copy: support server-side encryption settings

[goanpeca]

Summary

• Add source-sse for copy source SSE-C keys, mask raw key values before validation failures can reach logs, and forward source/destination SSE settings into copy requests.
• Handle copy encryption across small and large files, including SSE-B2 destination starts without invalid part encryption, SSE-C part encryption, preserved file info, and stopping queued copy parts after a part failure.
• Update action metadata, README, CHANGELOG, focused tests, generated dist output, and TypeDoc-visible SSE parser docs.

Closes #96

Tests

• pnpm lint
• pnpm docs:check-action-yml
• pnpm run docs
• pnpm typecheck
• pnpm test
• pnpm build
• pnpm exec vitest run __tests__/commands/delete-copy-presign.test.ts --reporter=dot
• pnpm exec vitest run __tests__/sse.test.ts --reporter=dot
• git diff --check
• pre-commit hook: biome lint, release provenance policy, tsc, vitest, ncc build, cspell
• pre-push hook: vitest --coverage

Follow-up notes

• Bucket default encryption remains out of scope, as tracked separately.

[github-actions]

Build artifact for this PR: build.tar.gz (valid 1 hour)

[Copilot]

Pull request overview

Adds support for server-side encryption configuration to the copy command by introducing a dedicated source-sse input for decrypting SSE-C sources and forwarding both source/destination encryption settings into the SDK copy APIs, with documentation and tests to ensure keys are masked in logs.

Changes:

• Extend SSE parsing to support an input-name override and to disallow SSE-B2 where appropriate (for source-sse).
• Parse and scrub source-sse, and forward sourceServerSideEncryption / destinationServerSideEncryption into small + large copy calls.
• Document the new copy SSE surface and add tests for forwarding + redaction.

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/sse.ts	Adds parsing options for input naming and disallowing SSE-B2 for source-sse.
src/inputs.ts	Adds source-sse parsing, secret scrubbing, and exposes parsed source encryption on ParsedInputs.
src/commands/copy.ts	Forwards parsed source/destination encryption settings into SDK copy calls.
README.md	Documents source-sse and clarifies sse semantics for copy.
action.yml	Adds source-sse input and updates sse description.
tests/sse.test.ts	Adds coverage for rejecting SSE-B2 when parsing source-sse.
tests/inputs.test.ts	Adds coverage for masking and parsing source-sse.
tests/commands/delete-copy-presign.test.ts	Adds coverage for SSE forwarding to small/large copy and ensures keys don’t appear in stdout.
tests/_parsed-inputs.ts	Updates parsed-inputs helper to include the new fields.
dist/index.js	Updates the bundled action output to reflect source changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Build artifact for this PR: build.tar.gz (valid 1 hour)

[github-actions]

Build artifact for this PR: build.tar.gz (valid 1 hour)

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated 1 comment.

[github-actions]

Build artifact for this PR: build.tar.gz (valid 1 hour)

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated 1 comment.

[github-actions]

Build artifact for this PR: build.tar.gz (valid 1 hour)

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated no new comments.

[github-actions]

Build artifact for this PR: build.tar.gz (valid 1 hour)

[github-actions]

Build artifact for this PR: build.tar.gz (valid 1 hour)

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated no new comments.

[github-actions]

Build artifact for this PR: build.tar.gz (valid 1 hour)

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated no new comments.