1import type { EncryptSecretKeyError } from "@distilled.cloud/fly-io/machines";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../Binding.ts";
4import type { RuntimeContext } from "../RuntimeContext.ts";
5import type { SecretKey } from "./SecretKey.ts";
6
7export interface EncryptRequest {
8 /** Bytes to encrypt. */
9 plaintext: Uint8Array | ArrayLike<number>;
10 /** Optional AEAD associated data. */
11 associatedData?: Uint8Array | ArrayLike<number>;
12}
13
14export interface EncryptResult {
15 ciphertext: Uint8Array;
16}
17
18/**
19 * Encrypt with a Fly {@link SecretKey} (`nacl_box`, `nacl_secretbox`,
20 * `xaes256gcm`, …). The App and key name are fixed by `Encrypt(key)`.
21 *
22 *
23 * ### Encrypt a payload
24 * Provide {@link EncryptHttp} on the Action or Service Effect. Fly
25 * crypto ops need a KMS token. Org API tokens are typed `Forbidden`.
26 *
27 * **Example:** Encrypt
28 * ```typescript
29 * const encrypt = yield* Fly.Encrypt(Box);
30 * const { ciphertext } = yield* encrypt({
31 * plaintext: new TextEncoder().encode("attack at dawn"),
32 * });
33 * ```
34 *
35 * ### Associated data
36 * `associatedData` is optional AEAD associated data. {@link Decrypt}
37 * must pass the same bytes.
38 *
39 * **Example:** AEAD
40 * ```typescript
41 * const { ciphertext } = yield* encrypt({
42 * plaintext: bytes,
43 * associatedData: nonce,
44 * });
45 * ```
46 *
47 * @binding
48 * @product Secret Key
49 */
50export interface Encrypt extends Binding.Service<
51 Encrypt,
52 "Fly.Encrypt",
53 (
54 key: SecretKey,
55 ) => Effect.Effect<
56 (
57 request: EncryptRequest,
58 ) => Effect.Effect<EncryptResult, EncryptSecretKeyError, RuntimeContext>
59 >
60> {}
61
62export const Encrypt = Binding.Service<Encrypt>("Fly.Encrypt");