@backblaze-labs/b2-sdk 0.2.0 → 0.3.0

package/dist/partner/redaction.js

@@ -0,0 +1,257 @@
+import { B2PartnerAuthorizationError } from "../errors/index.js";
+import { APPLICATION_KEY_REDACTED, PARTNER_TOKEN_REDACTED } from "./redaction-placeholders.js";
+//#region src/partner/redaction.ts
+var inspectSymbol = Symbol.for("nodejs.util.inspect.custom");
+function installPortableJsonHook(target, toJson) {
+	const originalPrototype = Object.getPrototypeOf(target);
+	const redactionPrototype = Object.create(originalPrototype);
+	Object.defineProperty(redactionPrototype, "toJSON", {
+		value: toJson,
+		enumerable: false,
+		configurable: true
+	});
+	Object.setPrototypeOf(target, redactionPrototype);
+	Object.defineProperty(target, "toJSON", {
+		value: toJson,
+		enumerable: false,
+		configurable: true
+	});
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide tokens.
+*
+* @param auth - Partner authorization response to render safely.
+*
+* @returns A plain object with the Partner token replaced by a placeholder.
+*/
+function partnerAuthorizeResponseToRedactedJson(auth) {
+	return {
+		...auth,
+		authorizationToken: PARTNER_TOKEN_REDACTED
+	};
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide group-member keys.
+*
+* @param result - Create group member result to render safely.
+*
+* @returns A plain object with the application key secret replaced by a placeholder.
+*/
+function createGroupMemberResultToRedactedJson(result) {
+	return {
+		...result,
+		applicationKey: APPLICATION_KEY_REDACTED
+	};
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide group-member keys.
+*
+* @param response - Create group member response to render safely.
+*
+* @returns A plain array with every application key secret replaced by a placeholder.
+*/
+function createGroupMemberResponseToRedactedJson(response) {
+	return response.map((result) => createGroupMemberResultToRedactedJson(result));
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide trial account keys.
+*
+* @param result - Reserve trial account result to render safely.
+*
+* @returns A plain object with the application key secret replaced by a placeholder.
+*/
+function reserveTrialCreateAccountResultToRedactedJson(result) {
+	return {
+		...result,
+		applicationKey: APPLICATION_KEY_REDACTED
+	};
+}
+/**
+* Returns a redacted copy for log serializers that intentionally hide trial account keys.
+*
+* @param response - Reserve trial account response to render safely.
+*
+* @returns A plain array with every application key secret replaced by a placeholder.
+*/
+function reserveTrialCreateAccountResponseToRedactedJson(response) {
+	return response.map((result) => reserveTrialCreateAccountResultToRedactedJson(result));
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact the
+* Partner token through `JSON.stringify`, `toString`, and Node `util.inspect`
+* while preserving direct property access.
+*
+* `JSON.stringify` no longer round-trips `authorizationToken` from protected
+* authorize responses. Persist trusted auth caches with
+* `partnerAuthorizeResponseForPersistence(auth)` only into encrypted or
+* otherwise credential-grade storage, or read `authorizationToken` directly
+* into secure storage before serializing.
+*
+* This does not make the object universally log-safe: object spread,
+* `Object.assign`, `Object.entries`, `structuredClone`, and serializers that
+* walk enumerable properties can still expose the raw token.
+*
+* @param auth - Partner authorization response to protect from accidental inspection.
+*
+* @returns The same auth object with inspection hooks installed when possible.
+*/
+function redactPartnerAuthorizeResponse(auth) {
+	const target = Object.isExtensible(auth) ? auth : { ...auth };
+	const toRedactedJson = () => partnerAuthorizeResponseToRedactedJson(target);
+	const toRedactedString = () => `[PartnerAuthorizeResponse ${PARTNER_TOKEN_REDACTED}]`;
+	installPortableJsonHook(target, toRedactedJson);
+	Object.defineProperties(target, {
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact the
+* application key secret while preserving direct property access.
+*
+* @param result - Create group member result to protect from accidental logging.
+*
+* @returns The same result object with redaction hooks installed when possible.
+*/
+function redactCreateGroupMemberResult(result) {
+	const target = Object.isExtensible(result) ? result : { ...result };
+	const toRedactedJson = () => createGroupMemberResultToRedactedJson(target);
+	const toRedactedString = () => `[CreateGroupMemberResult ${APPLICATION_KEY_REDACTED}]`;
+	installPortableJsonHook(target, toRedactedJson);
+	Object.defineProperties(target, {
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact all
+* create-group-member application key secrets while preserving direct access.
+*
+* @param response - Create group member response to protect from accidental logging.
+*
+* @returns The same response array with redaction hooks installed when possible.
+*
+* @throws B2PartnerAuthorizationError if the response is not an array.
+*/
+function redactCreateGroupMemberResponse(response) {
+	if (!Array.isArray(response)) throw new B2PartnerAuthorizationError("b2_create_group_member response was not a JSON array");
+	const target = Object.isExtensible(response) ? response : [...response];
+	const writableTarget = target;
+	for (let i = 0; i < writableTarget.length; i++) {
+		const result = writableTarget[i];
+		if (result !== void 0) writableTarget[i] = redactCreateGroupMemberResult(result);
+	}
+	const toRedactedJson = () => createGroupMemberResponseToRedactedJson(target);
+	const toRedactedString = () => `[CreateGroupMemberResponse ${APPLICATION_KEY_REDACTED}]`;
+	Object.defineProperties(target, {
+		toJSON: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		},
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact the
+* application key secret while preserving direct property access.
+*
+* `JSON.stringify` redacts because the response contains newly minted
+* application key secrets that are commonly logged as batch results. Callers
+* that need to persist the key should read `applicationKey` directly into
+* secure storage before serializing the object.
+*
+* @param result - Reserve trial account result to protect from accidental logging.
+*
+* @returns The same result object with redaction hooks installed when possible.
+*/
+function redactReserveTrialCreateAccountResult(result) {
+	const target = Object.isExtensible(result) ? result : { ...result };
+	const toRedactedJson = () => reserveTrialCreateAccountResultToRedactedJson(target);
+	const toRedactedString = () => `[ReserveTrialCreateAccountResult ${APPLICATION_KEY_REDACTED}]`;
+	installPortableJsonHook(target, toRedactedJson);
+	Object.defineProperties(target, {
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+/**
+* Adds non-enumerable serialization and inspection hooks that redact all
+* reserve-trial application key secrets while preserving direct property access.
+*
+* @param response - Reserve trial account response to protect from accidental logging.
+*
+* @returns The same response array with redaction hooks installed when possible.
+*
+* @throws B2PartnerAuthorizationError if the response is not an array.
+*/
+function redactReserveTrialCreateAccountResponse(response) {
+	if (!Array.isArray(response)) throw new B2PartnerAuthorizationError("b2_reserve_trial_create_account response was not a JSON array");
+	const target = Object.isExtensible(response) ? response : [...response];
+	const writableTarget = target;
+	for (let i = 0; i < writableTarget.length; i++) {
+		const result = writableTarget[i];
+		if (result !== void 0) writableTarget[i] = redactReserveTrialCreateAccountResult(result);
+	}
+	const toRedactedJson = () => reserveTrialCreateAccountResponseToRedactedJson(target);
+	const toRedactedString = () => `[ReserveTrialCreateAccountResponse ${APPLICATION_KEY_REDACTED}]`;
+	Object.defineProperties(target, {
+		toJSON: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		},
+		toString: {
+			value: toRedactedString,
+			enumerable: false,
+			configurable: true
+		},
+		[inspectSymbol]: {
+			value: toRedactedJson,
+			enumerable: false,
+			configurable: true
+		}
+	});
+	return target;
+}
+//#endregion
+export { PARTNER_TOKEN_REDACTED, createGroupMemberResponseToRedactedJson, createGroupMemberResultToRedactedJson, partnerAuthorizeResponseToRedactedJson, redactCreateGroupMemberResponse, redactCreateGroupMemberResult, redactPartnerAuthorizeResponse, redactReserveTrialCreateAccountResponse, redactReserveTrialCreateAccountResult, reserveTrialCreateAccountResponseToRedactedJson, reserveTrialCreateAccountResultToRedactedJson };
+
+//# sourceMappingURL=redaction.js.map

package/dist/partner/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","names":[],"sources":["../../src/partner/redaction.ts"],"sourcesContent":["import { B2PartnerAuthorizationError } from '../errors/index.ts'\nimport type {\n  CreateGroupMemberResponse,\n  CreateGroupMemberResult,\n  PartnerAuthorizeResponse,\n  ReserveTrialCreateAccountResponse,\n  ReserveTrialCreateAccountResult,\n} from '../types/partner.ts'\nimport { APPLICATION_KEY_REDACTED, PARTNER_TOKEN_REDACTED } from './redaction-placeholders.ts'\n\nexport {\n  APPLICATION_KEY_REDACTED,\n  PARTNER_TOKEN_REDACTED,\n} from './redaction-placeholders.ts'\n\n/**\n * JSON-safe Partner authorize response with the Partner token replaced by a\n * placeholder string.\n */\nexport interface RedactedPartnerAuthorizeResponseJson\n  extends Omit<PartnerAuthorizeResponse, 'authorizationToken'> {\n  /** Redacted Partner authorization token placeholder. */\n  readonly authorizationToken: string\n}\n\nexport type RedactedCreateGroupMemberResultJson = Omit<\n  CreateGroupMemberResult,\n  'applicationKey'\n> & {\n  readonly applicationKey: string\n}\n\nexport type RedactedCreateGroupMemberResponseJson = readonly RedactedCreateGroupMemberResultJson[]\n\nexport type RedactedReserveTrialCreateAccountResultJson = Omit<\n  ReserveTrialCreateAccountResult,\n  'applicationKey'\n> & {\n  readonly applicationKey: string\n}\n\nexport type RedactedReserveTrialCreateAccountResponseJson =\n  readonly RedactedReserveTrialCreateAccountResultJson[]\n\nconst inspectSymbol = Symbol.for('nodejs.util.inspect.custom')\n\n// Bun/WebKit only honor object toJSON hooks when they are inherited, while Node\n// honors own hooks. Install both shapes so SDK safe serialization is portable.\nfunction installPortableJsonHook<T extends object>(target: T, toJson: () => unknown): void {\n  const originalPrototype = Object.getPrototypeOf(target)\n  const redactionPrototype = Object.create(originalPrototype) as object\n  Object.defineProperty(redactionPrototype, 'toJSON', {\n    value: toJson,\n    enumerable: false,\n    configurable: true,\n  })\n  Object.setPrototypeOf(target, redactionPrototype)\n  Object.defineProperty(target, 'toJSON', {\n    value: toJson,\n    enumerable: false,\n    configurable: true,\n  })\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide tokens.\n *\n * @param auth - Partner authorization response to render safely.\n *\n * @returns A plain object with the Partner token replaced by a placeholder.\n */\nexport function partnerAuthorizeResponseToRedactedJson(\n  auth: PartnerAuthorizeResponse,\n): RedactedPartnerAuthorizeResponseJson {\n  return {\n    ...auth,\n    authorizationToken: PARTNER_TOKEN_REDACTED,\n  }\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide group-member keys.\n *\n * @param result - Create group member result to render safely.\n *\n * @returns A plain object with the application key secret replaced by a placeholder.\n */\nexport function createGroupMemberResultToRedactedJson(\n  result: CreateGroupMemberResult,\n): RedactedCreateGroupMemberResultJson {\n  return {\n    ...result,\n    applicationKey: APPLICATION_KEY_REDACTED,\n  }\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide group-member keys.\n *\n * @param response - Create group member response to render safely.\n *\n * @returns A plain array with every application key secret replaced by a placeholder.\n */\nexport function createGroupMemberResponseToRedactedJson(\n  response: CreateGroupMemberResponse,\n): RedactedCreateGroupMemberResponseJson {\n  return response.map((result) => createGroupMemberResultToRedactedJson(result))\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide trial account keys.\n *\n * @param result - Reserve trial account result to render safely.\n *\n * @returns A plain object with the application key secret replaced by a placeholder.\n */\nexport function reserveTrialCreateAccountResultToRedactedJson(\n  result: ReserveTrialCreateAccountResult,\n): RedactedReserveTrialCreateAccountResultJson {\n  return {\n    ...result,\n    applicationKey: APPLICATION_KEY_REDACTED,\n  }\n}\n\n/**\n * Returns a redacted copy for log serializers that intentionally hide trial account keys.\n *\n * @param response - Reserve trial account response to render safely.\n *\n * @returns A plain array with every application key secret replaced by a placeholder.\n */\nexport function reserveTrialCreateAccountResponseToRedactedJson(\n  response: ReserveTrialCreateAccountResponse,\n): RedactedReserveTrialCreateAccountResponseJson {\n  return response.map((result) => reserveTrialCreateAccountResultToRedactedJson(result))\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact the\n * Partner token through `JSON.stringify`, `toString`, and Node `util.inspect`\n * while preserving direct property access.\n *\n * `JSON.stringify` no longer round-trips `authorizationToken` from protected\n * authorize responses. Persist trusted auth caches with\n * `partnerAuthorizeResponseForPersistence(auth)` only into encrypted or\n * otherwise credential-grade storage, or read `authorizationToken` directly\n * into secure storage before serializing.\n *\n * This does not make the object universally log-safe: object spread,\n * `Object.assign`, `Object.entries`, `structuredClone`, and serializers that\n * walk enumerable properties can still expose the raw token.\n *\n * @param auth - Partner authorization response to protect from accidental inspection.\n *\n * @returns The same auth object with inspection hooks installed when possible.\n */\nexport function redactPartnerAuthorizeResponse(\n  auth: PartnerAuthorizeResponse,\n): PartnerAuthorizeResponse {\n  const target = Object.isExtensible(auth) ? auth : { ...auth }\n  const toRedactedJson = (): RedactedPartnerAuthorizeResponseJson =>\n    partnerAuthorizeResponseToRedactedJson(target)\n  const toRedactedString = (): string => `[PartnerAuthorizeResponse ${PARTNER_TOKEN_REDACTED}]`\n\n  installPortableJsonHook(target, toRedactedJson)\n  Object.defineProperties(target, {\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact the\n * application key secret while preserving direct property access.\n *\n * @param result - Create group member result to protect from accidental logging.\n *\n * @returns The same result object with redaction hooks installed when possible.\n */\nexport function redactCreateGroupMemberResult(\n  result: CreateGroupMemberResult,\n): CreateGroupMemberResult {\n  const target = Object.isExtensible(result) ? result : { ...result }\n  const toRedactedJson = (): RedactedCreateGroupMemberResultJson =>\n    createGroupMemberResultToRedactedJson(target)\n  const toRedactedString = (): string => `[CreateGroupMemberResult ${APPLICATION_KEY_REDACTED}]`\n\n  installPortableJsonHook(target, toRedactedJson)\n  Object.defineProperties(target, {\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact all\n * create-group-member application key secrets while preserving direct access.\n *\n * @param response - Create group member response to protect from accidental logging.\n *\n * @returns The same response array with redaction hooks installed when possible.\n *\n * @throws B2PartnerAuthorizationError if the response is not an array.\n */\nexport function redactCreateGroupMemberResponse(\n  response: CreateGroupMemberResponse,\n): CreateGroupMemberResponse {\n  if (!Array.isArray(response)) {\n    throw new B2PartnerAuthorizationError('b2_create_group_member response was not a JSON array')\n  }\n\n  const target = Object.isExtensible(response) ? response : [...response]\n  const writableTarget = target as CreateGroupMemberResult[]\n  for (let i = 0; i < writableTarget.length; i++) {\n    const result = writableTarget[i]\n    if (result !== undefined) writableTarget[i] = redactCreateGroupMemberResult(result)\n  }\n\n  const toRedactedJson = (): RedactedCreateGroupMemberResponseJson =>\n    createGroupMemberResponseToRedactedJson(target)\n  const toRedactedString = (): string => `[CreateGroupMemberResponse ${APPLICATION_KEY_REDACTED}]`\n\n  Object.defineProperties(target, {\n    toJSON: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact the\n * application key secret while preserving direct property access.\n *\n * `JSON.stringify` redacts because the response contains newly minted\n * application key secrets that are commonly logged as batch results. Callers\n * that need to persist the key should read `applicationKey` directly into\n * secure storage before serializing the object.\n *\n * @param result - Reserve trial account result to protect from accidental logging.\n *\n * @returns The same result object with redaction hooks installed when possible.\n */\nexport function redactReserveTrialCreateAccountResult(\n  result: ReserveTrialCreateAccountResult,\n): ReserveTrialCreateAccountResult {\n  const target = Object.isExtensible(result) ? result : { ...result }\n  const toRedactedJson = (): RedactedReserveTrialCreateAccountResultJson =>\n    reserveTrialCreateAccountResultToRedactedJson(target)\n  const toRedactedString = (): string =>\n    `[ReserveTrialCreateAccountResult ${APPLICATION_KEY_REDACTED}]`\n\n  installPortableJsonHook(target, toRedactedJson)\n  Object.defineProperties(target, {\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n\n/**\n * Adds non-enumerable serialization and inspection hooks that redact all\n * reserve-trial application key secrets while preserving direct property access.\n *\n * @param response - Reserve trial account response to protect from accidental logging.\n *\n * @returns The same response array with redaction hooks installed when possible.\n *\n * @throws B2PartnerAuthorizationError if the response is not an array.\n */\nexport function redactReserveTrialCreateAccountResponse(\n  response: ReserveTrialCreateAccountResponse,\n): ReserveTrialCreateAccountResponse {\n  if (!Array.isArray(response)) {\n    throw new B2PartnerAuthorizationError(\n      'b2_reserve_trial_create_account response was not a JSON array',\n    )\n  }\n\n  const target = Object.isExtensible(response) ? response : [...response]\n  const writableTarget = target as ReserveTrialCreateAccountResult[]\n  for (let i = 0; i < writableTarget.length; i++) {\n    const result = writableTarget[i]\n    if (result !== undefined) writableTarget[i] = redactReserveTrialCreateAccountResult(result)\n  }\n\n  const toRedactedJson = (): RedactedReserveTrialCreateAccountResponseJson =>\n    reserveTrialCreateAccountResponseToRedactedJson(target)\n  const toRedactedString = (): string =>\n    `[ReserveTrialCreateAccountResponse ${APPLICATION_KEY_REDACTED}]`\n\n  Object.defineProperties(target, {\n    toJSON: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n    toString: {\n      value: toRedactedString,\n      enumerable: false,\n      configurable: true,\n    },\n    [inspectSymbol]: {\n      value: toRedactedJson,\n      enumerable: false,\n      configurable: true,\n    },\n  })\n\n  return target\n}\n"],"mappings":";;;AA4CA,IAAM,gBAAgB,OAAO,IAAI,4BAA4B;AAI7D,SAAS,wBAA0C,QAAW,QAA6B;CACzF,MAAM,oBAAoB,OAAO,eAAe,MAAM;CACtD,MAAM,qBAAqB,OAAO,OAAO,iBAAiB;CAC1D,OAAO,eAAe,oBAAoB,UAAU;EAClD,OAAO;EACP,YAAY;EACZ,cAAc;CAChB,CAAC;CACD,OAAO,eAAe,QAAQ,kBAAkB;CAChD,OAAO,eAAe,QAAQ,UAAU;EACtC,OAAO;EACP,YAAY;EACZ,cAAc;CAChB,CAAC;AACH;;;;;;;;AASA,SAAgB,uCACd,MACsC;CACtC,OAAO;EACL,GAAG;EACH,oBAAoB;CACtB;AACF;;;;;;;;AASA,SAAgB,sCACd,QACqC;CACrC,OAAO;EACL,GAAG;EACH,gBAAgB;CAClB;AACF;;;;;;;;AASA,SAAgB,wCACd,UACuC;CACvC,OAAO,SAAS,KAAK,WAAW,sCAAsC,MAAM,CAAC;AAC/E;;;;;;;;AASA,SAAgB,8CACd,QAC6C;CAC7C,OAAO;EACL,GAAG;EACH,gBAAgB;CAClB;AACF;;;;;;;;AASA,SAAgB,gDACd,UAC+C;CAC/C,OAAO,SAAS,KAAK,WAAW,8CAA8C,MAAM,CAAC;AACvF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,+BACd,MAC0B;CAC1B,MAAM,SAAS,OAAO,aAAa,IAAI,IAAI,OAAO,EAAE,GAAG,KAAK;CAC5D,MAAM,uBACJ,uCAAuC,MAAM;CAC/C,MAAM,yBAAiC,6BAA6B,uBAAuB;CAE3F,wBAAwB,QAAQ,cAAc;CAC9C,OAAO,iBAAiB,QAAQ;EAC9B,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;AAUA,SAAgB,8BACd,QACyB;CACzB,MAAM,SAAS,OAAO,aAAa,MAAM,IAAI,SAAS,EAAE,GAAG,OAAO;CAClE,MAAM,uBACJ,sCAAsC,MAAM;CAC9C,MAAM,yBAAiC,4BAA4B,yBAAyB;CAE5F,wBAAwB,QAAQ,cAAc;CAC9C,OAAO,iBAAiB,QAAQ;EAC9B,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,gCACd,UAC2B;CAC3B,IAAI,CAAC,MAAM,QAAQ,QAAQ,GACzB,MAAM,IAAI,4BAA4B,sDAAsD;CAG9F,MAAM,SAAS,OAAO,aAAa,QAAQ,IAAI,WAAW,CAAC,GAAG,QAAQ;CACtE,MAAM,iBAAiB;CACvB,KAAK,IAAI,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;EAC9C,MAAM,SAAS,eAAe;EAC9B,IAAI,WAAW,KAAA,GAAW,eAAe,KAAK,8BAA8B,MAAM;CACpF;CAEA,MAAM,uBACJ,wCAAwC,MAAM;CAChD,MAAM,yBAAiC,8BAA8B,yBAAyB;CAE9F,OAAO,iBAAiB,QAAQ;EAC9B,QAAQ;GACN,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;EACA,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAgB,sCACd,QACiC;CACjC,MAAM,SAAS,OAAO,aAAa,MAAM,IAAI,SAAS,EAAE,GAAG,OAAO;CAClE,MAAM,uBACJ,8CAA8C,MAAM;CACtD,MAAM,yBACJ,oCAAoC,yBAAyB;CAE/D,wBAAwB,QAAQ,cAAc;CAC9C,OAAO,iBAAiB,QAAQ;EAC9B,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,wCACd,UACmC;CACnC,IAAI,CAAC,MAAM,QAAQ,QAAQ,GACzB,MAAM,IAAI,4BACR,+DACF;CAGF,MAAM,SAAS,OAAO,aAAa,QAAQ,IAAI,WAAW,CAAC,GAAG,QAAQ;CACtE,MAAM,iBAAiB;CACvB,KAAK,IAAI,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;EAC9C,MAAM,SAAS,eAAe;EAC9B,IAAI,WAAW,KAAA,GAAW,eAAe,KAAK,sCAAsC,MAAM;CAC5F;CAEA,MAAM,uBACJ,gDAAgD,MAAM;CACxD,MAAM,yBACJ,sCAAsC,yBAAyB;CAEjE,OAAO,iBAAiB,QAAQ;EAC9B,QAAQ;GACN,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;EACA,UAAU;GACR,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;GACC,gBAAgB;GACf,OAAO;GACP,YAAY;GACZ,cAAc;EAChB;CACF,CAAC;CAED,OAAO;AACT"}

package/dist/raw/index.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors_index = require("../errors/index.cjs");
 const require_encoding = require("./encoding.cjs");
-const require_normalize = require("../util/normalize.cjs");
 const require_encryption = require("../types/encryption.cjs");
+const require_normalize = require("../util/normalize.cjs");
 const require_realms = require("../auth/realms.cjs");
+const require_url = require("./url.cjs");
 //#region src/raw/index.ts
 /**
 * Low-level 1:1 bindings for every B2 native API endpoint.
@@ -15,6 +16,14 @@ const require_realms = require("../auth/realms.cjs");
 *
 * @packageDocumentation
 */
+var B2_NATIVE_API_V3 = {
+	prefix: "b2api",
+	version: "v3"
+};
+var B2_NATIVE_API_V4 = {
+	prefix: "b2api",
+	version: "v4"
+};
 function normalizeRawRequestOptions(optionsOrSignal, retry) {
 	if (optionsOrSignal === void 0) return retry === void 0 ? void 0 : { retry };
 	if (isAbortSignal(optionsOrSignal)) return {
@@ -29,6 +38,19 @@ function normalizeRawRequestOptions(optionsOrSignal, retry) {
 function isAbortSignal(value) {
 	return typeof value === "object" && value !== null && "aborted" in value && typeof value.addEventListener === "function";
 }
+function assertCustomUploadTimestamp(value) {
+	if (value === void 0) return;
+	if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return;
+	throw new TypeError("customUploadTimestamp must be a non-negative safe integer");
+}
+function assertRawCustomUploadTimestamp(value) {
+	if (value === void 0 || value === null) return;
+	if (typeof value === "string" && /^\d+$/.test(value)) {
+		const timestamp = Number(value);
+		if (Number.isSafeInteger(timestamp)) return;
+	}
+	throw new TypeError("customUploadTimestamp must be a non-negative safe integer string or null");
+}
 function normalizeCreateKeyRequest(request) {
 	const { bucketId, ...withoutDeprecatedBucketId } = request;
 	if (bucketId !== void 0 && withoutDeprecatedBucketId.bucketIds !== void 0) throw new TypeError("createKey accepts either bucketIds or deprecated bucketId, not both");
@@ -92,7 +114,8 @@ function normalizeAuthorizeAccountResponse(response) {
 }
 function uploadResponseBodyError(err, signal) {
 	if (signal?.aborted === true) throw signal.reason ?? new DOMException("Aborted", "AbortError");
-	return new require_errors_index.UploadResponseBodyError(err instanceof Error ? err.message : "Upload response body could not be read", { cause: err });
+	const message = err instanceof Error ? err.message : "Upload response body could not be read";
+	return new require_errors_index.UploadResponseBodyError(message, { cause: err });
 }
 /**
 * Low-level client providing 1:1 bindings to all B2 native API endpoints.
@@ -122,7 +145,10 @@ var RawClient = class {
 	async authorizeAccount(applicationKeyId, applicationKey, realmUrl = "https://api.backblazeb2.com") {
 		require_realms.assertSecureRealmUrl(realmUrl);
 		return normalizeAuthorizeAccountResponse(await (await this.transport.send({
-			url: `${realmUrl}/b2api/v4/b2_authorize_account`,
+			url: require_url.b2Url(realmUrl, {
+				...B2_NATIVE_API_V4,
+				endpoint: "b2_authorize_account"
+			}),
 			method: "GET",
 			headers: { Authorization: `Basic ${btoa(`${applicationKeyId}:${applicationKey}`)}` }
 		})).json());
@@ -205,6 +231,10 @@ var RawClient = class {
 			...require_encoding.buildFileInfoHeaders(headers.fileInfo)
 		};
 		if (headers.lastModifiedMillis !== void 0) reqHeaders["X-Bz-Info-src_last_modified_millis"] = String(headers.lastModifiedMillis);
+		if (headers.customUploadTimestamp !== void 0) {
+			assertCustomUploadTimestamp(headers.customUploadTimestamp);
+			reqHeaders["X-Bz-Custom-Upload-Timestamp"] = String(headers.customUploadTimestamp);
+		}
 		if (headers.contentDisposition) reqHeaders["X-Bz-Info-b2-content-disposition"] = headers.contentDisposition;
 		if (headers.contentLanguage) reqHeaders["X-Bz-Info-b2-content-language"] = headers.contentLanguage;
 		if (headers.expires) reqHeaders["X-Bz-Info-b2-expires"] = headers.expires;
@@ -296,7 +326,7 @@ var RawClient = class {
 	* @returns The copied file version metadata.
 	*/
 	async copyFile(apiUrl, authToken, request, options) {
-		return require_normalize.normalizeFileVersionSha1(await this.postJson(apiUrl, authToken, "b2_copy_file", request, options));
+		return require_normalize.normalizeFileVersionSha1(await this.postJson(apiUrl, authToken, "b2_copy_file", withJsonBodyWireSseC(request), options));
 	}
 	/**
 	* Calls {@link https://www.backblaze.com/apidocs/b2-copy-part | b2_copy_part}.
@@ -308,7 +338,7 @@ var RawClient = class {
 	* @returns The copied part metadata.
 	*/
 	async copyPart(apiUrl, authToken, request, options) {
-		return this.postJson(apiUrl, authToken, "b2_copy_part", request, options);
+		return this.postJson(apiUrl, authToken, "b2_copy_part", withJsonBodyWireSseC(request), options);
 	}
 	/**
 	* Calls {@link https://www.backblaze.com/apidocs/b2-start-large-file | b2_start_large_file}.
@@ -320,7 +350,8 @@ var RawClient = class {
 	* @returns The started large file metadata with file ID.
 	*/
 	async startLargeFile(apiUrl, authToken, request, options) {
-		return this.postJson(apiUrl, authToken, "b2_start_large_file", request, options);
+		assertRawCustomUploadTimestamp(request.customUploadTimestamp);
+		return require_normalize.normalizeFileVersionSha1(await this.postJson(apiUrl, authToken, "b2_start_large_file", withJsonBodyWireSseC(request), options));
 	}
 	/**
 	* Implementation for both upload part URL request-control signatures.
@@ -379,7 +410,10 @@ var RawClient = class {
 	*/
 	async finishLargeFile(apiUrl, authToken, request, options) {
 		const response = await this.transport.send({
-			url: `${apiUrl}/b2api/v3/b2_finish_large_file`,
+			url: require_url.b2Url(apiUrl, {
+				...B2_NATIVE_API_V3,
+				endpoint: "b2_finish_large_file"
+			}),
 			method: "POST",
 			headers: {
 				Authorization: authToken,
@@ -422,7 +456,7 @@ var RawClient = class {
 	* @returns The list of unfinished large files and optional continuation token.
 	*/
 	async listUnfinishedLargeFiles(apiUrl, authToken, request, options) {
-		return this.postJson(apiUrl, authToken, "b2_list_unfinished_large_files", request, options);
+		return require_normalize.normalizeFileVersionListSha1(await this.postJson(apiUrl, authToken, "b2_list_unfinished_large_files", request, options));
 	}
 	/**
 	* Calls {@link https://www.backblaze.com/apidocs/b2-list-parts | b2_list_parts}.
@@ -447,7 +481,10 @@ var RawClient = class {
 	*/
 	async downloadFileById(downloadUrl, authToken, fileId, options) {
 		const headers = buildDownloadRequestHeaders(authToken, options);
-		const url = appendDownloadOverrides(`${downloadUrl}/b2api/v3/b2_download_file_by_id?fileId=${encodeURIComponent(fileId)}`, options);
+		const url = appendDownloadOverrides(`${require_url.b2Url(downloadUrl, {
+			...B2_NATIVE_API_V3,
+			endpoint: "b2_download_file_by_id"
+		})}?fileId=${encodeURIComponent(fileId)}`, options);
 		const response = await this.transport.send({
 			url,
 			method: options?.method ?? "GET",
@@ -505,7 +542,7 @@ var RawClient = class {
 	* @returns The newly created application key with secret.
 	*/
 	async createKey(apiUrl, authToken, request) {
-		return normalizeKeyResponse(await this.postJson(apiUrl, authToken, "b2_create_key", normalizeCreateKeyRequest(request), void 0, "v4"));
+		return normalizeKeyResponse(await this.postJson(apiUrl, authToken, "b2_create_key", normalizeCreateKeyRequest(request), void 0, B2_NATIVE_API_V4));
 	}
 	/**
 	* Calls {@link https://www.backblaze.com/apidocs/b2-list-keys | b2_list_keys}.
@@ -516,7 +553,7 @@ var RawClient = class {
 	* @returns The list of application keys and optional continuation token.
 	*/
 	async listKeys(apiUrl, authToken, request) {
-		const response = await this.postJson(apiUrl, authToken, "b2_list_keys", request, void 0, "v4");
+		const response = await this.postJson(apiUrl, authToken, "b2_list_keys", request, void 0, B2_NATIVE_API_V4);
 		return {
 			...response,
 			keys: response.keys.map((key) => normalizeKeyResponse(key))
@@ -531,7 +568,7 @@ var RawClient = class {
 	* @returns The deleted application key metadata.
 	*/
 	async deleteKey(apiUrl, authToken, request) {
-		return normalizeKeyResponse(await this.postJson(apiUrl, authToken, "b2_delete_key", request, void 0, "v4"));
+		return normalizeKeyResponse(await this.postJson(apiUrl, authToken, "b2_delete_key", request, void 0, B2_NATIVE_API_V4));
 	}
 	/**
 	* Calls {@link https://www.backblaze.com/apidocs/b2-update-file-retention | b2_update_file_retention}.
@@ -584,13 +621,16 @@ var RawClient = class {
 	* @param endpoint - The B2 API endpoint name.
 	* @param body - The JSON request body.
 	* @param options - Optional abort and per-request retry settings.
-	* @param apiVersion - B2 Native API version segment for this endpoint.
+	* @param urlOptions - B2 endpoint path prefix and version settings.
 	*
 	* @returns The parsed JSON response.
 	*/
-	async postJson(apiUrl, authToken, endpoint, body, options, apiVersion = "v3") {
+	async postJson(apiUrl, authToken, endpoint, body, options, urlOptions = B2_NATIVE_API_V3) {
 		return (await this.transport.send({
-			url: `${apiUrl}/b2api/${apiVersion}/${endpoint}`,
+			url: require_url.b2Url(apiUrl, {
+				...urlOptions,
+				endpoint
+			}),
 			method: "POST",
 			headers: {
 				Authorization: authToken,
@@ -602,6 +642,23 @@ var RawClient = class {
 		})).json();
 	}
 };
+function withJsonBodyWireSseC(request) {
+	return {
+		...request,
+		...request.serverSideEncryption !== void 0 ? { serverSideEncryption: toWireSseC(request.serverSideEncryption) } : {},
+		...request.sourceServerSideEncryption !== void 0 ? { sourceServerSideEncryption: toWireSseC(request.sourceServerSideEncryption) } : {},
+		...request.destinationServerSideEncryption !== void 0 ? { destinationServerSideEncryption: toWireSseC(request.destinationServerSideEncryption) } : {}
+	};
+}
+function toWireSseC(setting) {
+	if (setting.mode !== require_encryption.EncryptionMode.SseC) return setting;
+	return {
+		mode: require_encryption.EncryptionMode.SseC,
+		algorithm: setting.algorithm,
+		customerKey: setting.customerKey,
+		customerKeyMd5: setting.customerKeyMd5
+	};
+}
 /**
 * Applies server-side encryption headers to the request.
 * @param headers - The mutable headers object to populate.
@@ -636,10 +693,15 @@ var DOWNLOAD_OVERRIDE_PARAMS = [
 function buildDownloadRequestHeaders(authToken, options) {
 	const headers = { Authorization: authToken };
 	if (options?.range) headers["Range"] = options.range;
-	if (options?.serverSideEncryption) applyEncryptionHeaders(headers, {
-		mode: require_encryption.EncryptionMode.SseC,
-		...options.serverSideEncryption
-	});
+	if (options?.serverSideEncryption) {
+		const encryption = options.serverSideEncryption;
+		applyEncryptionHeaders(headers, {
+			mode: require_encryption.EncryptionMode.SseC,
+			algorithm: encryption.algorithm,
+			customerKey: encryption.customerKey,
+			customerKeyMd5: encryption.customerKeyMd5
+		});
+	}
 	return headers;
 }
 /**