACTED = "[redacted SSE-C key]";
+class EncryptionKey {
+  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */
+  mode = "SSE-C";
+  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */
+  algorithm = "AES256";
+  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */
+  customerKey;
+  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */
+  customerKeyMd5;
+  /**
+   * Internal constructor. Use {@link EncryptionKey.fromBytes} or
+   * {@link EncryptionKey.fromBase64} instead.
+   *
+   * @param customerKey - Base64-encoded 256-bit encryption key.
+   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+   *
+   * @internal
+   */
+  constructor(customerKey, customerKeyMd5) {
+    this.customerKey = customerKey;
+    this.customerKeyMd5 = customerKeyMd5;
+  }
+  /**
+   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
+   * required base64 MD5 digest internally.
+   *
+   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.
+   *
+   * @returns A safely-wrapped EncryptionKey ready for upload/download.
+   *
+   * @throws If the key is not exactly 32 bytes.
+   */
+  static async fromBytes(rawKey) {
+    if (rawKey.byteLength !== 32) {
+      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`);
+    }
+    const customerKey = bytesToBase64(rawKey);
+    const customerKeyMd5 = await md5Base64(rawKey);
+    return new EncryptionKey(customerKey, customerKeyMd5);
+  }
+  /**
+   * Builds an EncryptionKey from precomputed base64 strings. Use this in
+   * environments where MD5 must be computed externally (e.g., browsers).
+   *
+   * @param customerKey - Base64-encoded 256-bit encryption key.
+   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.
+   *
+   * @returns A safely-wrapped EncryptionKey ready for upload/download.
+   */
+  static fromBase64(customerKey, customerKeyMd5) {
+    return new EncryptionKey(customerKey, customerKeyMd5);
+  }
+  /**
+   * Hides the key bytes from `JSON.stringify`.
+   *
+   * @returns A redacted shape: same mode and algorithm, but the key and MD5
+   *   replaced with a placeholder string.
+   */
+  toJSON() {
+    return {
+      mode: this.mode,
+      algorithm: this.algorithm,
+      customerKey: KEY_REDACTED,
+      customerKeyMd5: KEY_REDACTED
+    };
+  }
+  /**
+   * Hides the key bytes from default `toString()`.
+   *
+   * @returns A short opaque label indicating this is an SSE-C key.
+   */
+  toString() {
+    return `[EncryptionKey SSE-C ${KEY_REDACTED}]`;
+  }
+  /**
+   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).
+   *
+   * @returns A short opaque label indicating this is an SSE-C key.
+   */
+  [Symbol.for("nodejs.util.inspect.custom")]() {
+    return this.toString();
+  }
+}
+export {
+  EncryptionAlgorithm,
+  EncryptionKey,
+  EncryptionMode,
+  SSE_B2,
+  SSE_NONE,
+  sseCustomer
+};
+//# sourceMappingURL=encryption.js.map

package/dist/types/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sources":["../../src/types/encryption.ts"],"sourcesContent":["/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /** Base64-encoded 256-bit encryption key provided by the customer. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\n/**\n * Computes the MD5 digest of the given bytes as a base64 string. Prefers\n * `node:crypto` for native speed when available; falls back to a pure-JS\n * implementation in browser / edge runtimes because WebCrypto's\n * `crypto.subtle.digest` deliberately does not support MD5.\n *\n * MD5 is used here only for SSE-C key integrity (matching the B2 wire\n * protocol). It is **not** a security boundary; the customer key itself is\n * the secret. Bundling a pure-JS fallback keeps `EncryptionKey.fromBytes`\n * isomorphic.\n *\n * @param bytes - The bytes to digest.\n *\n * @returns The base64-encoded MD5 digest.\n */\nasync function md5Base64(bytes: Uint8Array): Promise<string> {\n  try {\n    const { createHash } = await import('node:crypto')\n    // Vite's browser shim resolves the import but does not implement\n    // `createHash`. Probe explicitly so we fall through to the pure-JS path.\n    if (typeof createHash !== 'function') throw new Error('createHash unavailable')\n    return createHash('md5').update(bytes).digest('base64')\n    /* v8 ignore next 3 -- fallback only reachable in non-Node runtimes */\n  } catch {\n    return bytesToBase64(md5Bytes(bytes))\n  }\n}\n\n/**\n * Pure-JS MD5 implementation per RFC 1321. Returns the 16-byte digest of the\n * input. Used as a browser fallback for SSE-C key MD5 computation; not\n * intended for security-sensitive purposes (MD5 is broken cryptographically).\n *\n * @param data - The bytes to hash.\n *\n * @returns The 16-byte MD5 digest.\n */\nfunction md5Bytes(data: Uint8Array): Uint8Array {\n  // Padding: append 0x80, then zeros, then the original length in bits as a\n  // little-endian 64-bit integer, so the total length is a multiple of 64.\n  const originalBitLength = data.byteLength * 8\n  const padLength = ((data.byteLength + 8) >>> 6) + 1\n  const padded = new Uint8Array(padLength * 64)\n  padded.set(data)\n  padded[data.byteLength] = 0x80\n  // Write the 64-bit length (little-endian). JS bitwise ops are 32-bit, so\n  // split into low/high halves.\n  const lowBits = originalBitLength >>> 0\n  const highBits = Math.floor(originalBitLength / 0x1_0000_0000) >>> 0\n  const lengthView = new DataView(padded.buffer, padded.byteLength - 8, 8)\n  lengthView.setUint32(0, lowBits, true)\n  lengthView.setUint32(4, highBits, true)\n\n  // Per-round shift amounts.\n  const s = [\n    7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9,\n    14, 20, 5, 9, 14, 20, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21,\n    6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,\n  ]\n  // Per-round sine-derived constants K[i] = floor(2^32 * abs(sin(i + 1))).\n  const k = new Uint32Array([\n    0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,\n    0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,\n    0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,\n    0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,\n    0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,\n    0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,\n    0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,\n    0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,\n  ])\n\n  let a0 = 0x67452301\n  let b0 = 0xefcdab89\n  let c0 = 0x98badcfe\n  let d0 = 0x10325476\n\n  const m = new Uint32Array(16)\n  const view = new DataView(padded.buffer)\n  for (let block = 0; block < padded.byteLength; block += 64) {\n    for (let i = 0; i < 16; i++) m[i] = view.getUint32(block + i * 4, true)\n    let A = a0\n    let B = b0\n    let C = c0\n    let D = d0\n    for (let i = 0; i < 64; i++) {\n      let f: number\n      let g: number\n      if (i < 16) {\n        f = (B & C) | (~B & D)\n        g = i\n      } else if (i < 32) {\n        f = (D & B) | (~D & C)\n        g = (5 * i + 1) % 16\n      } else if (i < 48) {\n        f = B ^ C ^ D\n        g = (3 * i + 5) % 16\n      } else {\n        f = C ^ (B | ~D)\n        g = (7 * i) % 16\n      }\n      const temp = D\n      D = C\n      C = B\n      const sum = (A + f + (k[i] ?? 0) + (m[g] ?? 0)) >>> 0\n      const shift = s[i] ?? 0\n      const rotated = ((sum << shift) | (sum >>> (32 - shift))) >>> 0\n      B = (B + rotated) >>> 0\n      A = temp\n    }\n    a0 = (a0 + A) >>> 0\n    b0 = (b0 + B) >>> 0\n    c0 = (c0 + C) >>> 0\n    d0 = (d0 + D) >>> 0\n  }\n\n  const out = new Uint8Array(16)\n  const outView = new DataView(out.buffer)\n  outView.setUint32(0, a0, true)\n  outView.setUint32(4, b0, true)\n  outView.setUint32(8, c0, true)\n  outView.setUint32(12, d0, true)\n  return out\n}\n\nconst KEY_REDACTED = '[redacted SSE-C key]'\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return {\n      mode: this.mode,\n      algorithm: this.algorithm,\n      customerKey: KEY_REDACTED,\n      customerKeyMd5: KEY_REDACTED,\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return `[EncryptionKey SSE-C ${KEY_REDACTED}]`\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return this.toString()\n  }\n}\n"],"names":[],"mappings":"AACO,MAAM,sBAAsB;AAAA;AAAA,EAEjC,QAAQ;AACV;AAcO,MAAM,iBAAiB;AAAA;AAAA,EAE5B,OAAO;AAAA;AAAA,EAEP,MAAM;AAAA;AAAA,EAEN,MAAM;AACR;AAmCO,MAAM,SAAuB,EAAE,MAAM,UAAU,WAAW,SAAA;AAG1D,MAAM,WAAyB,EAAE,MAAM,OAAA;AASvC,SAAS,YAAY,aAAqB,gBAA6C;AAC5F,SAAO,EAAE,MAAM,SAAS,WAAW,UAAU,aAAa,eAAA;AAC5D;AASA,SAAS,cAAc,OAA2B;AAKhD,QAAM,IAAI;AAGV,MAAI,EAAE,QAAQ;AACZ,WAAO,EAAE,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAAA,EAC/C;AACA,MAAI,SAAS;AACb,aAAW,KAAK,MAAO,WAAU,OAAO,aAAa,CAAC;AACtD,SAAO,KAAK,MAAM;AACpB;AAiBA,eAAe,UAAU,OAAoC;AAC3D,MAAI;AACF,UAAM,EAAE,WAAA,IAAe,MAAM,OAAO,aAAa;AAGjD,QAAI,OAAO,eAAe,WAAY,OAAM,IAAI,MAAM,wBAAwB;AAC9E,WAAO,WAAW,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,QAAQ;AAAA,EAExD,QAAQ;AACN,WAAO,cAAc,SAAS,KAAK,CAAC;AAAA,EACtC;AACF;AAWA,SAAS,SAAS,MAA8B;AAG9C,QAAM,oBAAoB,KAAK,aAAa;AAC5C,QAAM,aAAc,KAAK,aAAa,MAAO,KAAK;AAClD,QAAM,SAAS,IAAI,WAAW,YAAY,EAAE;AAC5C,SAAO,IAAI,IAAI;AACf,SAAO,KAAK,UAAU,IAAI;AAG1B,QAAM,UAAU,sBAAsB;AACtC,QAAM,WAAW,KAAK,MAAM,oBAAoB,UAAa,MAAM;AACnE,QAAM,aAAa,IAAI,SAAS,OAAO,QAAQ,OAAO,aAAa,GAAG,CAAC;AACvE,aAAW,UAAU,GAAG,SAAS,IAAI;AACrC,aAAW,UAAU,GAAG,UAAU,IAAI;AAGtC,QAAM,IAAI;AAAA,IACR;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAC3F;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAC7F;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,IAAI;AAAA,IAAG;AAAA,IAAI;AAAA,IAAI;AAAA,EAAA;AAG3C,QAAM,IAAI,IAAI,YAAY;AAAA,IACxB;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IACpF;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,IAAY;AAAA,EAAA,CACrF;AAED,MAAI,KAAK;AACT,MAAI,KAAK;AACT,MAAI,KAAK;AACT,MAAI,KAAK;AAET,QAAM,IAAI,IAAI,YAAY,EAAE;AAC5B,QAAM,OAAO,IAAI,SAAS,OAAO,MAAM;AACvC,WAAS,QAAQ,GAAG,QAAQ,OAAO,YAAY,SAAS,IAAI;AAC1D,aAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,UAAU,QAAQ,IAAI,GAAG,IAAI;AACtE,QAAI,IAAI;AACR,QAAI,IAAI;AACR,QAAI,IAAI;AACR,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAI;AACJ,UAAI;AACJ,UAAI,IAAI,IAAI;AACV,YAAK,IAAI,IAAM,CAAC,IAAI;AACpB,YAAI;AAAA,MACN,WAAW,IAAI,IAAI;AACjB,YAAK,IAAI,IAAM,CAAC,IAAI;AACpB,aAAK,IAAI,IAAI,KAAK;AAAA,MACpB,WAAW,IAAI,IAAI;AACjB,YAAI,IAAI,IAAI;AACZ,aAAK,IAAI,IAAI,KAAK;AAAA,MACpB,OAAO;AACL,YAAI,KAAK,IAAI,CAAC;AACd,YAAK,IAAI,IAAK;AAAA,MAChB;AACA,YAAM,OAAO;AACb,UAAI;AACJ,UAAI;AACJ,YAAM,MAAO,IAAI,KAAK,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,KAAK,OAAQ;AACpD,YAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,YAAM,WAAY,OAAO,QAAU,QAAS,KAAK,WAAa;AAC9D,UAAK,IAAI,YAAa;AACtB,UAAI;AAAA,IACN;AACA,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAClB,SAAM,KAAK,MAAO;AAAA,EACpB;AAEA,QAAM,MAAM,IAAI,WAAW,EAAE;AAC7B,QAAM,UAAU,IAAI,SAAS,IAAI,MAAM;AACvC,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,GAAG,IAAI,IAAI;AAC7B,UAAQ,UAAU,IAAI,IAAI,IAAI;AAC9B,SAAO;AACT;AAEA,MAAM,eAAe;AAOd,MAAM,cAAc;AAAA;AAAA,EAEhB,OAAO;AAAA;AAAA,EAEP,YAAiC;AAAA;AAAA,EAEjC;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWD,YAAY,aAAqB,gBAAwB;AAC/D,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,UAAU,QAA4C;AACjE,QAAI,OAAO,eAAe,IAAI;AAC5B,YAAM,IAAI,MAAM,sDAAsD,OAAO,UAAU,GAAG;AAAA,IAC5F;AACA,UAAM,cAAc,cAAc,MAAM;AACxC,UAAM,iBAAiB,MAAM,UAAU,MAAM;AAC7C,WAAO,IAAI,cAAc,aAAa,cAAc;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,WAAW,aAAqB,gBAAuC;AAC5E,WAAO,IAAI,cAAc,aAAa,cAAc;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SASE;AACA,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,WAAW,KAAK;AAAA,MAChB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAAA;AAAA,EAEpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAmB;AACjB,WAAO,wBAAwB,YAAY;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,CAAC,OAAO,IAAI,4BAA4B,CAAC,IAAY;AACnD,WAAO,KAAK,SAAA;AAAA,EACd;AACF;"}

package/dist/types/errors.d.cts

@@ -0,0 +1,16 @@
+/**
+ * Known B2 API error codes.
+ * The union includes a `string & {}` fallback to allow unknown error codes
+ * while still providing autocomplete for well-known values.
+ */
+export type B2ErrorCode = 'expired_auth_token' | 'bad_auth_token' | 'unauthorized' | 'bad_request' | 'bad_bucket_id' | 'not_found' | 'method_not_allowed' | 'request_timeout' | 'conflict' | 'duplicate_bucket_name' | 'too_many_buckets' | 'too_many_files' | 'cap_exceeded' | 'storage_cap_exceeded' | 'transaction_cap_exceeded' | 'access_denied' | 'service_unavailable' | 'internal_error' | 'bad_json' | 'invalid_bucket_id' | 'file_not_present' | 'no_such_file' | 'out_of_range' | 'range_not_satisfiable' | 'invalid_file_id' | 'invalid_part_number' | 'bad_sha1_checksum' | 'download_cap_exceeded' | (string & {});
+/** Standard error response body returned by the B2 API on failure. */
+export interface B2ErrorResponse {
+    /** HTTP status code from the B2 API response. */
+    readonly status: number;
+    /** Machine-readable error code identifying the specific failure. */
+    readonly code: B2ErrorCode;
+    /** Human-readable description of the error. */
+    readonly message: string;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/types/errors.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/types/errors.js"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB,oBAAoB,GACpB,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,eAAe,GACf,WAAW,GACX,oBAAoB,GACpB,iBAAiB,GACjB,UAAU,GACV,uBAAuB,GACvB,kBAAkB,GAClB,gBAAgB,GAChB,cAAc,GACd,sBAAsB,GACtB,0BAA0B,GAC1B,eAAe,GACf,qBAAqB,GACrB,gBAAgB,GAChB,UAAU,GACV,mBAAmB,GACnB,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,uBAAuB,GACvB,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,GACnB,uBAAuB,GACvB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB"}

package/dist/types/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Known B2 API error codes.
+ * The union includes a `string & {}` fallback to allow unknown error codes
+ * while still providing autocomplete for well-known values.
+ */
+export type B2ErrorCode = 'expired_auth_token' | 'bad_auth_token' | 'unauthorized' | 'bad_request' | 'bad_bucket_id' | 'not_found' | 'method_not_allowed' | 'request_timeout' | 'conflict' | 'duplicate_bucket_name' | 'too_many_buckets' | 'too_many_files' | 'cap_exceeded' | 'storage_cap_exceeded' | 'transaction_cap_exceeded' | 'access_denied' | 'service_unavailable' | 'internal_error' | 'bad_json' | 'invalid_bucket_id' | 'file_not_present' | 'no_such_file' | 'out_of_range' | 'range_not_satisfiable' | 'invalid_file_id' | 'invalid_part_number' | 'bad_sha1_checksum' | 'download_cap_exceeded' | (string & {});
+/** Standard error response body returned by the B2 API on failure. */
+export interface B2ErrorResponse {
+    /** HTTP status code from the B2 API response. */
+    readonly status: number;
+    /** Machine-readable error code identifying the specific failure. */
+    readonly code: B2ErrorCode;
+    /** Human-readable description of the error. */
+    readonly message: string;
+}
+//# sourceMappingURL=errors.d.ts.map