# @filoz/filecoin-encryption-envelope

**Filecoin Encryption Envelope (FIP-1253) - Main Entry Point**

## Example

```ts
import * as fee from '@filoz/filecoin-encryption-envelope'

source.pipeThrough(fee.encrypt({ cek }))  // chunked stream, the default
encrypted.pipeThrough(fee.decrypt(cek))    // and back
await fee.decryptRange(object, cek, { offset: 1024, length: 4096 })  // one byte range
fee.aesGcm.encrypt(plaintext, { cek })     // whole-object, opt-in
fee.constants.ALG_A256KW
```

## Namespaces

| Namespace | Description |
| ------ | ------ |
| [aesGcm](/reference/filoz/filecoin-encryption-envelope/namespaces/aesgcm/toc/) | - |
| [constants](/reference/filoz/filecoin-encryption-envelope/namespaces/constants/toc/) | - |
| [cose](/reference/filoz/filecoin-encryption-envelope/namespaces/cose/toc/) | COSE decode-only inspection surface (FIP-1253): read an untrusted envelope into its typed protected header, unprotected header, and recipient list. See docs/tech-spec.md, "Wire profile" and "CDDL". |
| [errors](/reference/filoz/filecoin-encryption-envelope/namespaces/errors/toc/) | - |
| [recipients](/reference/filoz/filecoin-encryption-envelope/namespaces/recipients/toc/) | - |

## Interfaces

| Interface | Description |
| ------ | ------ |
| [ByteRange](/reference/filoz/filecoin-encryption-envelope/interfaces/byterange/) | A byte range over an object's plaintext, HTTP `Range`-header style. |
| [ChunkedEncryptOptions](/reference/filoz/filecoin-encryption-envelope/interfaces/chunkedencryptoptions/) | Options for one chunked AES-256-GCM STREAM encryption using a direct CEK. |
| [ChunkedEnvelopeParams](/reference/filoz/filecoin-encryption-envelope/interfaces/chunkedenvelopeparams/) | Cached values from one chunked envelope's protected header, for range decryption to reuse. |
| [RandomAccessSource](/reference/filoz/filecoin-encryption-envelope/interfaces/randomaccesssource/) | One immutable encoded FEE object, readable by byte range. |
| [RangeResult](/reference/filoz/filecoin-encryption-envelope/interfaces/rangeresult/) | - |

## Type Aliases

| Type Alias | Description |
| ------ | ------ |
| [AppMetadata](/reference/filoz/filecoin-encryption-envelope/type-aliases/appmetadata/) | Opaque, string-keyed application metadata. Carried but never interpreted. |
| [CborValue](/reference/filoz/filecoin-encryption-envelope/type-aliases/cborvalue/) | CBOR values supported by this profile. |
| [EnvelopeInfo](/reference/filoz/filecoin-encryption-envelope/type-aliases/envelopeinfo/) | Only the chunked scheme carries `params`: scheme 1 is decrypted as one complete object, never by range. |

## Functions

| Function | Description |
| ------ | ------ |
| [decrypt](/reference/filoz/filecoin-encryption-envelope/functions/decrypt/) | Decrypt a scheme-2 (chunked AES-256-GCM STREAM) object using a direct CEK. |
| [decryptRange](/reference/filoz/filecoin-encryption-envelope/functions/decryptrange/) | Decrypt one byte range of a chunked object using a direct CEK. |
| [decryptRangeWith](/reference/filoz/filecoin-encryption-envelope/functions/decryptrangewith/) | Like `decryptRange`, but recovers the CEK from the envelope's recipients through `unwrapper`. |
| [decryptWith](/reference/filoz/filecoin-encryption-envelope/functions/decryptwith/) | Decrypt a scheme-2 object using a CEK recovered by `unwrapper`. |
| [encrypt](/reference/filoz/filecoin-encryption-envelope/functions/encrypt/) | Creates a streaming encryptor using scheme 2 (chunked AES-256-GCM STREAM) with a direct CEK. |
| [parse](/reference/filoz/filecoin-encryption-envelope/functions/parse/) | Inspect an encoded FEE object without a key: scheme, content type, application metadata, and recipients. Unauthenticated -- see above. |