

import { KnownJwaContentEncryptionAlgorithms } from "../jwk/jwa.mjs";
import { zKmsJwkPrivateOct } from "../jwk/kty/oct/octJwk.mjs";
import { zKmsKeyId } from "./common.mjs";
import { zKmsKeyAgreementEncryptOptions } from "./KmsKeyAgreementEncryptOptions.mjs";
import { z } from "zod";

//#region src/modules/kms/options/KmsEncryptOptions.ts
const zKmsEncryptDataEncryptionAesGcm = z.object({
	algorithm: z.enum([
		KnownJwaContentEncryptionAlgorithms.A128GCM,
		KnownJwaContentEncryptionAlgorithms.A192GCM,
		KnownJwaContentEncryptionAlgorithms.A256GCM
	]),
	iv: z.optional(z.instanceof(Uint8Array).refine((iv) => iv.length === 12, "iv must be 12 bytes for AES GCM")),
	aad: z.optional(z.instanceof(Uint8Array))
});
const zKmsEncryptDataEncryptionAesCbc = z.object({
	algorithm: z.enum([KnownJwaContentEncryptionAlgorithms.A128CBC, KnownJwaContentEncryptionAlgorithms.A256CBC]),
	iv: z.optional(z.instanceof(Uint8Array).refine((iv) => iv.length === 16, "iv must be 16 bytes for AES CBC"))
});
const zKmsEncryptDataEncryptionAesCbcHmac = z.object({
	algorithm: z.enum([
		KnownJwaContentEncryptionAlgorithms.A128CBC_HS256,
		KnownJwaContentEncryptionAlgorithms.A192CBC_HS384,
		KnownJwaContentEncryptionAlgorithms.A256CBC_HS512
	]),
	iv: z.optional(z.instanceof(Uint8Array).refine((iv) => iv.length === 16, "iv must be 16 bytes for AES CBC with HMAC")),
	aad: z.optional(z.instanceof(Uint8Array))
});
const zKmsDecryptDataEncryptionSalsa = z.object({
	algorithm: z.enum([KnownJwaContentEncryptionAlgorithms["XSALSA20-POLY1305"]]),
	iv: z.instanceof(Uint8Array).optional()
});
const zKmsEncryptDataEncryptionC20p = z.object({
	algorithm: z.enum([KnownJwaContentEncryptionAlgorithms.C20P, KnownJwaContentEncryptionAlgorithms.XC20P]),
	iv: z.optional(z.instanceof(Uint8Array)),
	aad: z.optional(z.instanceof(Uint8Array))
});
const zKmsEncryptDataEncryption = z.discriminatedUnion("algorithm", [
	zKmsEncryptDataEncryptionAesCbc,
	zKmsEncryptDataEncryptionAesCbcHmac,
	zKmsEncryptDataEncryptionAesGcm,
	zKmsEncryptDataEncryptionC20p,
	zKmsDecryptDataEncryptionSalsa
]);
const zKmsEncryptOptions = z.object({
	key: z.union([
		z.object({
			keyId: zKmsKeyId,
			privateJwk: z.never().optional(),
			keyAgreement: z.never().optional()
		}),
		z.object({
			privateJwk: zKmsJwkPrivateOct.describe("A private oct (symmetric) jwk"),
			keyId: z.never().optional(),
			keyAgreement: z.never().optional()
		}),
		z.object({
			keyAgreement: zKmsKeyAgreementEncryptOptions,
			keyId: z.never().optional(),
			privateJwk: z.never().optional()
		})
	]),
	encryption: zKmsEncryptDataEncryption.describe("Options related to the encryption algorithm to use for encrypting the data"),
	data: z.instanceof(Uint8Array).describe("The data to encrypt")
});
const zKmsEncryptedKey = z.object({
	tag: z.instanceof(Uint8Array).optional(),
	iv: z.instanceof(Uint8Array).optional(),
	encrypted: z.instanceof(Uint8Array)
});

//#endregion
export { zKmsEncryptOptions, zKmsEncryptedKey };
//# sourceMappingURL=KmsEncryptOptions.mjs.map