Function encrypt

packages/security/src/encryption.ts:11–29

(
  plaintext: string,
  key: Buffer
)

 * @param key - 32-byte encryption key
 */
export async function encrypt(
  plaintext: string,
  key: Buffer
): Promise<{ encrypted: string; iv: string }> {
  assertKey(key)

  const iv = randomBytes(16)
  const cipher = createCipheriv('aes-256-gcm', key, iv, { authTagLength: 16 })
  let encrypted = cipher.update(plaintext, 'utf8', 'hex')
  encrypted += cipher.final('hex')

  const authTag = cipher.getAuthTag()
  const ivHex = iv.toString('hex')

  return {
    encrypted: `${ivHex}:${encrypted}:${authTag.toString('hex')}`,
    iv: ivHex,
  }
}

/**
 * AES-256-GCM decryption primitive. Expects input produced by {@link encrypt}