const require_chunk = require('./chunk-CUT6urMc.cjs');
const node_crypto = require_chunk.__toESM(require("node:crypto"));

//#region src/secrets/encryption.ts
/** AES-256-GCM configuration */
const ALGORITHM = "aes-256-gcm";
const KEY_LENGTH = 32;
const IV_LENGTH = 12;
/**
* Encrypt secrets for embedding in a bundle.
* Uses AES-256-GCM with a randomly generated ephemeral key.
*
* @param secrets - Key-value pairs to encrypt
* @returns Encrypted payload with ephemeral master key
*/
function encryptSecrets(secrets) {
	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
	const plaintext = JSON.stringify(secrets);
	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
	const authTag = cipher.getAuthTag();
	const combined = Buffer.concat([ciphertext, authTag]);
	return {
		encrypted: combined.toString("base64"),
		iv: iv.toString("hex"),
		masterKey: masterKey.toString("hex")
	};
}
/**
* Generate the define options for tsdown/esbuild.
* These will be injected at build time.
*/
function generateDefineOptions(payload) {
	return {
		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
	};
}

//#endregion
Object.defineProperty(exports, 'encryptSecrets', {
  enumerable: true,
  get: function () {
    return encryptSecrets;
  }
});
Object.defineProperty(exports, 'generateDefineOptions', {
  enumerable: true,
  get: function () {
    return generateDefineOptions;
  }
});
//# sourceMappingURL=encryption-BE0UOb8j.cjs.map