@beignet/core/dist/encryption/index.d.ts

Core framework primitives for Beignet

import "../server-only.js";
/** Non-secret, authenticated metadata. Supply the same expected context on reads. */
export type EncryptionContext = Readonly<Record<string, string>>;
/** Options shared by string encryption and decryption. */
export interface EncryptionValueOptions {
    /** Plaintext for encrypt; the complete encrypted value for decrypt. */
    value: string;
    /** Bind the value to its purpose, tenant, or record. This is not authorization. */
    context?: EncryptionContext;
}
/** Server-side authenticated string encryption. */
export interface EncryptionPort {
    /** Encrypt a string; persist the complete returned value. */
    encrypt(options: EncryptionValueOptions): Promise<string>;
    /** Authenticate and decrypt a value with the same expected context. */
    decrypt(options: EncryptionValueOptions): Promise<string>;
}
/** Configuration for the built-in AES-256-GCM implementation. */
export interface CreateEncryptionOptions {
    /** A base64: prefixed, canonical Base64 encoding of 32 random bytes. */
    key: string;
    /** Decryption-only keys in the same format. New writes always use key. */
    previousKeys?: readonly string[];
}
/** Malformed, unauthenticated, or undecryptable ciphertext. Contains no input. */
export declare class EncryptionDecryptionError extends Error {
    /** Stable error name, independent of the decryption failure's cause. */
    readonly name = "EncryptionDecryptionError";
    constructor();
}
/** Generate a new 256-bit key. Store it in a server secret store; never log it. */
export declare function generateEncryptionKey(): string;
/**
 * Create authenticated string encryption using Web Crypto AES-256-GCM.
 * Configuration is validated synchronously. Each write uses a random 96-bit IV
 * and a 128-bit authentication tag. Previous keys are used only for reads.
 * No environment variables are read and no plaintext, keys, or context are logged.
 */
export declare function createEncryption(options: CreateEncryptionOptions): EncryptionPort;
//# sourceMappingURL=index.d.ts.map