@backblaze-labs/b2-sdk 0.3.0 → 0.4.0

package/dist/types/download.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/types/download.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAEzE,oEAAoE;AACpE,eAAO,MAAM,kBAAkB;IAC7B,wDAAwD;;IAExD,qDAAqD;;IAErD,qDAAqD;;IAErD,iDAAiD;;IAEjD,iDAAiD;;IAEjD,oDAAoD;;IAEpD,qEAAqE;;IAErE,mDAAmD;;IAEnD,mDAAmD;;IAEnD,sDAAsD;;IAEtD,4DAA4D;;IAE5D,iDAAiD;;IAEjD,uEAAuE;;IAEvE,gDAAgD;;IAEhD,uDAAuD;;IAEvD,sDAAsD;;IAEtD,8DAA8D;;IAE9D,wDAAwD;;IAExD,gFAAgF;;CAExE,CAAA;AAEV,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAE7F,gGAAgG;AAChG,eAAO,MAAM,sCAAsC;IACjD,gDAAgD;;IAEhD,0CAA0C;;IAE1C,iDAAiD;;IAEjD,qDAAqD;;IAErD,6DAA6D;;IAE7D,iDAAiD;;CAEzC,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,sCAAsC,GAChD,CAAC,OAAO,sCAAsC,CAAC,CAAC,MAAM,OAAO,sCAAsC,CAAC,CAAA;AAEtG,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE;QAC9B,+CAA+C;QAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAA;QAC5B,uDAAuD;QACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,uDAAuD;QACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;KAChC,CAAA;IACD,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,6GAA6G;AAC7G,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE;QAC9B,+CAA+C;QAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAA;QAC5B,uDAAuD;QACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,uDAAuD;QACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;KAChC,CAAA;IACD,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,gFAAgF;IAChF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,kEAAkE;AAClE,MAAM,WAAW,6BAA6B;IAC5C,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,8EAA8E;AAC9E,MAAM,MAAM,4BAA4B,GAAG,YAAY,GAAG,mBAAmB,CAAA;AAE7E,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IACpC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAA;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAA;IAC9C,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,gFAAgF;IAChF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,sCAAsC,EAAE,CAAA;IACrF,4FAA4F;IAC5F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;CACjE"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/types/download.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAEzE,oEAAoE;AACpE,eAAO,MAAM,kBAAkB;IAC7B,wDAAwD;;IAExD,qDAAqD;;IAErD,qDAAqD;;IAErD,iDAAiD;;IAEjD,iDAAiD;;IAEjD,oDAAoD;;IAEpD,qEAAqE;;IAErE,mDAAmD;;IAEnD,mDAAmD;;IAEnD,sDAAsD;;IAEtD,4DAA4D;;IAE5D,iDAAiD;;IAEjD,uEAAuE;;IAEvE,gDAAgD;;IAEhD,uDAAuD;;IAEvD,sDAAsD;;IAEtD,8DAA8D;;IAE9D,wDAAwD;;IAExD,gFAAgF;;CAExE,CAAA;AAEV,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAE7F,gGAAgG;AAChG,eAAO,MAAM,sCAAsC;IACjD,gDAAgD;;IAEhD,0CAA0C;;IAE1C,iDAAiD;;IAEjD,qDAAqD;;IAErD,6DAA6D;;IAE7D,iDAAiD;;CAEzC,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,sCAAsC,GAChD,CAAC,OAAO,sCAAsC,CAAC,CAAC,MAAM,OAAO,sCAAsC,CAAC,CAAA;AAEtG,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAA;IAC/C,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,6GAA6G;AAC7G,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAA;IAC/C,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,gFAAgF;IAChF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,kEAAkE;AAClE,MAAM,WAAW,6BAA6B;IAC5C,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,8EAA8E;AAC9E,MAAM,MAAM,4BAA4B,GAAG,YAAY,GAAG,mBAAmB,CAAA;AAE7E,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IACpC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAA;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAA;IAC9C,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,gFAAgF;IAChF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,sCAAsC,EAAE,CAAA;IACrF,4FAA4F;IAC5F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;CACjE"}

package/dist/types/download.d.ts

@@ -1,4 +1,4 @@
-import { SseB2Setting, SseCPublicSetting } from './encryption.js';
+import { SseB2Setting, SseCKeyMaterial, SseCPublicSetting } from './encryption.js';
 import { BucketId, FileId } from './ids.js';
 import { ReadableFileRetention, ReadableLegalHold } from './lock.js';
 /** HTTP response header names returned by B2 download endpoints. */
@@ -68,14 +68,7 @@ export interface DownloadByIdRequest {
     /** Optional byte range to download (e.g., `'bytes=0-999'`). */
     readonly range?: string;
     /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */
-    readonly serverSideEncryption?: {
-        /** Encryption algorithm. Always `'AES256'`. */
-        readonly algorithm: 'AES256';
-        /** Base64-encoded customer-provided decryption key. */
-        readonly customerKey: string;
-        /** Base64-encoded MD5 digest of the decryption key. */
-        readonly customerKeyMd5: string;
-    };
+    readonly serverSideEncryption?: SseCKeyMaterial;
     /** Override the Content-Disposition header in the download response. */
     readonly b2ContentDisposition?: string;
     /** Override the Content-Language header in the download response. */
@@ -98,14 +91,7 @@ export interface DownloadByNameRequest {
     /** Optional byte range to download (e.g., `'bytes=0-999'`). */
     readonly range?: string;
     /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */
-    readonly serverSideEncryption?: {
-        /** Encryption algorithm. Always `'AES256'`. */
-        readonly algorithm: 'AES256';
-        /** Base64-encoded customer-provided decryption key. */
-        readonly customerKey: string;
-        /** Base64-encoded MD5 digest of the decryption key. */
-        readonly customerKeyMd5: string;
-    };
+    readonly serverSideEncryption?: SseCKeyMaterial;
     /** Override the Content-Disposition header in the download response. */
     readonly b2ContentDisposition?: string;
     /** Override the Content-Language header in the download response. */

package/dist/types/download.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/types/download.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAEzE,oEAAoE;AACpE,eAAO,MAAM,kBAAkB;IAC7B,wDAAwD;;IAExD,qDAAqD;;IAErD,qDAAqD;;IAErD,iDAAiD;;IAEjD,iDAAiD;;IAEjD,oDAAoD;;IAEpD,qEAAqE;;IAErE,mDAAmD;;IAEnD,mDAAmD;;IAEnD,sDAAsD;;IAEtD,4DAA4D;;IAE5D,iDAAiD;;IAEjD,uEAAuE;;IAEvE,gDAAgD;;IAEhD,uDAAuD;;IAEvD,sDAAsD;;IAEtD,8DAA8D;;IAE9D,wDAAwD;;IAExD,gFAAgF;;CAExE,CAAA;AAEV,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAE7F,gGAAgG;AAChG,eAAO,MAAM,sCAAsC;IACjD,gDAAgD;;IAEhD,0CAA0C;;IAE1C,iDAAiD;;IAEjD,qDAAqD;;IAErD,6DAA6D;;IAE7D,iDAAiD;;CAEzC,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,sCAAsC,GAChD,CAAC,OAAO,sCAAsC,CAAC,CAAC,MAAM,OAAO,sCAAsC,CAAC,CAAA;AAEtG,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE;QAC9B,+CAA+C;QAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAA;QAC5B,uDAAuD;QACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,uDAAuD;QACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;KAChC,CAAA;IACD,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,6GAA6G;AAC7G,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE;QAC9B,+CAA+C;QAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAA;QAC5B,uDAAuD;QACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,uDAAuD;QACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;KAChC,CAAA;IACD,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,gFAAgF;IAChF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,kEAAkE;AAClE,MAAM,WAAW,6BAA6B;IAC5C,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,8EAA8E;AAC9E,MAAM,MAAM,4BAA4B,GAAG,YAAY,GAAG,mBAAmB,CAAA;AAE7E,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IACpC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAA;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAA;IAC9C,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,gFAAgF;IAChF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,sCAAsC,EAAE,CAAA;IACrF,4FAA4F;IAC5F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;CACjE"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/types/download.js"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAEzE,oEAAoE;AACpE,eAAO,MAAM,kBAAkB;IAC7B,wDAAwD;;IAExD,qDAAqD;;IAErD,qDAAqD;;IAErD,iDAAiD;;IAEjD,iDAAiD;;IAEjD,oDAAoD;;IAEpD,qEAAqE;;IAErE,mDAAmD;;IAEnD,mDAAmD;;IAEnD,sDAAsD;;IAEtD,4DAA4D;;IAE5D,iDAAiD;;IAEjD,uEAAuE;;IAEvE,gDAAgD;;IAEhD,uDAAuD;;IAEvD,sDAAsD;;IAEtD,8DAA8D;;IAE9D,wDAAwD;;IAExD,gFAAgF;;CAExE,CAAA;AAEV,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAE7F,gGAAgG;AAChG,eAAO,MAAM,sCAAsC;IACjD,gDAAgD;;IAEhD,0CAA0C;;IAE1C,iDAAiD;;IAEjD,qDAAqD;;IAErD,6DAA6D;;IAE7D,iDAAiD;;CAEzC,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,sCAAsC,GAChD,CAAC,OAAO,sCAAsC,CAAC,CAAC,MAAM,OAAO,sCAAsC,CAAC,CAAA;AAEtG,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAA;IAC/C,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,6GAA6G;AAC7G,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAA;IAC/C,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,gFAAgF;IAChF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,kEAAkE;AAClE,MAAM,WAAW,6BAA6B;IAC5C,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,8EAA8E;AAC9E,MAAM,MAAM,4BAA4B,GAAG,YAAY,GAAG,mBAAmB,CAAA;AAE7E,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IACpC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAA;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAA;IAC9C,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,gFAAgF;IAChF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,sCAAsC,EAAE,CAAA;IACrF,4FAA4F;IAC5F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;CACjE"}

package/dist/types/download.js.map

@@ -1 +1 @@
-{"version":3,"file":"download.js","names":[],"sources":["../../src/types/download.ts"],"sourcesContent":["import type { SseB2Setting, SseCPublicSetting } from './encryption.ts'\nimport type { BucketId, FileId } from './ids.ts'\nimport type { ReadableFileRetention, ReadableLegalHold } from './lock.ts'\n\n/** HTTP response header names returned by B2 download endpoints. */\nexport const DownloadHeaderName = {\n  /** Header carrying the response content disposition. */\n  ContentDisposition: 'Content-Disposition',\n  /** Header carrying the response content language. */\n  ContentLanguage: 'Content-Language',\n  /** Header carrying the response content encoding. */\n  ContentEncoding: 'Content-Encoding',\n  /** Header carrying the response content type. */\n  ContentType: 'Content-Type',\n  /** Header carrying the response cache policy. */\n  CacheControl: 'Cache-Control',\n  /** Header carrying the response expiration time. */\n  Expires: 'Expires',\n  /** Header carrying the byte range returned for partial downloads. */\n  ContentRange: 'Content-Range',\n  /** Header carrying the response content length. */\n  ContentLength: 'Content-Length',\n  /** Header carrying the B2 SHA-1 metadata value. */\n  ContentSha1: 'X-Bz-Content-Sha1',\n  /** Header carrying the downloaded file version ID. */\n  FileId: 'X-Bz-File-Id',\n  /** Header carrying the URL-encoded downloaded file name. */\n  FileName: 'X-Bz-File-Name',\n  /** Header carrying the file upload timestamp. */\n  UploadTimestamp: 'X-Bz-Upload-Timestamp',\n  /** Header carrying the B2-managed server-side encryption algorithm. */\n  ServerSideEncryption: 'X-Bz-Server-Side-Encryption',\n  /** Header carrying the SSE-C algorithm echo. */\n  ServerSideEncryptionCustomerAlgorithm: 'X-Bz-Server-Side-Encryption-Customer-Algorithm',\n  /** Header carrying the SSE-C customer-key MD5 echo. */\n  ServerSideEncryptionCustomerKeyMd5: 'X-Bz-Server-Side-Encryption-Customer-Key-Md5',\n  /** Header carrying the Object Lock retention mode. */\n  FileRetentionMode: 'X-Bz-File-Retention-Mode',\n  /** Header carrying the Object Lock retain-until timestamp. */\n  FileRetentionRetainUntilTimestamp: 'X-Bz-File-Retention-Retain-Until-Timestamp',\n  /** Header carrying the Object Lock legal-hold value. */\n  FileLegalHold: 'X-Bz-File-Legal-Hold',\n  /** Header carrying names of metadata headers hidden by missing capabilities. */\n  ClientUnauthorizedToRead: 'X-Bz-Client-Unauthorized-To-Read',\n} as const\n\n/** HTTP response header name returned by B2 download endpoints. */\nexport type DownloadHeaderName = (typeof DownloadHeaderName)[keyof typeof DownloadHeaderName]\n\n/** Documented download metadata markers B2 may hide when the caller lacks read capabilities. */\nexport const DownloadClientUnauthorizedToReadMarker = {\n  /** B2-managed encryption metadata is hidden. */\n  ServerSideEncryption: DownloadHeaderName.ServerSideEncryption,\n  /** SSE-C algorithm metadata is hidden. */\n  ServerSideEncryptionCustomerAlgorithm: DownloadHeaderName.ServerSideEncryptionCustomerAlgorithm,\n  /** SSE-C customer-key MD5 metadata is hidden. */\n  ServerSideEncryptionCustomerKeyMd5: DownloadHeaderName.ServerSideEncryptionCustomerKeyMd5,\n  /** Object Lock retention mode metadata is hidden. */\n  FileRetentionMode: DownloadHeaderName.FileRetentionMode,\n  /** Object Lock retain-until timestamp metadata is hidden. */\n  FileRetentionRetainUntilTimestamp: DownloadHeaderName.FileRetentionRetainUntilTimestamp,\n  /** Object Lock legal-hold metadata is hidden. */\n  FileLegalHold: DownloadHeaderName.FileLegalHold,\n} as const\n\n/** Documented download metadata marker B2 may hide when the caller lacks read capabilities. */\nexport type DownloadClientUnauthorizedToReadMarker =\n  (typeof DownloadClientUnauthorizedToReadMarker)[keyof typeof DownloadClientUnauthorizedToReadMarker]\n\n/** Request parameters for downloading a file by its ID via `b2_download_file_by_id`. */\nexport interface DownloadByIdRequest {\n  /** ID of the file version to download. */\n  readonly fileId: FileId\n  /** Optional byte range to download (e.g., `'bytes=0-999'`). */\n  readonly range?: string\n  /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */\n  readonly serverSideEncryption?: {\n    /** Encryption algorithm. Always `'AES256'`. */\n    readonly algorithm: 'AES256'\n    /** Base64-encoded customer-provided decryption key. */\n    readonly customerKey: string\n    /** Base64-encoded MD5 digest of the decryption key. */\n    readonly customerKeyMd5: string\n  }\n  /** Override the Content-Disposition header in the download response. */\n  readonly b2ContentDisposition?: string\n  /** Override the Content-Language header in the download response. */\n  readonly b2ContentLanguage?: string\n  /** Override the Content-Encoding header in the download response. */\n  readonly b2ContentEncoding?: string\n  /** Override the Content-Type header in the download response. */\n  readonly b2ContentType?: string\n  /** Override the Cache-Control header in the download response. */\n  readonly b2CacheControl?: string\n  /** Override the Expires header in the download response. */\n  readonly b2Expires?: string\n}\n\n/** Request parameters for downloading a file by bucket name and file name via `b2_download_file_by_name`. */\nexport interface DownloadByNameRequest {\n  /** Name of the bucket containing the file. */\n  readonly bucketName: string\n  /** Full path and name of the file within the bucket. */\n  readonly fileName: string\n  /** Optional byte range to download (e.g., `'bytes=0-999'`). */\n  readonly range?: string\n  /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */\n  readonly serverSideEncryption?: {\n    /** Encryption algorithm. Always `'AES256'`. */\n    readonly algorithm: 'AES256'\n    /** Base64-encoded customer-provided decryption key. */\n    readonly customerKey: string\n    /** Base64-encoded MD5 digest of the decryption key. */\n    readonly customerKeyMd5: string\n  }\n  /** Override the Content-Disposition header in the download response. */\n  readonly b2ContentDisposition?: string\n  /** Override the Content-Language header in the download response. */\n  readonly b2ContentLanguage?: string\n  /** Override the Content-Encoding header in the download response. */\n  readonly b2ContentEncoding?: string\n  /** Override the Content-Type header in the download response. */\n  readonly b2ContentType?: string\n  /** Override the Cache-Control header in the download response. */\n  readonly b2CacheControl?: string\n  /** Override the Expires header in the download response. */\n  readonly b2Expires?: string\n}\n\n/**\n * Request parameters for the `b2_get_download_authorization` API call.\n * Creates a time-limited token that authorizes downloads of files matching a prefix.\n */\nexport interface DownloadAuthorizationRequest {\n  /** Bucket to authorize downloads from. */\n  readonly bucketId: BucketId\n  /** Only files with names starting with this prefix are authorized. */\n  readonly fileNamePrefix: string\n  /** Duration in seconds that the authorization token remains valid. */\n  readonly validDurationInSeconds: number\n  /** Override the Content-Disposition header in authorized download responses. */\n  readonly b2ContentDisposition?: string\n  /** Override the Content-Language header in authorized download responses. */\n  readonly b2ContentLanguage?: string\n  /** Override the Content-Encoding header in authorized download responses. */\n  readonly b2ContentEncoding?: string\n  /** Override the Content-Type header in authorized download responses. */\n  readonly b2ContentType?: string\n  /** Override the Cache-Control header in authorized download responses. */\n  readonly b2CacheControl?: string\n  /** Override the Expires header in authorized download responses. */\n  readonly b2Expires?: string\n}\n\n/** Response from the `b2_get_download_authorization` API call. */\nexport interface DownloadAuthorizationResponse {\n  /** Bucket the authorization applies to. */\n  readonly bucketId: BucketId\n  /** File name prefix the authorization is scoped to. */\n  readonly fileNamePrefix: string\n  /** Authorization token to include in download requests. */\n  readonly authorizationToken: string\n}\n\n/** Customer-managed server-side encryption metadata echoed in B2 download response headers. */\nexport interface SseCDownloadSetting extends SseCPublicSetting {\n  /** MD5 digest echoed by `X-Bz-Server-Side-Encryption-Customer-Key-Md5`. */\n  readonly customerKeyMd5: string\n}\n\n/** Server-side encryption metadata echoed in B2 download response headers. */\nexport type DownloadServerSideEncryption = SseB2Setting | SseCDownloadSetting\n\n/** Diagnostic for a present download metadata header the SDK could not parse narrowly. */\nexport interface DownloadHeaderParseIssue {\n  /** Header whose value could not be parsed into the current typed SDK model. */\n  readonly headerName: DownloadHeaderName\n  /** Raw header value that could not be parsed. */\n  readonly value: string\n}\n\n/** Parsed headers from a B2 file download response. */\nexport interface DownloadHeaders {\n  /** MIME type of the downloaded file content. */\n  readonly contentType: string\n  /** Size of the downloaded content in bytes. */\n  readonly contentLength: number\n  /** Content-Disposition value computed from upload metadata or the download request. */\n  readonly contentDisposition?: string\n  /** Content-Language value computed from upload metadata or the download request. */\n  readonly contentLanguage?: string\n  /** Content-Encoding value computed from upload metadata or the download request. */\n  readonly contentEncoding?: string\n  /** Cache-Control value computed from upload metadata, bucket defaults, or the download request. */\n  readonly cacheControl?: string\n  /** Expires value computed from upload metadata or the download request. */\n  readonly expires?: string\n  /** Content-Range value returned for satisfiable range downloads. */\n  readonly contentRange?: string\n  /** SHA-1 checksum of the full file content, or null for large files. */\n  readonly contentSha1: string | null\n  /** ID of the downloaded file version. */\n  readonly fileId: FileId\n  /** Full path and name of the downloaded file. */\n  readonly fileName: string\n  /** User-defined key-value metadata stored with the file. */\n  readonly fileInfo: Record<string, string>\n  /** UTC timestamp (milliseconds) when the file was uploaded. */\n  readonly uploadTimestamp: number\n  /** Server-side encryption metadata echoed by B2, when the caller is authorized to read it. */\n  readonly serverSideEncryption?: DownloadServerSideEncryption\n  /** Object Lock retention metadata, including whether the caller may read it. */\n  readonly fileRetention?: ReadableFileRetention\n  /** Object Lock legal hold metadata, including whether the caller may read it. */\n  readonly legalHold?: ReadableLegalHold\n  /** Header names B2 omitted because the caller lacks capability to read them. */\n  readonly clientUnauthorizedToRead?: readonly DownloadClientUnauthorizedToReadMarker[]\n  /** Present metadata headers the SDK could not parse into its current narrow typed model. */\n  readonly headerParseIssues?: readonly DownloadHeaderParseIssue[]\n}\n"],"mappings":";;AAKA,IAAa,qBAAqB;;CAEhC,oBAAoB;;CAEpB,iBAAiB;;CAEjB,iBAAiB;;CAEjB,aAAa;;CAEb,cAAc;;CAEd,SAAS;;CAET,cAAc;;CAEd,eAAe;;CAEf,aAAa;;CAEb,QAAQ;;CAER,UAAU;;CAEV,iBAAiB;;CAEjB,sBAAsB;;CAEtB,uCAAuC;;CAEvC,oCAAoC;;CAEpC,mBAAmB;;CAEnB,mCAAmC;;CAEnC,eAAe;;CAEf,0BAA0B;AAC5B;;AAMA,IAAa,yCAAyC;;CAEpD,sBAAsB,mBAAmB;;CAEzC,uCAAuC,mBAAmB;;CAE1D,oCAAoC,mBAAmB;;CAEvD,mBAAmB,mBAAmB;;CAEtC,mCAAmC,mBAAmB;;CAEtD,eAAe,mBAAmB;AACpC"}
+{"version":3,"file":"download.js","names":[],"sources":["../../src/types/download.ts"],"sourcesContent":["import type { SseB2Setting, SseCKeyMaterial, SseCPublicSetting } from './encryption.ts'\nimport type { BucketId, FileId } from './ids.ts'\nimport type { ReadableFileRetention, ReadableLegalHold } from './lock.ts'\n\n/** HTTP response header names returned by B2 download endpoints. */\nexport const DownloadHeaderName = {\n  /** Header carrying the response content disposition. */\n  ContentDisposition: 'Content-Disposition',\n  /** Header carrying the response content language. */\n  ContentLanguage: 'Content-Language',\n  /** Header carrying the response content encoding. */\n  ContentEncoding: 'Content-Encoding',\n  /** Header carrying the response content type. */\n  ContentType: 'Content-Type',\n  /** Header carrying the response cache policy. */\n  CacheControl: 'Cache-Control',\n  /** Header carrying the response expiration time. */\n  Expires: 'Expires',\n  /** Header carrying the byte range returned for partial downloads. */\n  ContentRange: 'Content-Range',\n  /** Header carrying the response content length. */\n  ContentLength: 'Content-Length',\n  /** Header carrying the B2 SHA-1 metadata value. */\n  ContentSha1: 'X-Bz-Content-Sha1',\n  /** Header carrying the downloaded file version ID. */\n  FileId: 'X-Bz-File-Id',\n  /** Header carrying the URL-encoded downloaded file name. */\n  FileName: 'X-Bz-File-Name',\n  /** Header carrying the file upload timestamp. */\n  UploadTimestamp: 'X-Bz-Upload-Timestamp',\n  /** Header carrying the B2-managed server-side encryption algorithm. */\n  ServerSideEncryption: 'X-Bz-Server-Side-Encryption',\n  /** Header carrying the SSE-C algorithm echo. */\n  ServerSideEncryptionCustomerAlgorithm: 'X-Bz-Server-Side-Encryption-Customer-Algorithm',\n  /** Header carrying the SSE-C customer-key MD5 echo. */\n  ServerSideEncryptionCustomerKeyMd5: 'X-Bz-Server-Side-Encryption-Customer-Key-Md5',\n  /** Header carrying the Object Lock retention mode. */\n  FileRetentionMode: 'X-Bz-File-Retention-Mode',\n  /** Header carrying the Object Lock retain-until timestamp. */\n  FileRetentionRetainUntilTimestamp: 'X-Bz-File-Retention-Retain-Until-Timestamp',\n  /** Header carrying the Object Lock legal-hold value. */\n  FileLegalHold: 'X-Bz-File-Legal-Hold',\n  /** Header carrying names of metadata headers hidden by missing capabilities. */\n  ClientUnauthorizedToRead: 'X-Bz-Client-Unauthorized-To-Read',\n} as const\n\n/** HTTP response header name returned by B2 download endpoints. */\nexport type DownloadHeaderName = (typeof DownloadHeaderName)[keyof typeof DownloadHeaderName]\n\n/** Documented download metadata markers B2 may hide when the caller lacks read capabilities. */\nexport const DownloadClientUnauthorizedToReadMarker = {\n  /** B2-managed encryption metadata is hidden. */\n  ServerSideEncryption: DownloadHeaderName.ServerSideEncryption,\n  /** SSE-C algorithm metadata is hidden. */\n  ServerSideEncryptionCustomerAlgorithm: DownloadHeaderName.ServerSideEncryptionCustomerAlgorithm,\n  /** SSE-C customer-key MD5 metadata is hidden. */\n  ServerSideEncryptionCustomerKeyMd5: DownloadHeaderName.ServerSideEncryptionCustomerKeyMd5,\n  /** Object Lock retention mode metadata is hidden. */\n  FileRetentionMode: DownloadHeaderName.FileRetentionMode,\n  /** Object Lock retain-until timestamp metadata is hidden. */\n  FileRetentionRetainUntilTimestamp: DownloadHeaderName.FileRetentionRetainUntilTimestamp,\n  /** Object Lock legal-hold metadata is hidden. */\n  FileLegalHold: DownloadHeaderName.FileLegalHold,\n} as const\n\n/** Documented download metadata marker B2 may hide when the caller lacks read capabilities. */\nexport type DownloadClientUnauthorizedToReadMarker =\n  (typeof DownloadClientUnauthorizedToReadMarker)[keyof typeof DownloadClientUnauthorizedToReadMarker]\n\n/** Request parameters for downloading a file by its ID via `b2_download_file_by_id`. */\nexport interface DownloadByIdRequest {\n  /** ID of the file version to download. */\n  readonly fileId: FileId\n  /** Optional byte range to download (e.g., `'bytes=0-999'`). */\n  readonly range?: string\n  /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */\n  readonly serverSideEncryption?: SseCKeyMaterial\n  /** Override the Content-Disposition header in the download response. */\n  readonly b2ContentDisposition?: string\n  /** Override the Content-Language header in the download response. */\n  readonly b2ContentLanguage?: string\n  /** Override the Content-Encoding header in the download response. */\n  readonly b2ContentEncoding?: string\n  /** Override the Content-Type header in the download response. */\n  readonly b2ContentType?: string\n  /** Override the Cache-Control header in the download response. */\n  readonly b2CacheControl?: string\n  /** Override the Expires header in the download response. */\n  readonly b2Expires?: string\n}\n\n/** Request parameters for downloading a file by bucket name and file name via `b2_download_file_by_name`. */\nexport interface DownloadByNameRequest {\n  /** Name of the bucket containing the file. */\n  readonly bucketName: string\n  /** Full path and name of the file within the bucket. */\n  readonly fileName: string\n  /** Optional byte range to download (e.g., `'bytes=0-999'`). */\n  readonly range?: string\n  /** SSE-C decryption parameters, required if the file was uploaded with SSE-C. */\n  readonly serverSideEncryption?: SseCKeyMaterial\n  /** Override the Content-Disposition header in the download response. */\n  readonly b2ContentDisposition?: string\n  /** Override the Content-Language header in the download response. */\n  readonly b2ContentLanguage?: string\n  /** Override the Content-Encoding header in the download response. */\n  readonly b2ContentEncoding?: string\n  /** Override the Content-Type header in the download response. */\n  readonly b2ContentType?: string\n  /** Override the Cache-Control header in the download response. */\n  readonly b2CacheControl?: string\n  /** Override the Expires header in the download response. */\n  readonly b2Expires?: string\n}\n\n/**\n * Request parameters for the `b2_get_download_authorization` API call.\n * Creates a time-limited token that authorizes downloads of files matching a prefix.\n */\nexport interface DownloadAuthorizationRequest {\n  /** Bucket to authorize downloads from. */\n  readonly bucketId: BucketId\n  /** Only files with names starting with this prefix are authorized. */\n  readonly fileNamePrefix: string\n  /** Duration in seconds that the authorization token remains valid. */\n  readonly validDurationInSeconds: number\n  /** Override the Content-Disposition header in authorized download responses. */\n  readonly b2ContentDisposition?: string\n  /** Override the Content-Language header in authorized download responses. */\n  readonly b2ContentLanguage?: string\n  /** Override the Content-Encoding header in authorized download responses. */\n  readonly b2ContentEncoding?: string\n  /** Override the Content-Type header in authorized download responses. */\n  readonly b2ContentType?: string\n  /** Override the Cache-Control header in authorized download responses. */\n  readonly b2CacheControl?: string\n  /** Override the Expires header in authorized download responses. */\n  readonly b2Expires?: string\n}\n\n/** Response from the `b2_get_download_authorization` API call. */\nexport interface DownloadAuthorizationResponse {\n  /** Bucket the authorization applies to. */\n  readonly bucketId: BucketId\n  /** File name prefix the authorization is scoped to. */\n  readonly fileNamePrefix: string\n  /** Authorization token to include in download requests. */\n  readonly authorizationToken: string\n}\n\n/** Customer-managed server-side encryption metadata echoed in B2 download response headers. */\nexport interface SseCDownloadSetting extends SseCPublicSetting {\n  /** MD5 digest echoed by `X-Bz-Server-Side-Encryption-Customer-Key-Md5`. */\n  readonly customerKeyMd5: string\n}\n\n/** Server-side encryption metadata echoed in B2 download response headers. */\nexport type DownloadServerSideEncryption = SseB2Setting | SseCDownloadSetting\n\n/** Diagnostic for a present download metadata header the SDK could not parse narrowly. */\nexport interface DownloadHeaderParseIssue {\n  /** Header whose value could not be parsed into the current typed SDK model. */\n  readonly headerName: DownloadHeaderName\n  /** Raw header value that could not be parsed. */\n  readonly value: string\n}\n\n/** Parsed headers from a B2 file download response. */\nexport interface DownloadHeaders {\n  /** MIME type of the downloaded file content. */\n  readonly contentType: string\n  /** Size of the downloaded content in bytes. */\n  readonly contentLength: number\n  /** Content-Disposition value computed from upload metadata or the download request. */\n  readonly contentDisposition?: string\n  /** Content-Language value computed from upload metadata or the download request. */\n  readonly contentLanguage?: string\n  /** Content-Encoding value computed from upload metadata or the download request. */\n  readonly contentEncoding?: string\n  /** Cache-Control value computed from upload metadata, bucket defaults, or the download request. */\n  readonly cacheControl?: string\n  /** Expires value computed from upload metadata or the download request. */\n  readonly expires?: string\n  /** Content-Range value returned for satisfiable range downloads. */\n  readonly contentRange?: string\n  /** SHA-1 checksum of the full file content, or null for large files. */\n  readonly contentSha1: string | null\n  /** ID of the downloaded file version. */\n  readonly fileId: FileId\n  /** Full path and name of the downloaded file. */\n  readonly fileName: string\n  /** User-defined key-value metadata stored with the file. */\n  readonly fileInfo: Record<string, string>\n  /** UTC timestamp (milliseconds) when the file was uploaded. */\n  readonly uploadTimestamp: number\n  /** Server-side encryption metadata echoed by B2, when the caller is authorized to read it. */\n  readonly serverSideEncryption?: DownloadServerSideEncryption\n  /** Object Lock retention metadata, including whether the caller may read it. */\n  readonly fileRetention?: ReadableFileRetention\n  /** Object Lock legal hold metadata, including whether the caller may read it. */\n  readonly legalHold?: ReadableLegalHold\n  /** Header names B2 omitted because the caller lacks capability to read them. */\n  readonly clientUnauthorizedToRead?: readonly DownloadClientUnauthorizedToReadMarker[]\n  /** Present metadata headers the SDK could not parse into its current narrow typed model. */\n  readonly headerParseIssues?: readonly DownloadHeaderParseIssue[]\n}\n"],"mappings":";;AAKA,IAAa,qBAAqB;;CAEhC,oBAAoB;;CAEpB,iBAAiB;;CAEjB,iBAAiB;;CAEjB,aAAa;;CAEb,cAAc;;CAEd,SAAS;;CAET,cAAc;;CAEd,eAAe;;CAEf,aAAa;;CAEb,QAAQ;;CAER,UAAU;;CAEV,iBAAiB;;CAEjB,sBAAsB;;CAEtB,uCAAuC;;CAEvC,oCAAoC;;CAEpC,mBAAmB;;CAEnB,mCAAmC;;CAEnC,eAAe;;CAEf,0BAA0B;AAC5B;;AAMA,IAAa,yCAAyC;;CAEpD,sBAAsB,mBAAmB;;CAEzC,uCAAuC,mBAAmB;;CAE1D,oCAAoC,mBAAmB;;CAEvD,mBAAmB,mBAAmB;;CAEtC,mCAAmC,mBAAmB;;CAEtD,eAAe,mBAAmB;AACpC"}

package/dist/types/encryption.cjs

@@ -140,6 +140,16 @@ var EncryptionKey = class EncryptionKey {
 		this.customerKeyMd5 = customerKeyMd5;
 	}
 	/**
+	* Generates a random 32-byte (256-bit) SSE-C key.
+	*
+	* @returns A safely-wrapped EncryptionKey ready for upload/download.
+	*/
+	static async generate() {
+		const rawKey = /* @__PURE__ */ new Uint8Array(32);
+		getRandomValues(rawKey);
+		return EncryptionKey.fromBytes(rawKey);
+	}
+	/**
 	* Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
 	* required base64 MD5 digest internally.
 	*
@@ -196,6 +206,14 @@ var EncryptionKey = class EncryptionKey {
 		return this.toString();
 	}
 };
+function getRandomValues(bytes) {
+	const cryptoLike = globalThis.crypto;
+	if (cryptoLike !== void 0) {
+		cryptoLike.getRandomValues(bytes);
+		return;
+	}
+	throw new Error("EncryptionKey.generate requires crypto.getRandomValues.");
+}
 //#endregion
 exports.EncryptionAlgorithm = EncryptionAlgorithm;
 exports.EncryptionKey = EncryptionKey;

package/dist/types/encryption.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.cjs","names":[],"sources":["../../src/types/encryption.ts"],"sourcesContent":["import { md5Base64 } from '../util/md5.ts'\n\n/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /** Base64-encoded 256-bit encryption key provided by the customer. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Server-side encryption using customer-provided keys as returned by B2 responses. */\nexport interface SseCPublicSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** No-encryption shape returned by B2 response objects. */\nexport interface NoEncryptionWireSetting {\n  /** Encryption mode discriminator. B2 response payloads use null for no encryption. */\n  readonly mode: null\n  /** Encryption algorithm. B2 response payloads use null when no encryption is applied. */\n  readonly algorithm: null\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Server-side encryption setting returned by B2 response objects. */\nexport type PublicEncryptionSetting =\n  | SseB2Setting\n  | SseCPublicSetting\n  | NoEncryption\n  | NoEncryptionWireSetting\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\nexport const SSE_C_KEY_REDACTION = '[redacted SSE-C key]'\n\nconst NODE_INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom')\n\ninterface SseCKeyMaterial {\n  readonly algorithm: EncryptionAlgorithm\n  readonly customerKey: string\n  readonly customerKeyMd5: string\n}\n\ninterface SseCKeyRedactionOptions {\n  readonly label: string\n  readonly mode?: 'SSE-C'\n}\n\ninterface RedactedSseCKeyJson {\n  readonly mode?: 'SSE-C'\n  readonly algorithm: EncryptionAlgorithm\n  readonly customerKey: string\n  readonly customerKeyMd5: string\n}\n\nfunction sseCKeyRedactedJson(\n  key: SseCKeyMaterial,\n  options: SseCKeyRedactionOptions,\n): RedactedSseCKeyJson {\n  return {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n    customerKey: SSE_C_KEY_REDACTION,\n    // The MD5 is not secret key material, but it is still derived from a\n    // customer-provided key. Keep logged key views fully opaque by default.\n    customerKeyMd5: SSE_C_KEY_REDACTION,\n  }\n}\n\nfunction sseCKeyRedactedString(options: SseCKeyRedactionOptions): string {\n  return `[${options.label} ${SSE_C_KEY_REDACTION}]`\n}\n\n/**\n * Wraps SSE-C key material so diagnostic stringification redacts key fields.\n *\n * The returned object keeps `customerKey` and `customerKeyMd5` readable by\n * property access for request header construction, but makes them\n * non-enumerable so object spread and generic serializers do not copy them.\n * Callers that need wire headers must read those fields directly.\n *\n * @param key - SSE-C key material to wrap.\n * @param options - Redaction label and optional encryption mode discriminator.\n *\n * @returns A redacted view with the same readable key fields.\n */\nexport function redactSseCKeyMaterial<T extends SseCKeyMaterial>(\n  key: T,\n  options: SseCKeyRedactionOptions,\n): T {\n  const redacted = {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n  } as T & {\n    toJSON(): RedactedSseCKeyJson\n    toString(): string\n  }\n\n  Object.defineProperties(redacted, {\n    customerKey: { value: key.customerKey, enumerable: false },\n    customerKeyMd5: { value: key.customerKeyMd5, enumerable: false },\n    toJSON: { value: () => sseCKeyRedactedJson(key, options), enumerable: false },\n    toString: { value: () => sseCKeyRedactedString(options), enumerable: false },\n  })\n  Object.defineProperty(redacted, NODE_INSPECT_CUSTOM, {\n    value: () => sseCKeyRedactedString(options),\n    enumerable: false,\n  })\n\n  return redacted\n}\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return sseCKeyRedactedJson(this, { label: 'EncryptionKey SSE-C', mode: this.mode }) as {\n      mode: 'SSE-C'\n      algorithm: EncryptionAlgorithm\n      customerKey: string\n      customerKeyMd5: string\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return sseCKeyRedactedString({ label: 'EncryptionKey SSE-C' })\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [NODE_INSPECT_CUSTOM](): string {\n    return this.toString()\n  }\n}\n"],"mappings":";;;AAGA,IAAa,sBAAsB;;AAEjC,QAAQ,SACV;;;;;;;;;;AAcA,IAAa,iBAAiB;;CAE5B,OAAO;;CAEP,MAAM;;CAEN,MAAM;AACR;;AA0DA,IAAa,SAAuB;CAAE,MAAM;CAAU,WAAW;AAAS;;AAG1E,IAAa,WAAyB,EAAE,MAAM,OAAO;;;;;;;;AASrD,SAAgB,YAAY,aAAqB,gBAA6C;CAC5F,OAAO;EAAE,MAAM;EAAS,WAAW;EAAU;EAAa;CAAe;AAC3E;;;;;;;;AASA,SAAS,cAAc,OAA2B;CAKhD,MAAM,IAAI;CAGV,IAAI,EAAE,QACJ,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;CAE/C,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;AAEA,IAAa,sBAAsB;AAEnC,IAAM,sBAAsB,OAAO,IAAI,4BAA4B;AAoBnE,SAAS,oBACP,KACA,SACqB;CACrB,OAAO;EACL,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;EACf,aAAa;EAGb,gBAAgB;CAClB;AACF;AAEA,SAAS,sBAAsB,SAA0C;CACvE,OAAO,IAAI,QAAQ,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;;;;;;;AAeA,SAAgB,sBACd,KACA,SACG;CACH,MAAM,WAAW;EACf,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;CACjB;CAKA,OAAO,iBAAiB,UAAU;EAChC,aAAa;GAAE,OAAO,IAAI;GAAa,YAAY;EAAM;EACzD,gBAAgB;GAAE,OAAO,IAAI;GAAgB,YAAY;EAAM;EAC/D,QAAQ;GAAE,aAAa,oBAAoB,KAAK,OAAO;GAAG,YAAY;EAAM;EAC5E,UAAU;GAAE,aAAa,sBAAsB,OAAO;GAAG,YAAY;EAAM;CAC7E,CAAC;CACD,OAAO,eAAe,UAAU,qBAAqB;EACnD,aAAa,sBAAsB,OAAO;EAC1C,YAAY;CACd,CAAC;CAED,OAAO;AACT;;;;;;AAOA,IAAa,gBAAb,MAAa,cAAc;;CAEzB,OAAgB;;CAEhB,YAA0C;;CAE1C;;CAEA;;;;;;;;;;CAWA,YAAoB,aAAqB,gBAAwB;EAC/D,KAAK,cAAc;EACnB,KAAK,iBAAiB;CACxB;;;;;;;;;;;CAYA,aAAa,UAAU,QAA4C;EACjE,IAAI,OAAO,eAAe,IACxB,MAAM,IAAI,MAAM,sDAAsD,OAAO,WAAW,EAAE;EAE5F,MAAM,cAAc,cAAc,MAAM;EACxC,MAAM,iBAAiB,MAAM,YAAA,UAAU,MAAM;EAC7C,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;;;;CAWA,OAAO,WAAW,aAAqB,gBAAuC;EAC5E,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;CAQA,SASE;EACA,OAAO,oBAAoB,MAAM;GAAE,OAAO;GAAuB,MAAM,KAAK;EAAK,CAAC;CAMpF;;;;;;CAOA,WAAmB;EACjB,OAAO,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;CAC/D;;;;;;CAOA,CAAC,uBAA+B;EAC9B,OAAO,KAAK,SAAS;CACvB;AACF"}
+{"version":3,"file":"encryption.cjs","names":[],"sources":["../../src/types/encryption.ts"],"sourcesContent":["import { md5Base64 } from '../util/md5.ts'\n\n/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Shared customer-provided SSE-C key material used by uploads and downloads. */\nexport interface SseCKeyMaterial {\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /**\n   * Base64-encoded 256-bit encryption key provided by the customer.\n   *\n   * This is secret key material. Native B2 SSE-C requests send it as an\n   * HTTP request header, so custom transports and middleware must redact\n   * request headers before logging them.\n   */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting extends SseCKeyMaterial {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n}\n\n/** Server-side encryption using customer-provided keys as returned by B2 responses. */\nexport interface SseCPublicSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** No-encryption shape returned by B2 response objects. */\nexport interface NoEncryptionWireSetting {\n  /** Encryption mode discriminator. B2 response payloads use null for no encryption. */\n  readonly mode: null\n  /** Encryption algorithm. B2 response payloads use null when no encryption is applied. */\n  readonly algorithm: null\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Server-side encryption setting returned by B2 response objects. */\nexport type PublicEncryptionSetting =\n  | SseB2Setting\n  | SseCPublicSetting\n  | NoEncryption\n  | NoEncryptionWireSetting\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\nexport const SSE_C_KEY_REDACTION = '[redacted SSE-C key]'\n\nconst NODE_INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom')\n\ninterface SseCKeyRedactionOptions {\n  readonly label: string\n  readonly mode?: 'SSE-C'\n}\n\ninterface RedactedSseCKeyJson {\n  readonly mode?: 'SSE-C'\n  readonly algorithm: EncryptionAlgorithm\n  readonly customerKey: string\n  readonly customerKeyMd5: string\n}\n\nfunction sseCKeyRedactedJson(\n  key: SseCKeyMaterial,\n  options: SseCKeyRedactionOptions,\n): RedactedSseCKeyJson {\n  return {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n    customerKey: SSE_C_KEY_REDACTION,\n    // The MD5 is not secret key material, but it is still derived from a\n    // customer-provided key. Keep logged key views fully opaque by default.\n    customerKeyMd5: SSE_C_KEY_REDACTION,\n  }\n}\n\nfunction sseCKeyRedactedString(options: SseCKeyRedactionOptions): string {\n  return `[${options.label} ${SSE_C_KEY_REDACTION}]`\n}\n\n/**\n * Wraps SSE-C key material so diagnostic stringification redacts key fields.\n *\n * The returned object keeps `customerKey` and `customerKeyMd5` readable by\n * property access for request header construction, but makes them\n * non-enumerable so object spread and generic serializers do not copy them.\n * Callers that need wire headers must read those fields directly.\n *\n * @param key - SSE-C key material to wrap.\n * @param options - Redaction label and optional encryption mode discriminator.\n *\n * @returns A redacted view with the same readable key fields.\n */\nexport function redactSseCKeyMaterial<T extends SseCKeyMaterial>(\n  key: T,\n  options: SseCKeyRedactionOptions,\n): T {\n  const redacted = {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n  } as T & {\n    toJSON(): RedactedSseCKeyJson\n    toString(): string\n  }\n\n  Object.defineProperties(redacted, {\n    customerKey: { value: key.customerKey, enumerable: false },\n    customerKeyMd5: { value: key.customerKeyMd5, enumerable: false },\n    toJSON: { value: () => sseCKeyRedactedJson(key, options), enumerable: false },\n    toString: { value: () => sseCKeyRedactedString(options), enumerable: false },\n  })\n  Object.defineProperty(redacted, NODE_INSPECT_CUSTOM, {\n    value: () => sseCKeyRedactedString(options),\n    enumerable: false,\n  })\n\n  return redacted\n}\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey implements SseCCustomerSetting {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Generates a random 32-byte (256-bit) SSE-C key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static async generate(): Promise<EncryptionKey> {\n    const rawKey = new Uint8Array(32)\n    getRandomValues(rawKey)\n    return EncryptionKey.fromBytes(rawKey)\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return sseCKeyRedactedJson(this, { label: 'EncryptionKey SSE-C', mode: this.mode }) as {\n      mode: 'SSE-C'\n      algorithm: EncryptionAlgorithm\n      customerKey: string\n      customerKeyMd5: string\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return sseCKeyRedactedString({ label: 'EncryptionKey SSE-C' })\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [NODE_INSPECT_CUSTOM](): string {\n    return this.toString()\n  }\n}\n\nfunction getRandomValues(bytes: Uint8Array): void {\n  const cryptoLike = globalThis.crypto as\n    | { getRandomValues<T extends Uint8Array>(array: T): T }\n    | undefined\n  if (cryptoLike !== undefined) {\n    cryptoLike.getRandomValues(bytes)\n    return\n  }\n\n  throw new Error('EncryptionKey.generate requires crypto.getRandomValues.')\n}\n"],"mappings":";;;AAGA,IAAa,sBAAsB;;AAEjC,QAAQ,SACV;;;;;;;;;;AAcA,IAAa,iBAAiB;;CAE5B,OAAO;;CAEP,MAAM;;CAEN,MAAM;AACR;;AAoEA,IAAa,SAAuB;CAAE,MAAM;CAAU,WAAW;AAAS;;AAG1E,IAAa,WAAyB,EAAE,MAAM,OAAO;;;;;;;;AASrD,SAAgB,YAAY,aAAqB,gBAA6C;CAC5F,OAAO;EAAE,MAAM;EAAS,WAAW;EAAU;EAAa;CAAe;AAC3E;;;;;;;;AASA,SAAS,cAAc,OAA2B;CAKhD,MAAM,IAAI;CAGV,IAAI,EAAE,QACJ,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;CAE/C,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;AAEA,IAAa,sBAAsB;AAEnC,IAAM,sBAAsB,OAAO,IAAI,4BAA4B;AAcnE,SAAS,oBACP,KACA,SACqB;CACrB,OAAO;EACL,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;EACf,aAAa;EAGb,gBAAgB;CAClB;AACF;AAEA,SAAS,sBAAsB,SAA0C;CACvE,OAAO,IAAI,QAAQ,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;;;;;;;AAeA,SAAgB,sBACd,KACA,SACG;CACH,MAAM,WAAW;EACf,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;CACjB;CAKA,OAAO,iBAAiB,UAAU;EAChC,aAAa;GAAE,OAAO,IAAI;GAAa,YAAY;EAAM;EACzD,gBAAgB;GAAE,OAAO,IAAI;GAAgB,YAAY;EAAM;EAC/D,QAAQ;GAAE,aAAa,oBAAoB,KAAK,OAAO;GAAG,YAAY;EAAM;EAC5E,UAAU;GAAE,aAAa,sBAAsB,OAAO;GAAG,YAAY;EAAM;CAC7E,CAAC;CACD,OAAO,eAAe,UAAU,qBAAqB;EACnD,aAAa,sBAAsB,OAAO;EAC1C,YAAY;CACd,CAAC;CAED,OAAO;AACT;;;;;;AAOA,IAAa,gBAAb,MAAa,cAA6C;;CAExD,OAAgB;;CAEhB,YAA0C;;CAE1C;;CAEA;;;;;;;;;;CAWA,YAAoB,aAAqB,gBAAwB;EAC/D,KAAK,cAAc;EACnB,KAAK,iBAAiB;CACxB;;;;;;CAOA,aAAa,WAAmC;EAC9C,MAAM,yBAAS,IAAI,WAAW,EAAE;EAChC,gBAAgB,MAAM;EACtB,OAAO,cAAc,UAAU,MAAM;CACvC;;;;;;;;;;;CAYA,aAAa,UAAU,QAA4C;EACjE,IAAI,OAAO,eAAe,IACxB,MAAM,IAAI,MAAM,sDAAsD,OAAO,WAAW,EAAE;EAE5F,MAAM,cAAc,cAAc,MAAM;EACxC,MAAM,iBAAiB,MAAM,YAAA,UAAU,MAAM;EAC7C,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;;;;CAWA,OAAO,WAAW,aAAqB,gBAAuC;EAC5E,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;CAQA,SASE;EACA,OAAO,oBAAoB,MAAM;GAAE,OAAO;GAAuB,MAAM,KAAK;EAAK,CAAC;CAMpF;;;;;;CAOA,WAAmB;EACjB,OAAO,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;CAC/D;;;;;;CAOA,CAAC,uBAA+B;EAC9B,OAAO,KAAK,SAAS;CACvB;AACF;AAEA,SAAS,gBAAgB,OAAyB;CAChD,MAAM,aAAa,WAAW;CAG9B,IAAI,eAAe,KAAA,GAAW;EAC5B,WAAW,gBAAgB,KAAK;EAChC;CACF;CAEA,MAAM,IAAI,MAAM,yDAAyD;AAC3E"}

package/dist/types/encryption.d.cts

@@ -31,17 +31,26 @@ export interface SseB2Setting {
     /** Encryption algorithm. Always `'AES256'`. */
     readonly algorithm: EncryptionAlgorithm;
 }
-/** Server-side encryption using customer-provided keys (SSE-C). */
-export interface SseCCustomerSetting {
-    /** Encryption mode discriminator. Always `'SSE-C'`. */
-    readonly mode: 'SSE-C';
+/** Shared customer-provided SSE-C key material used by uploads and downloads. */
+export interface SseCKeyMaterial {
     /** Encryption algorithm. Always `'AES256'`. */
     readonly algorithm: EncryptionAlgorithm;
-    /** Base64-encoded 256-bit encryption key provided by the customer. */
+    /**
+     * Base64-encoded 256-bit encryption key provided by the customer.
+     *
+     * This is secret key material. Native B2 SSE-C requests send it as an
+     * HTTP request header, so custom transports and middleware must redact
+     * request headers before logging them.
+     */
     readonly customerKey: string;
     /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */
     readonly customerKeyMd5: string;
 }
+/** Server-side encryption using customer-provided keys (SSE-C). */
+export interface SseCCustomerSetting extends SseCKeyMaterial {
+    /** Encryption mode discriminator. Always `'SSE-C'`. */
+    readonly mode: 'SSE-C';
+}
 /** Server-side encryption using customer-provided keys as returned by B2 responses. */
 export interface SseCPublicSetting {
     /** Encryption mode discriminator. Always `'SSE-C'`. */
@@ -79,11 +88,6 @@ export declare const SSE_NONE: NoEncryption;
 export declare function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting;
 export declare const SSE_C_KEY_REDACTION = "[redacted SSE-C key]";
 declare const NODE_INSPECT_CUSTOM: unique symbol;
-interface SseCKeyMaterial {
-    readonly algorithm: EncryptionAlgorithm;
-    readonly customerKey: string;
-    readonly customerKeyMd5: string;
-}
 interface SseCKeyRedactionOptions {
     readonly label: string;
     readonly mode?: 'SSE-C';
@@ -107,7 +111,7 @@ export declare function redactSseCKeyMaterial<T extends SseCKeyMaterial>(key: T,
  * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}
  * to construct one from a raw 32-byte key; the MD5 digest is computed internally.
  */
-export declare class EncryptionKey {
+export declare class EncryptionKey implements SseCCustomerSetting {
     /** Encryption mode discriminant. Always `'SSE-C'` for this class. */
     readonly mode: "SSE-C";
     /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */
@@ -126,6 +130,12 @@ export declare class EncryptionKey {
      * @internal
      */
     private constructor();
+    /**
+     * Generates a random 32-byte (256-bit) SSE-C key.
+     *
+     * @returns A safely-wrapped EncryptionKey ready for upload/download.
+     */
+    static generate(): Promise<EncryptionKey>;
     /**
      * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
      * required base64 MD5 digest internally.

package/dist/types/encryption.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAC/B,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,uBAAuB,CAAA;AAE3B,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAyBD,eAAO,MAAM,mBAAmB,yBAAyB,CAAA;AAEzD,QAAA,MAAM,mBAAmB,eAA2C,CAAA;AAEpE,UAAU,eAAe;IACvB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CACxB;AA2BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,eAAe,EAC7D,GAAG,EAAE,CAAC,EACN,OAAO,EAAE,uBAAuB,GAC/B,CAAC,CAqBH;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;IAIlB;;;;OAIG;IACH,CAAC,mBAAmB,CAAC,IAAI,MAAM;CAGhC"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAC/B,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,uBAAuB,CAAA;AAE3B,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAyBD,eAAO,MAAM,mBAAmB,yBAAyB,CAAA;AAEzD,QAAA,MAAM,mBAAmB,eAA2C,CAAA;AAEpE,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CACxB;AA2BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,eAAe,EAC7D,GAAG,EAAE,CAAC,EACN,OAAO,EAAE,uBAAuB,GAC/B,CAAC,CAqBH;AAED;;;;GAIG;AACH,qBAAa,aAAc,YAAW,mBAAmB;IACvD,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;OAIG;WACU,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC;IAM/C;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;IAIlB;;;;OAIG;IACH,CAAC,mBAAmB,CAAC,IAAI,MAAM;CAGhC"}

package/dist/types/encryption.d.ts

@@ -31,17 +31,26 @@ export interface SseB2Setting {
     /** Encryption algorithm. Always `'AES256'`. */
     readonly algorithm: EncryptionAlgorithm;
 }
-/** Server-side encryption using customer-provided keys (SSE-C). */
-export interface SseCCustomerSetting {
-    /** Encryption mode discriminator. Always `'SSE-C'`. */
-    readonly mode: 'SSE-C';
+/** Shared customer-provided SSE-C key material used by uploads and downloads. */
+export interface SseCKeyMaterial {
     /** Encryption algorithm. Always `'AES256'`. */
     readonly algorithm: EncryptionAlgorithm;
-    /** Base64-encoded 256-bit encryption key provided by the customer. */
+    /**
+     * Base64-encoded 256-bit encryption key provided by the customer.
+     *
+     * This is secret key material. Native B2 SSE-C requests send it as an
+     * HTTP request header, so custom transports and middleware must redact
+     * request headers before logging them.
+     */
     readonly customerKey: string;
     /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */
     readonly customerKeyMd5: string;
 }
+/** Server-side encryption using customer-provided keys (SSE-C). */
+export interface SseCCustomerSetting extends SseCKeyMaterial {
+    /** Encryption mode discriminator. Always `'SSE-C'`. */
+    readonly mode: 'SSE-C';
+}
 /** Server-side encryption using customer-provided keys as returned by B2 responses. */
 export interface SseCPublicSetting {
     /** Encryption mode discriminator. Always `'SSE-C'`. */
@@ -79,11 +88,6 @@ export declare const SSE_NONE: NoEncryption;
 export declare function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting;
 export declare const SSE_C_KEY_REDACTION = "[redacted SSE-C key]";
 declare const NODE_INSPECT_CUSTOM: unique symbol;
-interface SseCKeyMaterial {
-    readonly algorithm: EncryptionAlgorithm;
-    readonly customerKey: string;
-    readonly customerKeyMd5: string;
-}
 interface SseCKeyRedactionOptions {
     readonly label: string;
     readonly mode?: 'SSE-C';
@@ -107,7 +111,7 @@ export declare function redactSseCKeyMaterial<T extends SseCKeyMaterial>(key: T,
  * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}
  * to construct one from a raw 32-byte key; the MD5 digest is computed internally.
  */
-export declare class EncryptionKey {
+export declare class EncryptionKey implements SseCCustomerSetting {
     /** Encryption mode discriminant. Always `'SSE-C'` for this class. */
     readonly mode: "SSE-C";
     /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */
@@ -126,6 +130,12 @@ export declare class EncryptionKey {
      * @internal
      */
     private constructor();
+    /**
+     * Generates a random 32-byte (256-bit) SSE-C key.
+     *
+     * @returns A safely-wrapped EncryptionKey ready for upload/download.
+     */
+    static generate(): Promise<EncryptionKey>;
     /**
      * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
      * required base64 MD5 digest internally.

package/dist/types/encryption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAC/B,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,uBAAuB,CAAA;AAE3B,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAyBD,eAAO,MAAM,mBAAmB,yBAAyB,CAAA;AAEzD,QAAA,MAAM,mBAAmB,eAA2C,CAAA;AAEpE,UAAU,eAAe;IACvB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CACxB;AA2BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,eAAe,EAC7D,GAAG,EAAE,CAAC,EACN,OAAO,EAAE,uBAAuB,GAC/B,CAAC,CAqBH;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;IAIlB;;;;OAIG;IACH,CAAC,mBAAmB,CAAC,IAAI,MAAM;CAGhC"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/types/encryption.js"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;IAC9B,wEAAwE;;CAEhE,CAAA;AAEV,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;IACzB,kCAAkC;;IAElC,yCAAyC;;IAEzC,qBAAqB;;CAEb,CAAA;AAEV,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEjF,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAC/B,YAAY,GACZ,iBAAiB,GACjB,YAAY,GACZ,uBAAuB,CAAA;AAE3B,yDAAyD;AACzD,eAAO,MAAM,MAAM,EAAE,YAAsD,CAAA;AAE3E,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,YAA+B,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,mBAAmB,CAE5F;AAyBD,eAAO,MAAM,mBAAmB,yBAAyB,CAAA;AAEzD,QAAA,MAAM,mBAAmB,eAA2C,CAAA;AAEpE,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CACxB;AA2BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,eAAe,EAC7D,GAAG,EAAE,CAAC,EACN,OAAO,EAAE,uBAAuB,GAC/B,CAAC,CAqBH;AAED;;;;GAIG;AACH,qBAAa,aAAc,YAAW,mBAAmB;IACvD,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAW;IAClD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO;IAKP;;;;OAIG;WACU,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC;IAM/C;;;;;;;;;OASG;WACU,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IASlE;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAI7E;;;;;OAKG;IACH,MAAM,IAAI;QACR,oCAAoC;QACpC,IAAI,EAAE,OAAO,CAAA;QACb,4BAA4B;QAC5B,SAAS,EAAE,mBAAmB,CAAA;QAC9B,wFAAwF;QACxF,WAAW,EAAE,MAAM,CAAA;QACnB,wFAAwF;QACxF,cAAc,EAAE,MAAM,CAAA;KACvB;IASD;;;;OAIG;IACH,QAAQ,IAAI,MAAM;IAIlB;;;;OAIG;IACH,CAAC,mBAAmB,CAAC,IAAI,MAAM;CAGhC"}

package/dist/types/encryption.js

@@ -140,6 +140,16 @@ var EncryptionKey = class EncryptionKey {
 		this.customerKeyMd5 = customerKeyMd5;
 	}
 	/**
+	* Generates a random 32-byte (256-bit) SSE-C key.
+	*
+	* @returns A safely-wrapped EncryptionKey ready for upload/download.
+	*/
+	static async generate() {
+		const rawKey = /* @__PURE__ */ new Uint8Array(32);
+		getRandomValues(rawKey);
+		return EncryptionKey.fromBytes(rawKey);
+	}
+	/**
 	* Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the
 	* required base64 MD5 digest internally.
 	*
@@ -196,6 +206,14 @@ var EncryptionKey = class EncryptionKey {
 		return this.toString();
 	}
 };
+function getRandomValues(bytes) {
+	const cryptoLike = globalThis.crypto;
+	if (cryptoLike !== void 0) {
+		cryptoLike.getRandomValues(bytes);
+		return;
+	}
+	throw new Error("EncryptionKey.generate requires crypto.getRandomValues.");
+}
 //#endregion
 export { EncryptionAlgorithm, EncryptionKey, EncryptionMode, SSE_B2, SSE_C_KEY_REDACTION, SSE_NONE, redactSseCKeyMaterial, sseCustomer };
 

package/dist/types/encryption.js.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.js","names":[],"sources":["../../src/types/encryption.ts"],"sourcesContent":["import { md5Base64 } from '../util/md5.ts'\n\n/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /** Base64-encoded 256-bit encryption key provided by the customer. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Server-side encryption using customer-provided keys as returned by B2 responses. */\nexport interface SseCPublicSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** No-encryption shape returned by B2 response objects. */\nexport interface NoEncryptionWireSetting {\n  /** Encryption mode discriminator. B2 response payloads use null for no encryption. */\n  readonly mode: null\n  /** Encryption algorithm. B2 response payloads use null when no encryption is applied. */\n  readonly algorithm: null\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Server-side encryption setting returned by B2 response objects. */\nexport type PublicEncryptionSetting =\n  | SseB2Setting\n  | SseCPublicSetting\n  | NoEncryption\n  | NoEncryptionWireSetting\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\nexport const SSE_C_KEY_REDACTION = '[redacted SSE-C key]'\n\nconst NODE_INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom')\n\ninterface SseCKeyMaterial {\n  readonly algorithm: EncryptionAlgorithm\n  readonly customerKey: string\n  readonly customerKeyMd5: string\n}\n\ninterface SseCKeyRedactionOptions {\n  readonly label: string\n  readonly mode?: 'SSE-C'\n}\n\ninterface RedactedSseCKeyJson {\n  readonly mode?: 'SSE-C'\n  readonly algorithm: EncryptionAlgorithm\n  readonly customerKey: string\n  readonly customerKeyMd5: string\n}\n\nfunction sseCKeyRedactedJson(\n  key: SseCKeyMaterial,\n  options: SseCKeyRedactionOptions,\n): RedactedSseCKeyJson {\n  return {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n    customerKey: SSE_C_KEY_REDACTION,\n    // The MD5 is not secret key material, but it is still derived from a\n    // customer-provided key. Keep logged key views fully opaque by default.\n    customerKeyMd5: SSE_C_KEY_REDACTION,\n  }\n}\n\nfunction sseCKeyRedactedString(options: SseCKeyRedactionOptions): string {\n  return `[${options.label} ${SSE_C_KEY_REDACTION}]`\n}\n\n/**\n * Wraps SSE-C key material so diagnostic stringification redacts key fields.\n *\n * The returned object keeps `customerKey` and `customerKeyMd5` readable by\n * property access for request header construction, but makes them\n * non-enumerable so object spread and generic serializers do not copy them.\n * Callers that need wire headers must read those fields directly.\n *\n * @param key - SSE-C key material to wrap.\n * @param options - Redaction label and optional encryption mode discriminator.\n *\n * @returns A redacted view with the same readable key fields.\n */\nexport function redactSseCKeyMaterial<T extends SseCKeyMaterial>(\n  key: T,\n  options: SseCKeyRedactionOptions,\n): T {\n  const redacted = {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n  } as T & {\n    toJSON(): RedactedSseCKeyJson\n    toString(): string\n  }\n\n  Object.defineProperties(redacted, {\n    customerKey: { value: key.customerKey, enumerable: false },\n    customerKeyMd5: { value: key.customerKeyMd5, enumerable: false },\n    toJSON: { value: () => sseCKeyRedactedJson(key, options), enumerable: false },\n    toString: { value: () => sseCKeyRedactedString(options), enumerable: false },\n  })\n  Object.defineProperty(redacted, NODE_INSPECT_CUSTOM, {\n    value: () => sseCKeyRedactedString(options),\n    enumerable: false,\n  })\n\n  return redacted\n}\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return sseCKeyRedactedJson(this, { label: 'EncryptionKey SSE-C', mode: this.mode }) as {\n      mode: 'SSE-C'\n      algorithm: EncryptionAlgorithm\n      customerKey: string\n      customerKeyMd5: string\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return sseCKeyRedactedString({ label: 'EncryptionKey SSE-C' })\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [NODE_INSPECT_CUSTOM](): string {\n    return this.toString()\n  }\n}\n"],"mappings":";;;AAGA,IAAa,sBAAsB;;AAEjC,QAAQ,SACV;;;;;;;;;;AAcA,IAAa,iBAAiB;;CAE5B,OAAO;;CAEP,MAAM;;CAEN,MAAM;AACR;;AA0DA,IAAa,SAAuB;CAAE,MAAM;CAAU,WAAW;AAAS;;AAG1E,IAAa,WAAyB,EAAE,MAAM,OAAO;;;;;;;;AASrD,SAAgB,YAAY,aAAqB,gBAA6C;CAC5F,OAAO;EAAE,MAAM;EAAS,WAAW;EAAU;EAAa;CAAe;AAC3E;;;;;;;;AASA,SAAS,cAAc,OAA2B;CAKhD,MAAM,IAAI;CAGV,IAAI,EAAE,QACJ,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;CAE/C,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;AAEA,IAAa,sBAAsB;AAEnC,IAAM,sBAAsB,OAAO,IAAI,4BAA4B;AAoBnE,SAAS,oBACP,KACA,SACqB;CACrB,OAAO;EACL,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;EACf,aAAa;EAGb,gBAAgB;CAClB;AACF;AAEA,SAAS,sBAAsB,SAA0C;CACvE,OAAO,IAAI,QAAQ,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;;;;;;;AAeA,SAAgB,sBACd,KACA,SACG;CACH,MAAM,WAAW;EACf,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;CACjB;CAKA,OAAO,iBAAiB,UAAU;EAChC,aAAa;GAAE,OAAO,IAAI;GAAa,YAAY;EAAM;EACzD,gBAAgB;GAAE,OAAO,IAAI;GAAgB,YAAY;EAAM;EAC/D,QAAQ;GAAE,aAAa,oBAAoB,KAAK,OAAO;GAAG,YAAY;EAAM;EAC5E,UAAU;GAAE,aAAa,sBAAsB,OAAO;GAAG,YAAY;EAAM;CAC7E,CAAC;CACD,OAAO,eAAe,UAAU,qBAAqB;EACnD,aAAa,sBAAsB,OAAO;EAC1C,YAAY;CACd,CAAC;CAED,OAAO;AACT;;;;;;AAOA,IAAa,gBAAb,MAAa,cAAc;;CAEzB,OAAgB;;CAEhB,YAA0C;;CAE1C;;CAEA;;;;;;;;;;CAWA,YAAoB,aAAqB,gBAAwB;EAC/D,KAAK,cAAc;EACnB,KAAK,iBAAiB;CACxB;;;;;;;;;;;CAYA,aAAa,UAAU,QAA4C;EACjE,IAAI,OAAO,eAAe,IACxB,MAAM,IAAI,MAAM,sDAAsD,OAAO,WAAW,EAAE;EAE5F,MAAM,cAAc,cAAc,MAAM;EACxC,MAAM,iBAAiB,MAAM,UAAU,MAAM;EAC7C,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;;;;CAWA,OAAO,WAAW,aAAqB,gBAAuC;EAC5E,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;CAQA,SASE;EACA,OAAO,oBAAoB,MAAM;GAAE,OAAO;GAAuB,MAAM,KAAK;EAAK,CAAC;CAMpF;;;;;;CAOA,WAAmB;EACjB,OAAO,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;CAC/D;;;;;;CAOA,CAAC,uBAA+B;EAC9B,OAAO,KAAK,SAAS;CACvB;AACF"}
+{"version":3,"file":"encryption.js","names":[],"sources":["../../src/types/encryption.ts"],"sourcesContent":["import { md5Base64 } from '../util/md5.ts'\n\n/** Named constants for the supported server-side encryption algorithms. */\nexport const EncryptionAlgorithm = {\n  /** AES with a 256-bit key. The only algorithm B2 currently supports. */\n  Aes256: 'AES256',\n} as const\n\n/** Supported server-side encryption algorithm. Derived from {@link EncryptionAlgorithm}. */\nexport type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm]\n\n/**\n * Named constants for the server-side encryption mode used by a file.\n *\n * Most callers should use the {@link SSE_B2}, {@link SSE_NONE}, and\n * {@link sseCustomer} helpers below which return complete\n * {@link EncryptionSetting} objects. These constants are useful when you\n * need the bare mode discriminator (e.g., when introspecting a file's\n * current encryption setting).\n */\nexport const EncryptionMode = {\n  /** B2-managed encryption keys. */\n  SseB2: 'SSE-B2',\n  /** Customer-provided encryption keys. */\n  SseC: 'SSE-C',\n  /** No encryption. */\n  None: 'none',\n} as const\n\n/** Server-side encryption mode for files stored in B2. Derived from {@link EncryptionMode}. */\nexport type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode]\n\n/** Server-side encryption using B2-managed keys (SSE-B2). */\nexport interface SseB2Setting {\n  /** Encryption mode discriminator. Always `'SSE-B2'`. */\n  readonly mode: 'SSE-B2'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Shared customer-provided SSE-C key material used by uploads and downloads. */\nexport interface SseCKeyMaterial {\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n  /**\n   * Base64-encoded 256-bit encryption key provided by the customer.\n   *\n   * This is secret key material. Native B2 SSE-C requests send it as an\n   * HTTP request header, so custom transports and middleware must redact\n   * request headers before logging them.\n   */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer-provided key, used for integrity verification. */\n  readonly customerKeyMd5: string\n}\n\n/** Server-side encryption using customer-provided keys (SSE-C). */\nexport interface SseCCustomerSetting extends SseCKeyMaterial {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n}\n\n/** Server-side encryption using customer-provided keys as returned by B2 responses. */\nexport interface SseCPublicSetting {\n  /** Encryption mode discriminator. Always `'SSE-C'`. */\n  readonly mode: 'SSE-C'\n  /** Encryption algorithm. Always `'AES256'`. */\n  readonly algorithm: EncryptionAlgorithm\n}\n\n/** Indicates no server-side encryption is applied. */\nexport interface NoEncryption {\n  /** Encryption mode discriminator. Always `'none'`. */\n  readonly mode: 'none'\n}\n\n/** No-encryption shape returned by B2 response objects. */\nexport interface NoEncryptionWireSetting {\n  /** Encryption mode discriminator. B2 response payloads use null for no encryption. */\n  readonly mode: null\n  /** Encryption algorithm. B2 response payloads use null when no encryption is applied. */\n  readonly algorithm: null\n}\n\n/** Union of all server-side encryption settings: B2-managed, customer-provided, or none. */\nexport type EncryptionSetting = SseB2Setting | SseCCustomerSetting | NoEncryption\n\n/** Server-side encryption setting returned by B2 response objects. */\nexport type PublicEncryptionSetting =\n  | SseB2Setting\n  | SseCPublicSetting\n  | NoEncryption\n  | NoEncryptionWireSetting\n\n/** Pre-built SSE-B2 encryption setting using AES-256. */\nexport const SSE_B2: SseB2Setting = { mode: 'SSE-B2', algorithm: 'AES256' }\n\n/** Pre-built setting indicating no server-side encryption. */\nexport const SSE_NONE: NoEncryption = { mode: 'none' }\n\n/**\n * Creates an SSE-C encryption setting with a customer-provided key.\n * @param customerKey - Base64-encoded 256-bit encryption key.\n * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n *\n * @returns An SSE-C encryption setting ready to pass to upload or download calls.\n */\nexport function sseCustomer(customerKey: string, customerKeyMd5: string): SseCCustomerSetting {\n  return { mode: 'SSE-C', algorithm: 'AES256', customerKey, customerKeyMd5 }\n}\n\n/**\n * Encodes raw bytes as base64 in an isomorphic way (Node Buffer fallback to btoa).\n *\n * @param bytes - The raw bytes to encode.\n *\n * @returns The base64-encoded string.\n */\nfunction bytesToBase64(bytes: Uint8Array): string {\n  // Prefer Node's Buffer when available (faster), but degrade to btoa() in\n  // browsers / Deno / Workers where Buffer isn't a global. We access via\n  // globalThis to avoid a hard reference to a Node-only symbol — that would\n  // break the type-check in non-Node runtimes (Deno, browser-mode Vitest).\n  const g = globalThis as {\n    Buffer?: { from(b: Uint8Array): { toString(encoding: string): string } }\n  }\n  if (g.Buffer) {\n    return g.Buffer.from(bytes).toString('base64')\n  }\n  let binary = ''\n  for (const b of bytes) binary += String.fromCharCode(b)\n  return btoa(binary)\n}\n\nexport const SSE_C_KEY_REDACTION = '[redacted SSE-C key]'\n\nconst NODE_INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom')\n\ninterface SseCKeyRedactionOptions {\n  readonly label: string\n  readonly mode?: 'SSE-C'\n}\n\ninterface RedactedSseCKeyJson {\n  readonly mode?: 'SSE-C'\n  readonly algorithm: EncryptionAlgorithm\n  readonly customerKey: string\n  readonly customerKeyMd5: string\n}\n\nfunction sseCKeyRedactedJson(\n  key: SseCKeyMaterial,\n  options: SseCKeyRedactionOptions,\n): RedactedSseCKeyJson {\n  return {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n    customerKey: SSE_C_KEY_REDACTION,\n    // The MD5 is not secret key material, but it is still derived from a\n    // customer-provided key. Keep logged key views fully opaque by default.\n    customerKeyMd5: SSE_C_KEY_REDACTION,\n  }\n}\n\nfunction sseCKeyRedactedString(options: SseCKeyRedactionOptions): string {\n  return `[${options.label} ${SSE_C_KEY_REDACTION}]`\n}\n\n/**\n * Wraps SSE-C key material so diagnostic stringification redacts key fields.\n *\n * The returned object keeps `customerKey` and `customerKeyMd5` readable by\n * property access for request header construction, but makes them\n * non-enumerable so object spread and generic serializers do not copy them.\n * Callers that need wire headers must read those fields directly.\n *\n * @param key - SSE-C key material to wrap.\n * @param options - Redaction label and optional encryption mode discriminator.\n *\n * @returns A redacted view with the same readable key fields.\n */\nexport function redactSseCKeyMaterial<T extends SseCKeyMaterial>(\n  key: T,\n  options: SseCKeyRedactionOptions,\n): T {\n  const redacted = {\n    ...(options.mode !== undefined ? { mode: options.mode } : {}),\n    algorithm: key.algorithm,\n  } as T & {\n    toJSON(): RedactedSseCKeyJson\n    toString(): string\n  }\n\n  Object.defineProperties(redacted, {\n    customerKey: { value: key.customerKey, enumerable: false },\n    customerKeyMd5: { value: key.customerKeyMd5, enumerable: false },\n    toJSON: { value: () => sseCKeyRedactedJson(key, options), enumerable: false },\n    toString: { value: () => sseCKeyRedactedString(options), enumerable: false },\n  })\n  Object.defineProperty(redacted, NODE_INSPECT_CUSTOM, {\n    value: () => sseCKeyRedactedString(options),\n    enumerable: false,\n  })\n\n  return redacted\n}\n\n/**\n * Safe wrapper around an SSE-C customer key. Hides the key bytes from\n * `JSON.stringify`, `console.log`, and Node's `util.inspect`. Use {@link EncryptionKey.fromBytes}\n * to construct one from a raw 32-byte key; the MD5 digest is computed internally.\n */\nexport class EncryptionKey implements SseCCustomerSetting {\n  /** Encryption mode discriminant. Always `'SSE-C'` for this class. */\n  readonly mode = 'SSE-C' as const\n  /** Encryption algorithm. B2's S3-compatible API only supports AES-256. */\n  readonly algorithm: EncryptionAlgorithm = 'AES256'\n  /** Base64-encoded 256-bit customer key. Logged as `[redacted SSE-C key]` via `toJSON` / `toString`. */\n  readonly customerKey: string\n  /** Base64-encoded MD5 digest of the customer key. Required by B2 for integrity verification. */\n  readonly customerKeyMd5: string\n\n  /**\n   * Internal constructor. Use {@link EncryptionKey.fromBytes} or\n   * {@link EncryptionKey.fromBase64} instead.\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @internal\n   */\n  private constructor(customerKey: string, customerKeyMd5: string) {\n    this.customerKey = customerKey\n    this.customerKeyMd5 = customerKeyMd5\n  }\n\n  /**\n   * Generates a random 32-byte (256-bit) SSE-C key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static async generate(): Promise<EncryptionKey> {\n    const rawKey = new Uint8Array(32)\n    getRandomValues(rawKey)\n    return EncryptionKey.fromBytes(rawKey)\n  }\n\n  /**\n   * Builds an EncryptionKey from a raw 32-byte (256-bit) key. Computes the\n   * required base64 MD5 digest internally.\n   *\n   * @param rawKey - The raw 256-bit key as bytes. Must be exactly 32 bytes.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   *\n   * @throws If the key is not exactly 32 bytes.\n   */\n  static async fromBytes(rawKey: Uint8Array): Promise<EncryptionKey> {\n    if (rawKey.byteLength !== 32) {\n      throw new Error(`SSE-C key must be exactly 32 bytes (256 bits); got ${rawKey.byteLength}.`)\n    }\n    const customerKey = bytesToBase64(rawKey)\n    const customerKeyMd5 = await md5Base64(rawKey)\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Builds an EncryptionKey from precomputed base64 strings. Use this in\n   * environments where MD5 must be computed externally (e.g., browsers).\n   *\n   * @param customerKey - Base64-encoded 256-bit encryption key.\n   * @param customerKeyMd5 - Base64-encoded MD5 digest of the key.\n   *\n   * @returns A safely-wrapped EncryptionKey ready for upload/download.\n   */\n  static fromBase64(customerKey: string, customerKeyMd5: string): EncryptionKey {\n    return new EncryptionKey(customerKey, customerKeyMd5)\n  }\n\n  /**\n   * Hides the key bytes from `JSON.stringify`.\n   *\n   * @returns A redacted shape: same mode and algorithm, but the key and MD5\n   *   replaced with a placeholder string.\n   */\n  toJSON(): {\n    /** Encryption mode discriminant. */\n    mode: 'SSE-C'\n    /** Encryption algorithm. */\n    algorithm: EncryptionAlgorithm\n    /** Always the literal redaction placeholder; the real key never leaves the instance. */\n    customerKey: string\n    /** Always the literal redaction placeholder; the real MD5 never leaves the instance. */\n    customerKeyMd5: string\n  } {\n    return sseCKeyRedactedJson(this, { label: 'EncryptionKey SSE-C', mode: this.mode }) as {\n      mode: 'SSE-C'\n      algorithm: EncryptionAlgorithm\n      customerKey: string\n      customerKeyMd5: string\n    }\n  }\n\n  /**\n   * Hides the key bytes from default `toString()`.\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  toString(): string {\n    return sseCKeyRedactedString({ label: 'EncryptionKey SSE-C' })\n  }\n\n  /**\n   * Hides the key bytes from Node's `util.inspect` (and therefore `console.log`).\n   *\n   * @returns A short opaque label indicating this is an SSE-C key.\n   */\n  [NODE_INSPECT_CUSTOM](): string {\n    return this.toString()\n  }\n}\n\nfunction getRandomValues(bytes: Uint8Array): void {\n  const cryptoLike = globalThis.crypto as\n    | { getRandomValues<T extends Uint8Array>(array: T): T }\n    | undefined\n  if (cryptoLike !== undefined) {\n    cryptoLike.getRandomValues(bytes)\n    return\n  }\n\n  throw new Error('EncryptionKey.generate requires crypto.getRandomValues.')\n}\n"],"mappings":";;;AAGA,IAAa,sBAAsB;;AAEjC,QAAQ,SACV;;;;;;;;;;AAcA,IAAa,iBAAiB;;CAE5B,OAAO;;CAEP,MAAM;;CAEN,MAAM;AACR;;AAoEA,IAAa,SAAuB;CAAE,MAAM;CAAU,WAAW;AAAS;;AAG1E,IAAa,WAAyB,EAAE,MAAM,OAAO;;;;;;;;AASrD,SAAgB,YAAY,aAAqB,gBAA6C;CAC5F,OAAO;EAAE,MAAM;EAAS,WAAW;EAAU;EAAa;CAAe;AAC3E;;;;;;;;AASA,SAAS,cAAc,OAA2B;CAKhD,MAAM,IAAI;CAGV,IAAI,EAAE,QACJ,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;CAE/C,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;AAEA,IAAa,sBAAsB;AAEnC,IAAM,sBAAsB,OAAO,IAAI,4BAA4B;AAcnE,SAAS,oBACP,KACA,SACqB;CACrB,OAAO;EACL,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;EACf,aAAa;EAGb,gBAAgB;CAClB;AACF;AAEA,SAAS,sBAAsB,SAA0C;CACvE,OAAO,IAAI,QAAQ,MAAM,GAAG,oBAAoB;AAClD;;;;;;;;;;;;;;AAeA,SAAgB,sBACd,KACA,SACG;CACH,MAAM,WAAW;EACf,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC3D,WAAW,IAAI;CACjB;CAKA,OAAO,iBAAiB,UAAU;EAChC,aAAa;GAAE,OAAO,IAAI;GAAa,YAAY;EAAM;EACzD,gBAAgB;GAAE,OAAO,IAAI;GAAgB,YAAY;EAAM;EAC/D,QAAQ;GAAE,aAAa,oBAAoB,KAAK,OAAO;GAAG,YAAY;EAAM;EAC5E,UAAU;GAAE,aAAa,sBAAsB,OAAO;GAAG,YAAY;EAAM;CAC7E,CAAC;CACD,OAAO,eAAe,UAAU,qBAAqB;EACnD,aAAa,sBAAsB,OAAO;EAC1C,YAAY;CACd,CAAC;CAED,OAAO;AACT;;;;;;AAOA,IAAa,gBAAb,MAAa,cAA6C;;CAExD,OAAgB;;CAEhB,YAA0C;;CAE1C;;CAEA;;;;;;;;;;CAWA,YAAoB,aAAqB,gBAAwB;EAC/D,KAAK,cAAc;EACnB,KAAK,iBAAiB;CACxB;;;;;;CAOA,aAAa,WAAmC;EAC9C,MAAM,yBAAS,IAAI,WAAW,EAAE;EAChC,gBAAgB,MAAM;EACtB,OAAO,cAAc,UAAU,MAAM;CACvC;;;;;;;;;;;CAYA,aAAa,UAAU,QAA4C;EACjE,IAAI,OAAO,eAAe,IACxB,MAAM,IAAI,MAAM,sDAAsD,OAAO,WAAW,EAAE;EAE5F,MAAM,cAAc,cAAc,MAAM;EACxC,MAAM,iBAAiB,MAAM,UAAU,MAAM;EAC7C,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;;;;CAWA,OAAO,WAAW,aAAqB,gBAAuC;EAC5E,OAAO,IAAI,cAAc,aAAa,cAAc;CACtD;;;;;;;CAQA,SASE;EACA,OAAO,oBAAoB,MAAM;GAAE,OAAO;GAAuB,MAAM,KAAK;EAAK,CAAC;CAMpF;;;;;;CAOA,WAAmB;EACjB,OAAO,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;CAC/D;;;;;;CAOA,CAAC,uBAA+B;EAC9B,OAAO,KAAK,SAAS;CACvB;AACF;AAEA,SAAS,gBAAgB,OAAyB;CAChD,MAAM,aAAa,WAAW;CAG9B,IAAI,eAAe,KAAA,GAAW;EAC5B,WAAW,gBAAgB,KAAK;EAChC;CACF;CAEA,MAAM,IAAI,MAAM,yDAAyD;AAC3E"}

package/dist/types/file.cjs

@@ -19,6 +19,8 @@ var FileAction = {
 	/** Created via server-side copy. */
 	Copy: "copy"
 };
+/** MIME type B2 returns for hide-marker rows in `b2_list_file_versions`. */
+var HIDE_MARKER_CONTENT_TYPE = "application/x-bz-hide-marker";
 /**
 * Named constants for how metadata is handled during a file copy.
 *
@@ -35,6 +37,7 @@ var MetadataDirective = {
 };
 //#endregion
 exports.FileAction = FileAction;
+exports.HIDE_MARKER_CONTENT_TYPE = HIDE_MARKER_CONTENT_TYPE;
 exports.MetadataDirective = MetadataDirective;
 
 //# sourceMappingURL=file.cjs.map

package/dist/types/file.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"file.cjs","names":[],"sources":["../../src/types/file.ts"],"sourcesContent":["import type { EncryptionSetting, PublicEncryptionSetting } from './encryption.ts'\nimport type { AccountId, BucketId, FileId } from './ids.ts'\nimport type { FileRetentionValue, LegalHoldValue } from './lock.ts'\n\n/**\n * Named constants for the action that created a file version.\n *\n * @example\n * ```ts\n * if (file.action === FileAction.Hide) { ... }\n * ```\n */\nexport const FileAction = {\n  /** Large file upload started but not yet finished. */\n  Start: 'start',\n  /** Normal upload (small or finished large file). */\n  Upload: 'upload',\n  /** Hide marker (soft delete). */\n  Hide: 'hide',\n  /** Virtual folder marker. */\n  Folder: 'folder',\n  /** Created via server-side copy. */\n  Copy: 'copy',\n} as const\n\n/**\n * The action that created a file version. Derived from {@link FileAction}.\n *\n * - `'start'`: large file upload started but not yet finished.\n * - `'upload'`: file was uploaded normally.\n * - `'hide'`: file was hidden (soft-deleted).\n * - `'folder'`: virtual folder marker.\n * - `'copy'`: file was created via server-side copy.\n */\nexport type FileAction = (typeof FileAction)[keyof typeof FileAction]\n\n/**\n * Replication status for a file version or unfinished large file.\n *\n * B2 returns these uppercase wire values as-is and omits the containing\n * `replicationStatus` field when the file is not covered by a replication rule.\n */\nexport type ReplicationStatus = 'PENDING' | 'COMPLETED' | 'FAILED' | 'REPLICA'\n\n/**\n * Complete metadata for a single file version in B2.\n * Returned by `b2_get_file_info`, `b2_list_file_names`, `b2_list_file_versions`,\n * `b2_upload_file`, `b2_copy_file`, and other file-related endpoints.\n */\nexport interface FileVersion {\n  /** Account that owns this file. */\n  readonly accountId: AccountId\n  /** Action that created this file version. */\n  readonly action: FileAction\n  /** Bucket containing this file. */\n  readonly bucketId: BucketId\n  /** Size of the file content in bytes. */\n  readonly contentLength: number\n  /** MD5 checksum of the content, or null if not available. */\n  readonly contentMd5: string | null\n  /** SHA-1 checksum of the content, or null if not available (e.g., large files). */\n  readonly contentSha1: string | null\n  /** MIME type of the file content. */\n  readonly contentType: string\n  /** Unique identifier for this file version. */\n  readonly fileId: FileId\n  /** User-defined key-value metadata stored with the file. */\n  readonly fileInfo: Record<string, string>\n  /** Full path and name of the file within the bucket. */\n  readonly fileName: string\n  /** Object Lock retention settings for this file version. */\n  readonly fileRetention: {\n    /** Whether the caller is authorized to read retention settings. */\n    readonly isClientAuthorizedToRead: boolean\n    /** Retention settings, or null if the caller lacks read authorization. */\n    readonly value: FileRetentionValue | null\n  }\n  /** Legal hold status for this file version. */\n  readonly legalHold: {\n    /** Whether the caller is authorized to read legal hold status. */\n    readonly isClientAuthorizedToRead: boolean\n    /** Legal hold value, or null if the caller lacks read authorization. */\n    readonly value: LegalHoldValue | null\n  }\n  /** Replication status when this file is covered by a replication rule. */\n  readonly replicationStatus?: ReplicationStatus\n  /** Server-side encryption settings applied to this file version. */\n  readonly serverSideEncryption: PublicEncryptionSetting\n  /** UTC timestamp (milliseconds) when this version was uploaded. */\n  readonly uploadTimestamp: number\n}\n\n/** Request parameters for the `b2_list_file_names` API call. Lists the most recent version of each file in a bucket. */\nexport interface ListFileNamesRequest {\n  /** Bucket to list files from. */\n  readonly bucketId: BucketId\n  /** Return files starting after this name (exclusive). Used for pagination. */\n  readonly startFileName?: string\n  /** Maximum number of files to return (1 to 10000). */\n  readonly maxFileCount?: number\n  /** Only return files whose names start with this prefix. */\n  readonly prefix?: string\n  /** Delimiter for virtual folder grouping (typically `'/'`). */\n  readonly delimiter?: string\n}\n\n/** Response from the `b2_list_file_names` API call. */\nexport interface ListFileNamesResponse {\n  /** Array of file versions matching the request. */\n  readonly files: readonly FileVersion[]\n  /** Next file name to use for pagination, or null if all files have been listed. */\n  readonly nextFileName: string | null\n}\n\n/** Request parameters for the `b2_list_file_versions` API call. Lists all versions of files in a bucket. */\nexport interface ListFileVersionsRequest {\n  /** Bucket to list file versions from. */\n  readonly bucketId: BucketId\n  /** Return files starting after this name (exclusive). Used for pagination. */\n  readonly startFileName?: string\n  /** Return file versions starting after this ID. Used with startFileName for pagination. */\n  readonly startFileId?: FileId\n  /** Maximum number of file versions to return (1 to 10000). */\n  readonly maxFileCount?: number\n  /** Only return files whose names start with this prefix. */\n  readonly prefix?: string\n  /** Delimiter for virtual folder grouping (typically `'/'`). */\n  readonly delimiter?: string\n}\n\n/** Response from the `b2_list_file_versions` API call. */\nexport interface ListFileVersionsResponse {\n  /** Array of file versions matching the request. */\n  readonly files: readonly FileVersion[]\n  /** Next file name to use for pagination, or null if all versions have been listed. */\n  readonly nextFileName: string | null\n  /** Next file ID to use for pagination, or null if all versions have been listed. */\n  readonly nextFileId: FileId | null\n}\n\n/** Request parameters for the `b2_get_file_info` API call. */\nexport interface GetFileInfoRequest {\n  /** ID of the file version to retrieve info for. */\n  readonly fileId: FileId\n}\n\n/** Request parameters for the `b2_hide_file` API call. Hides a file so it no longer appears in `b2_list_file_names`. */\nexport interface HideFileRequest {\n  /** Bucket containing the file to hide. */\n  readonly bucketId: BucketId\n  /** Name of the file to hide. */\n  readonly fileName: string\n}\n\n/** Request parameters for the `b2_delete_file_version` API call. */\nexport interface DeleteFileVersionRequest {\n  /** Name of the file version to delete. */\n  readonly fileName: string\n  /** ID of the file version to delete. */\n  readonly fileId: FileId\n  /** If true, bypass governance-mode retention. Requires the `bypassGovernance` capability. */\n  readonly bypassGovernance?: boolean\n}\n\n/** Response from the `b2_delete_file_version` API call. */\nexport interface DeleteFileVersionResponse {\n  /** ID of the deleted file version. */\n  readonly fileId: FileId\n  /** Name of the deleted file. */\n  readonly fileName: string\n}\n\n/**\n * Named constants for how metadata is handled during a file copy.\n *\n * @example\n * ```ts\n * await bucket.copyFile({ ..., metadataDirective: MetadataDirective.Replace })\n * ```\n */\nexport const MetadataDirective = {\n  /** Preserve the source file's contentType and fileInfo. */\n  Copy: 'COPY',\n  /** Use the values provided in the copy request. */\n  Replace: 'REPLACE',\n} as const\n\n/** Controls how metadata is handled during a file copy. Derived from {@link MetadataDirective}. */\nexport type MetadataDirective = (typeof MetadataDirective)[keyof typeof MetadataDirective]\n\n/** Request parameters for the `b2_copy_file` API call. Performs a server-side file copy. */\nexport interface CopyFileRequest {\n  /** ID of the source file version to copy from. */\n  readonly sourceFileId: FileId\n  /** Destination bucket ID. Defaults to the source bucket if omitted. */\n  readonly destinationBucketId?: BucketId\n  /** Name for the destination file. */\n  readonly fileName: string\n  /** Byte range to copy (e.g., `'bytes=0-999'`). Omit to copy the entire file. */\n  readonly range?: string\n  /** Whether to copy or replace the source file's metadata. */\n  readonly metadataDirective?: MetadataDirective\n  /** MIME type for the destination file (only used when metadataDirective is `'REPLACE'`). */\n  readonly contentType?: string\n  /** User-defined metadata for the destination file (only used when metadataDirective is `'REPLACE'`). */\n  readonly fileInfo?: Record<string, string>\n  /** Object Lock retention for the destination file. */\n  readonly fileRetention?: FileRetentionValue\n  /** Legal hold for the destination file. */\n  readonly legalHold?: LegalHoldValue\n  /** SSE-C settings for reading the source file, if the source is encrypted with SSE-C. */\n  readonly sourceServerSideEncryption?: EncryptionSetting\n  /** Server-side encryption to apply to the destination file. */\n  readonly destinationServerSideEncryption?: EncryptionSetting\n}\n\n/** Request parameters for the `b2_copy_part` API call. Copies a byte range into a large file part. */\nexport interface CopyPartRequest {\n  /** ID of the source file version to copy from. */\n  readonly sourceFileId: FileId\n  /** ID of the large file being assembled. */\n  readonly largeFileId: FileId\n  /** Part number (1-based) for this part within the large file. */\n  readonly partNumber: number\n  /** Byte range to copy from the source (e.g., `'bytes=0-999'`). Omit to copy the entire source. */\n  readonly range?: string\n  /** SSE-C settings for reading the source file, if the source is encrypted with SSE-C. */\n  readonly sourceServerSideEncryption?: EncryptionSetting\n  /** Server-side encryption to apply to the destination part. */\n  readonly destinationServerSideEncryption?: EncryptionSetting\n}\n\n/** Response from the `b2_copy_part` API call. */\nexport interface CopyPartResponse {\n  /** ID of the large file this part belongs to. */\n  readonly fileId: FileId\n  /** Part number within the large file. */\n  readonly partNumber: number\n  /** Size of the copied part in bytes. */\n  readonly contentLength: number\n  /** SHA-1 checksum of the copied part content. */\n  readonly contentSha1: string\n  /** MD5 checksum of the copied part content, or null if not available. */\n  readonly contentMd5: string | null\n  /** Server-side encryption applied to this copied part. */\n  readonly serverSideEncryption: PublicEncryptionSetting\n  /** UTC timestamp (milliseconds) when this part was copied. */\n  readonly uploadTimestamp: number\n}\n"],"mappings":";;;;;;;;;AAYA,IAAa,aAAa;;CAExB,OAAO;;CAEP,QAAQ;;CAER,MAAM;;CAEN,QAAQ;;CAER,MAAM;AACR;;;;;;;;;AA6JA,IAAa,oBAAoB;;CAE/B,MAAM;;CAEN,SAAS;AACX"}
+{"version":3,"file":"file.cjs","names":[],"sources":["../../src/types/file.ts"],"sourcesContent":["import type { EncryptionSetting, PublicEncryptionSetting } from './encryption.ts'\nimport type { AccountId, BucketId, FileId } from './ids.ts'\nimport type { FileRetentionValue, LegalHoldValue } from './lock.ts'\n\n/**\n * Named constants for the action that created a file version.\n *\n * @example\n * ```ts\n * if (file.action === FileAction.Hide) { ... }\n * ```\n */\nexport const FileAction = {\n  /** Large file upload started but not yet finished. */\n  Start: 'start',\n  /** Normal upload (small or finished large file). */\n  Upload: 'upload',\n  /** Hide marker (soft delete). */\n  Hide: 'hide',\n  /** Virtual folder marker. */\n  Folder: 'folder',\n  /** Created via server-side copy. */\n  Copy: 'copy',\n} as const\n\n/** MIME type B2 returns for hide-marker rows in `b2_list_file_versions`. */\nexport const HIDE_MARKER_CONTENT_TYPE = 'application/x-bz-hide-marker' as const\n\n/**\n * The action that created a file version. Derived from {@link FileAction}.\n *\n * - `'start'`: large file upload started but not yet finished.\n * - `'upload'`: file was uploaded normally.\n * - `'hide'`: file was hidden (soft-deleted).\n * - `'folder'`: virtual folder marker.\n * - `'copy'`: file was created via server-side copy.\n */\nexport type FileAction = (typeof FileAction)[keyof typeof FileAction]\n\n/** File actions that represent concrete file versions with a B2 file ID. */\nexport type ConcreteFileAction = Exclude<FileAction, typeof FileAction.Folder>\n\n/** File actions that represent listed concrete versions with file metadata. */\nexport type ListedFileAction = Exclude<ConcreteFileAction, typeof FileAction.Hide>\n\n/**\n * Replication status for a file version or unfinished large file.\n *\n * B2 returns these uppercase wire values as-is and omits the containing\n * `replicationStatus` field when the file is not covered by a replication rule.\n */\nexport type ReplicationStatus = 'PENDING' | 'COMPLETED' | 'FAILED' | 'REPLICA'\n\n/**\n * Complete metadata for a concrete file version in B2. Returned by\n * `b2_get_file_info`, `b2_upload_file`, `b2_copy_file`, `b2_hide_file`, and\n * other file-related endpoints. List endpoints return\n * {@link ListedFileVersion} for file-name listings and\n * {@link ListedConcreteFileVersion} for file-version listings unless a\n * delimiter is requested, in which case file-name listings return\n * {@link FileNameListEntry} and file-version listings return\n * {@link FileVersionListEntry}.\n */\nexport interface FileVersion {\n  /** Account that owns this file. */\n  readonly accountId: AccountId\n  /** Action that created this file version. */\n  readonly action: ConcreteFileAction\n  /** Bucket containing this file. */\n  readonly bucketId: BucketId\n  /** Size of the file content in bytes. */\n  readonly contentLength: number\n  /** MD5 checksum of the content, or null if not available. */\n  readonly contentMd5: string | null\n  /** SHA-1 checksum of the content, or null if not available (e.g., large files). */\n  readonly contentSha1: string | null\n  /** MIME type of the file content. */\n  readonly contentType: string\n  /** Unique identifier for this file version. */\n  readonly fileId: FileId\n  /** User-defined key-value metadata stored with the file. */\n  readonly fileInfo: Record<string, string>\n  /** Full path and name of the file within the bucket. */\n  readonly fileName: string\n  /** Object Lock retention settings for this file version. */\n  readonly fileRetention: {\n    /** Whether the caller is authorized to read retention settings. */\n    readonly isClientAuthorizedToRead: boolean\n    /** Retention settings, or null if the caller lacks read authorization. */\n    readonly value: FileRetentionValue | null\n  }\n  /** Legal hold status for this file version. */\n  readonly legalHold: {\n    /** Whether the caller is authorized to read legal hold status. */\n    readonly isClientAuthorizedToRead: boolean\n    /** Legal hold value, or null if the caller lacks read authorization. */\n    readonly value: LegalHoldValue | null\n  }\n  /** Replication status when this file is covered by a replication rule. */\n  readonly replicationStatus?: ReplicationStatus\n  /** Server-side encryption settings applied to this file version. */\n  readonly serverSideEncryption: PublicEncryptionSetting\n  /** UTC timestamp (milliseconds) when this version was uploaded. */\n  readonly uploadTimestamp: number\n}\n\n/** Concrete non-hide file version as returned from list endpoints. */\nexport interface ListedFileVersion extends Omit<FileVersion, 'action'> {\n  /** Non-hide action with full file metadata. */\n  readonly action: ListedFileAction\n}\n\n/** Hide marker as returned from list endpoints when B2 omits metadata fields. */\nexport interface ListedHideFileVersion\n  extends Omit<\n    FileVersion,\n    'action' | 'contentType' | 'fileRetention' | 'legalHold' | 'serverSideEncryption'\n  > {\n  /** Hide marker (soft delete). */\n  readonly action: typeof FileAction.Hide\n  /** B2 list APIs return the documented hide-marker MIME type. */\n  readonly contentType: typeof HIDE_MARKER_CONTENT_TYPE\n}\n\n/** Virtual folder row returned by list endpoints when a delimiter groups file names. */\nexport interface FolderFileVersion {\n  /** Account that owns this bucket. */\n  readonly accountId: AccountId\n  /** Virtual folder marker. */\n  readonly action: typeof FileAction.Folder\n  /** Bucket containing the grouped files. */\n  readonly bucketId: BucketId\n  /** Always 0 for virtual folder rows. */\n  readonly contentLength: 0\n  /** Always null for virtual folder rows. */\n  readonly contentMd5: null\n  /** Always null for virtual folder rows. */\n  readonly contentSha1: null\n  /** Always null for virtual folder rows. */\n  readonly contentType: null\n  /** Always null for virtual folder rows. */\n  readonly fileId: null\n  /** Virtual folder rows do not carry file metadata. */\n  readonly fileInfo: Record<string, string>\n  /** Folder name, including the delimiter suffix. */\n  readonly fileName: string\n  /** Always 0 for virtual folder rows. */\n  readonly uploadTimestamp: 0\n}\n\n/** Concrete file-version entry returned by list endpoints. */\nexport type ListedConcreteFileVersion = ListedFileVersion | ListedHideFileVersion\n\n/** Entry returned by `b2_list_file_names` when a delimiter groups file names. */\nexport type FileNameListEntry = ListedFileVersion | FolderFileVersion\n\n/** Entry returned by `b2_list_file_names` and `b2_list_file_versions`. */\nexport type FileVersionListEntry = ListedConcreteFileVersion | FolderFileVersion\n\n/**\n * Request parameters shared by `b2_list_file_names` calls.\n */\nexport interface ListFileNamesBaseRequest {\n  /** Bucket to list files from. */\n  readonly bucketId: BucketId\n  /** Return files starting after this name (exclusive). Used for pagination. */\n  readonly startFileName?: string\n  /** Maximum number of files to return (1 to 10000). */\n  readonly maxFileCount?: number\n  /** Only return files whose names start with this prefix. */\n  readonly prefix?: string\n}\n\n/**\n * Request parameters for the non-delimiter `b2_list_file_names` API call.\n * Lists visible latest file versions in a bucket without hide markers or\n * virtual folder rows. Use {@link ListFileNamesWithDelimiterRequest} when\n * sending a `delimiter`.\n */\nexport interface ListFileNamesRequest extends ListFileNamesBaseRequest {\n  /** Omit delimiter to receive only visible concrete file-version entries. */\n  readonly delimiter?: undefined\n}\n\n/** Request parameters for delimiter-grouped `b2_list_file_names` calls. */\nexport interface ListFileNamesWithDelimiterRequest extends ListFileNamesBaseRequest {\n  /** Delimiter for virtual folder grouping (typically `'/'`). */\n  readonly delimiter: string\n}\n\n/** Request parameters for callers that dynamically include a delimiter. */\nexport interface ListFileNamesMaybeDelimiterRequest extends ListFileNamesBaseRequest {\n  /** Optional delimiter for virtual folder grouping. */\n  readonly delimiter?: string | undefined\n}\n\n/** Response from non-delimiter `b2_list_file_names` calls. */\nexport interface ListFileNamesResponse {\n  /** Array of visible concrete file-version entries matching the request. */\n  readonly files: readonly ListedFileVersion[]\n  /** Next file name to use for pagination, or null if all files have been listed. */\n  readonly nextFileName: string | null\n}\n\n/** Response from delimiter-grouped `b2_list_file_names` calls. */\nexport interface ListFileNamesWithDelimiterResponse {\n  /** Array of visible concrete file-version or virtual-folder entries. */\n  readonly files: readonly FileNameListEntry[]\n  /** Next file name to use for pagination, or null if all files have been listed. */\n  readonly nextFileName: string | null\n}\n\n/**\n * Request parameters shared by `b2_list_file_versions` calls.\n */\nexport interface ListFileVersionsBaseRequest {\n  /** Bucket to list file versions from. */\n  readonly bucketId: BucketId\n  /** Return files starting after this name (exclusive). Used for pagination. */\n  readonly startFileName?: string\n  /** Return file versions starting after this ID. Used with startFileName for pagination. */\n  readonly startFileId?: FileId\n  /** Maximum number of file versions to return (1 to 10000). */\n  readonly maxFileCount?: number\n  /** Only return files whose names start with this prefix. */\n  readonly prefix?: string\n}\n\n/**\n * Request parameters for the non-delimiter `b2_list_file_versions` API call.\n * Lists all versions of files in a bucket without virtual folder rows. Use\n * {@link ListFileVersionsWithDelimiterRequest} when sending a `delimiter`.\n */\nexport interface ListFileVersionsRequest extends ListFileVersionsBaseRequest {\n  /** Omit delimiter to receive only concrete file-version entries. */\n  readonly delimiter?: undefined\n}\n\n/** Request parameters for delimiter-grouped `b2_list_file_versions` calls. */\nexport interface ListFileVersionsWithDelimiterRequest extends ListFileVersionsBaseRequest {\n  /** Delimiter for virtual folder grouping (typically `'/'`). */\n  readonly delimiter: string\n}\n\n/** Request parameters for callers that dynamically include a delimiter. */\nexport interface ListFileVersionsMaybeDelimiterRequest extends ListFileVersionsBaseRequest {\n  /** Optional delimiter for virtual folder grouping. */\n  readonly delimiter?: string | undefined\n}\n\n/** Response from non-delimiter `b2_list_file_versions` calls. */\nexport interface ListFileVersionsResponse {\n  /** Array of concrete file-version entries matching the request. */\n  readonly files: readonly ListedConcreteFileVersion[]\n  /** Next file name to use for pagination, or null if all versions have been listed. */\n  readonly nextFileName: string | null\n  /** Next file ID to use for pagination, or null if all versions have been listed. */\n  readonly nextFileId: FileId | null\n}\n\n/** Response from delimiter-grouped `b2_list_file_versions` calls. */\nexport interface ListFileVersionsWithDelimiterResponse {\n  /** Array of concrete file-version or virtual-folder entries matching the request. */\n  readonly files: readonly FileVersionListEntry[]\n  /** Next file name to use for pagination, or null if all versions have been listed. */\n  readonly nextFileName: string | null\n  /** Next file ID to use for pagination, or null if all versions have been listed. */\n  readonly nextFileId: FileId | null\n}\n\n/** Request parameters for the `b2_get_file_info` API call. */\nexport interface GetFileInfoRequest {\n  /** ID of the file version to retrieve info for. */\n  readonly fileId: FileId\n}\n\n/** Request parameters for the `b2_hide_file` API call. Hides a file so it no longer appears in `b2_list_file_names`. */\nexport interface HideFileRequest {\n  /** Bucket containing the file to hide. */\n  readonly bucketId: BucketId\n  /** Name of the file to hide. */\n  readonly fileName: string\n}\n\n/** Request parameters for the `b2_delete_file_version` API call. */\nexport interface DeleteFileVersionRequest {\n  /** Name of the file version to delete. */\n  readonly fileName: string\n  /** ID of the file version to delete. */\n  readonly fileId: FileId\n  /** If true, bypass governance-mode retention. Requires the `bypassGovernance` capability. */\n  readonly bypassGovernance?: boolean\n}\n\n/** Response from the `b2_delete_file_version` API call. */\nexport interface DeleteFileVersionResponse {\n  /** ID of the deleted file version. */\n  readonly fileId: FileId\n  /** Name of the deleted file. */\n  readonly fileName: string\n}\n\n/**\n * Named constants for how metadata is handled during a file copy.\n *\n * @example\n * ```ts\n * await bucket.copyFile({ ..., metadataDirective: MetadataDirective.Replace })\n * ```\n */\nexport const MetadataDirective = {\n  /** Preserve the source file's contentType and fileInfo. */\n  Copy: 'COPY',\n  /** Use the values provided in the copy request. */\n  Replace: 'REPLACE',\n} as const\n\n/** Controls how metadata is handled during a file copy. Derived from {@link MetadataDirective}. */\nexport type MetadataDirective = (typeof MetadataDirective)[keyof typeof MetadataDirective]\n\n/** Request parameters for the `b2_copy_file` API call. Performs a server-side file copy. */\nexport interface CopyFileRequest {\n  /** ID of the source file version to copy from. */\n  readonly sourceFileId: FileId\n  /** Destination bucket ID. Defaults to the source bucket if omitted. */\n  readonly destinationBucketId?: BucketId\n  /** Name for the destination file. */\n  readonly fileName: string\n  /** Byte range to copy (e.g., `'bytes=0-999'`). Omit to copy the entire file. */\n  readonly range?: string\n  /** Whether to copy or replace the source file's metadata. */\n  readonly metadataDirective?: MetadataDirective\n  /** MIME type for the destination file (only used when metadataDirective is `'REPLACE'`). */\n  readonly contentType?: string\n  /** User-defined metadata for the destination file (only used when metadataDirective is `'REPLACE'`). */\n  readonly fileInfo?: Record<string, string>\n  /** Object Lock retention for the destination file. */\n  readonly fileRetention?: FileRetentionValue\n  /** Legal hold for the destination file. */\n  readonly legalHold?: LegalHoldValue\n  /** SSE-C settings for reading the source file, if the source is encrypted with SSE-C. */\n  readonly sourceServerSideEncryption?: EncryptionSetting\n  /** Server-side encryption to apply to the destination file. */\n  readonly destinationServerSideEncryption?: EncryptionSetting\n}\n\n/** Request parameters for the `b2_copy_part` API call. Copies a byte range into a large file part. */\nexport interface CopyPartRequest {\n  /** ID of the source file version to copy from. */\n  readonly sourceFileId: FileId\n  /** ID of the large file being assembled. */\n  readonly largeFileId: FileId\n  /** Part number (1-based) for this part within the large file. */\n  readonly partNumber: number\n  /** Byte range to copy from the source (e.g., `'bytes=0-999'`). Omit to copy the entire source. */\n  readonly range?: string\n  /** SSE-C settings for reading the source file, if the source is encrypted with SSE-C. */\n  readonly sourceServerSideEncryption?: EncryptionSetting\n  /** Server-side encryption to apply to the destination part. */\n  readonly destinationServerSideEncryption?: EncryptionSetting\n}\n\n/** Response from the `b2_copy_part` API call. */\nexport interface CopyPartResponse {\n  /** ID of the large file this part belongs to. */\n  readonly fileId: FileId\n  /** Part number within the large file. */\n  readonly partNumber: number\n  /** Size of the copied part in bytes. */\n  readonly contentLength: number\n  /** SHA-1 checksum of the copied part content. */\n  readonly contentSha1: string\n  /** MD5 checksum of the copied part content, or null if not available. */\n  readonly contentMd5: string | null\n  /** Server-side encryption applied to this copied part. */\n  readonly serverSideEncryption: PublicEncryptionSetting\n  /** UTC timestamp (milliseconds) when this part was copied. */\n  readonly uploadTimestamp: number\n}\n"],"mappings":";;;;;;;;;AAYA,IAAa,aAAa;;CAExB,OAAO;;CAEP,QAAQ;;CAER,MAAM;;CAEN,QAAQ;;CAER,MAAM;AACR;;AAGA,IAAa,2BAA2B;;;;;;;;;AA4RxC,IAAa,oBAAoB;;CAE/B,MAAM;;CAEN,SAAS;AACX"}