

const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.js');
const require_jwa = require('../jwk/jwa.js');
const require_zod = require('../../../utils/zod.js');
const require_octJwk = require('../jwk/kty/oct/octJwk.js');
const require_common = require('./common.js');
const require_KmsKeyAgreementEncryptOptions = require('./KmsKeyAgreementEncryptOptions.js');
let zod = require("zod");
zod = require_rolldown_runtime.__toESM(zod);

//#region src/modules/kms/options/KmsEncryptOptions.ts
const zKmsEncryptDataEncryptionAesGcm = zod.z.object({
	algorithm: zod.z.enum([
		require_jwa.KnownJwaContentEncryptionAlgorithms.A128GCM,
		require_jwa.KnownJwaContentEncryptionAlgorithms.A192GCM,
		require_jwa.KnownJwaContentEncryptionAlgorithms.A256GCM
	]),
	iv: zod.z.optional(require_zod.zAnyUint8Array.refine((iv) => iv.length === 12, "iv must be 12 bytes for AES GCM")),
	aad: zod.z.optional(require_zod.zAnyUint8Array)
});
const zKmsEncryptDataEncryptionAesCbc = zod.z.object({
	algorithm: zod.z.enum([require_jwa.KnownJwaContentEncryptionAlgorithms.A128CBC, require_jwa.KnownJwaContentEncryptionAlgorithms.A256CBC]),
	iv: zod.z.optional(require_zod.zAnyUint8Array.refine((iv) => iv.length === 16, "iv must be 16 bytes for AES CBC"))
});
const zKmsEncryptDataEncryptionAesCbcHmac = zod.z.object({
	algorithm: zod.z.enum([
		require_jwa.KnownJwaContentEncryptionAlgorithms.A128CBC_HS256,
		require_jwa.KnownJwaContentEncryptionAlgorithms.A192CBC_HS384,
		require_jwa.KnownJwaContentEncryptionAlgorithms.A256CBC_HS512
	]),
	iv: zod.z.optional(require_zod.zAnyUint8Array.refine((iv) => iv.length === 16, "iv must be 16 bytes for AES CBC with HMAC")),
	aad: zod.z.optional(require_zod.zAnyUint8Array)
});
const zKmsDecryptDataEncryptionSalsa = zod.z.object({
	algorithm: zod.z.enum([require_jwa.KnownJwaContentEncryptionAlgorithms["XSALSA20-POLY1305"]]),
	iv: require_zod.zAnyUint8Array.optional()
});
const zKmsEncryptDataEncryptionC20p = zod.z.object({
	algorithm: zod.z.enum([require_jwa.KnownJwaContentEncryptionAlgorithms.C20P, require_jwa.KnownJwaContentEncryptionAlgorithms.XC20P]),
	iv: zod.z.optional(require_zod.zAnyUint8Array),
	aad: zod.z.optional(require_zod.zAnyUint8Array)
});
const zKmsEncryptDataEncryption = zod.z.discriminatedUnion("algorithm", [
	zKmsEncryptDataEncryptionAesCbc,
	zKmsEncryptDataEncryptionAesCbcHmac,
	zKmsEncryptDataEncryptionAesGcm,
	zKmsEncryptDataEncryptionC20p,
	zKmsDecryptDataEncryptionSalsa
]);
const zKmsEncryptOptions = zod.z.object({
	key: zod.z.union([
		zod.z.object({
			keyId: require_common.zKmsKeyId,
			privateJwk: zod.z.never().optional(),
			keyAgreement: zod.z.never().optional()
		}),
		zod.z.object({
			privateJwk: require_octJwk.zKmsJwkPrivateOct.describe("A private oct (symmetric) jwk"),
			keyId: zod.z.never().optional(),
			keyAgreement: zod.z.never().optional()
		}),
		zod.z.object({
			keyAgreement: require_KmsKeyAgreementEncryptOptions.zKmsKeyAgreementEncryptOptions,
			keyId: zod.z.never().optional(),
			privateJwk: zod.z.never().optional()
		})
	]),
	encryption: zKmsEncryptDataEncryption.describe("Options related to the encryption algorithm to use for encrypting the data"),
	data: require_zod.zAnyUint8Array.describe("The data to encrypt")
});
const zKmsEncryptedKey = zod.z.object({
	tag: require_zod.zAnyUint8Array.optional(),
	iv: require_zod.zAnyUint8Array.optional(),
	encrypted: require_zod.zAnyUint8Array
});

//#endregion
exports.zKmsEncryptOptions = zKmsEncryptOptions;
exports.zKmsEncryptedKey = zKmsEncryptedKey;