import { __name } from './chunk-IBAHCH6O.js';
import crypto from 'crypto';

var ENCRYPTED_PREFIX = "varlock:v1:";
var IV_LENGTH = 12;
var AUTH_TAG_LENGTH = 16;
var KEY_LENGTH_HEX = 64;
function isEncryptedBlob(value) {
  return value.startsWith(ENCRYPTED_PREFIX);
}
__name(isEncryptedBlob, "isEncryptedBlob");
function validateHexKey(hexKey) {
  if (hexKey.length !== KEY_LENGTH_HEX || !/^[0-9a-f]+$/i.test(hexKey)) {
    throw new Error(`[varlock] _VARLOCK_ENV_KEY must be a ${KEY_LENGTH_HEX}-character hex string (256 bits)`);
  }
}
__name(validateHexKey, "validateHexKey");
function hexToBytes(hex) {
  const bytes = new Uint8Array(hex.length / 2);
  for (let i = 0; i < bytes.length; i++) {
    bytes[i] = parseInt(hex.substring(i * 2, i * 2 + 2), 16);
  }
  return bytes;
}
__name(hexToBytes, "hexToBytes");
function encryptEnvBlobSync(json, hexKey) {
  validateHexKey(hexKey);
  const keyBytes = hexToBytes(hexKey);
  const iv = crypto.randomBytes(IV_LENGTH);
  const cipher = crypto.createCipheriv("aes-256-gcm", keyBytes, iv);
  const encrypted = Buffer.concat([cipher.update(json, "utf8"), cipher.final()]);
  const authTag = cipher.getAuthTag();
  const combined = Buffer.concat([iv, encrypted, authTag]);
  return ENCRYPTED_PREFIX + combined.toString("base64");
}
__name(encryptEnvBlobSync, "encryptEnvBlobSync");
function decryptEnvBlobSync(encrypted, hexKey) {
  validateHexKey(hexKey);
  if (!isEncryptedBlob(encrypted)) {
    throw new Error("[varlock] expected encrypted blob with varlock:v1: prefix");
  }
  const combined = Buffer.from(encrypted.slice(ENCRYPTED_PREFIX.length), "base64");
  const iv = combined.subarray(0, IV_LENGTH);
  const authTag = combined.subarray(combined.length - AUTH_TAG_LENGTH);
  const ciphertext = combined.subarray(IV_LENGTH, combined.length - AUTH_TAG_LENGTH);
  const decipher = crypto.createDecipheriv("aes-256-gcm", hexToBytes(hexKey), iv);
  decipher.setAuthTag(authTag);
  return decipher.update(ciphertext, void 0, "utf8") + decipher.final("utf8");
}
__name(decryptEnvBlobSync, "decryptEnvBlobSync");
async function decryptEnvBlobAsync(encrypted, hexKey) {
  validateHexKey(hexKey);
  if (!isEncryptedBlob(encrypted)) {
    throw new Error("[varlock] expected encrypted blob with varlock:v1: prefix");
  }
  const raw = atob(encrypted.slice(ENCRYPTED_PREFIX.length));
  const combined = new Uint8Array(raw.length);
  for (let i = 0; i < raw.length; i++) combined[i] = raw.charCodeAt(i);
  const iv = combined.slice(0, IV_LENGTH);
  const ciphertextWithTag = combined.slice(IV_LENGTH);
  const keyBytes = hexToBytes(hexKey);
  const key = await globalThis.crypto.subtle.importKey(
    "raw",
    keyBytes.buffer,
    { name: "AES-GCM" },
    false,
    ["decrypt"]
  );
  const decrypted = await globalThis.crypto.subtle.decrypt(
    { name: "AES-GCM", iv },
    key,
    ciphertextWithTag
  );
  return new TextDecoder().decode(decrypted);
}
__name(decryptEnvBlobAsync, "decryptEnvBlobAsync");
function generateEncryptionKeyHex() {
  return crypto.randomBytes(32).toString("hex");
}
__name(generateEncryptionKeyHex, "generateEncryptionKeyHex");

export { decryptEnvBlobAsync, decryptEnvBlobSync, encryptEnvBlobSync, generateEncryptionKeyHex, isEncryptedBlob };
//# sourceMappingURL=chunk-IQ226IPZ.js.map
//# sourceMappingURL=chunk-IQ226IPZ.js.map