@credo-ts/core/build/modules/kms/options/KmsEncryptOptions.mjs

<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1

import { KnownJwaContentEncryptionAlgorithms, isJwaHpkeAlgorithm } from "../jwk/jwa.mjs";
import { zAnyUint8Array } from "../../../utils/zod.mjs";
import { zKmsJwkPrivateOct } from "../jwk/kty/oct/octJwk.mjs";
import { zKmsKeyId } from "./common.mjs";
import { zKmsKeyAgreementEncryptOptions } from "./KmsKeyAgreementEncryptOptions.mjs";
import { z as z$1 } from "zod";
//#region src/modules/kms/options/KmsEncryptOptions.ts
const zKmsEncryptDataEncryptionAesGcm = z$1.object({
	algorithm: z$1.enum([
		KnownJwaContentEncryptionAlgorithms.A128GCM,
		KnownJwaContentEncryptionAlgorithms.A192GCM,
		KnownJwaContentEncryptionAlgorithms.A256GCM
	]),
	iv: z$1.optional(zAnyUint8Array.refine((iv) => iv.length === 12, "iv must be 12 bytes for AES GCM")),
	aad: z$1.optional(zAnyUint8Array)
});
const zKmsEncryptDataEncryptionAesCbc = z$1.object({
	algorithm: z$1.enum([KnownJwaContentEncryptionAlgorithms.A128CBC, KnownJwaContentEncryptionAlgorithms.A256CBC]),
	iv: z$1.optional(zAnyUint8Array.refine((iv) => iv.length === 16, "iv must be 16 bytes for AES CBC"))
});
const zKmsEncryptDataEncryptionAesCbcHmac = z$1.object({
	algorithm: z$1.enum([
		KnownJwaContentEncryptionAlgorithms.A128CBC_HS256,
		KnownJwaContentEncryptionAlgorithms.A192CBC_HS384,
		KnownJwaContentEncryptionAlgorithms.A256CBC_HS512
	]),
	iv: z$1.optional(zAnyUint8Array.refine((iv) => iv.length === 16, "iv must be 16 bytes for AES CBC with HMAC")),
	aad: z$1.optional(zAnyUint8Array)
});
const zKmsDecryptDataEncryptionSalsa = z$1.object({
	algorithm: z$1.enum([KnownJwaContentEncryptionAlgorithms["XSALSA20-POLY1305"]]),
	iv: zAnyUint8Array.optional()
});
const zKmsEncryptDataEncryptionC20p = z$1.object({
	algorithm: z$1.enum([KnownJwaContentEncryptionAlgorithms.C20P, KnownJwaContentEncryptionAlgorithms.XC20P]),
	iv: z$1.optional(zAnyUint8Array),
	aad: z$1.optional(zAnyUint8Array)
});
/**
* Integrated-encryption HPKE. The HPKE suite (see the `HPKE-*` key agreement algorithms) fixes the
* AEAD, and both the content encryption key and the nonce are derived from the HPKE key schedule.
* The only content encryption parameter left to the caller is the aad.
*/
const zKmsEncryptDataEncryptionHpke = z$1.object({
	algorithm: z$1.literal("HPKE"),
	aad: z$1.optional(zAnyUint8Array)
});
const zKmsEncryptDataEncryption = z$1.discriminatedUnion("algorithm", [
	zKmsEncryptDataEncryptionAesCbc,
	zKmsEncryptDataEncryptionAesCbcHmac,
	zKmsEncryptDataEncryptionAesGcm,
	zKmsEncryptDataEncryptionC20p,
	zKmsDecryptDataEncryptionSalsa,
	zKmsEncryptDataEncryptionHpke
]);
const zKmsEncryptOptions = z$1.object({
	/**
	* The key to use for encrypting. There are three possible formats:
	* - a key id, pointing to a symmetric (oct) jwk that can be used directly for encryption
	* - a private symmetric (oct) jwk object that can be used directly for encryption
	* - an object configuring key agreement, based on an existing asymmetric key
	*/
	key: z$1.union([
		z$1.object({
			keyId: zKmsKeyId,
			privateJwk: z$1.never().optional(),
			keyAgreement: z$1.never().optional()
		}),
		z$1.object({
			privateJwk: zKmsJwkPrivateOct.describe("A private oct (symmetric) jwk"),
			keyId: z$1.never().optional(),
			keyAgreement: z$1.never().optional()
		}),
		z$1.object({
			keyAgreement: zKmsKeyAgreementEncryptOptions,
			keyId: z$1.never().optional(),
			privateJwk: z$1.never().optional()
		})
	]),
	/**
	* The encryption algorithm used to encrypt the data/content.
	* In JWE this parameter is referred to as "enc".
	*
	* Must be 'HPKE' for the integrated-encryption HPKE algorithms, where the suite fixes the AEAD
	* and only the aad is left to the caller.
	*/
	encryption: zKmsEncryptDataEncryption.describe("Options related to the encryption algorithm to use for encrypting the data"),
	/**
	* The data to encrypt
	*/
	data: zAnyUint8Array.describe("The data to encrypt")
}).check(({ value, issues }) => {
	const usesIntegratedEncryption = value.key.keyAgreement && isJwaHpkeAlgorithm(value.key.keyAgreement.algorithm);
	const usesHpkeContentEncryption = value.encryption.algorithm === "HPKE";
	if (usesIntegratedEncryption && !usesHpkeContentEncryption) issues.push({
		code: "custom",
		input: value.encryption,
		path: ["encryption", "algorithm"],
		message: `'encryption.algorithm' must be 'HPKE' for key agreement algorithm '${value.key.keyAgreement?.algorithm}', as the HPKE suite defines the content encryption algorithm`
	});
	else if (!usesIntegratedEncryption && usesHpkeContentEncryption) issues.push({
		code: "custom",
		input: value.encryption,
		path: ["encryption", "algorithm"],
		message: `'encryption.algorithm' 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`
	});
});
const zKmsEncryptedKey = z$1.object({
	/**
	* Optional authentication tag
	*/
	tag: zAnyUint8Array.optional(),
	/**
	* The initialization vector.
	*/
	iv: zAnyUint8Array.optional(),
	/**
	* The encrypted key
	*/
	encrypted: zAnyUint8Array
});
//#endregion
export { zKmsEncryptDataEncryption, zKmsEncryptOptions, zKmsEncryptedKey };

//# sourceMappingURL=KmsEncryptOptions.mjs.map