Dowe

SERVER / CRYPTO

Transform protected byte streams

crypto is a Rust-owned server declaration for byte transforms. It names the transformed binding first, then makes the encryption mode and key material explicit.

Server documentation

MENTAL MODEL

Declare the output and encryption mode

The binding after crypto is available to later server statements. encryption selects the byte transform, while data, key, and iv preserve a clear data flow without exposing server secrets to views.

dowe
handler decryptSegment async req
  http upstream method:"get" base:env.MEDIA_BASE_URL path:"/segment.m4s" mode:"bytes"
  crypto encrypted encryption:"cencAesCtr" data:upstream key:env.MEDIA_KEY iv:env.MEDIA_IV
  return response bytes:encrypted contentType:"video/mp4"

BINDING

encrypted is the byte binding for a response or the next server-side transform.

AES-CTR

Use encryption:"aesCtr" for a complete AES-128-CTR byte buffer with a 16-byte key and IV.

SERVER ONLY

Keys and IVs resolve only inside the server runtime and never enter client artifacts or views.

CENC

Preserve clear ranges in encrypted samples

cencAesCtr supports an 8-byte or 16-byte IV and optional clear and encrypted subsamples. Clear bytes remain unchanged while encrypted ranges advance the AES-CTR stream.

dowe
crypto encrypted encryption:"cencAesCtr" data:upstream key:env.MEDIA_KEY iv:sampleIv subsamples:[{ clear:5 encrypted:1024 }, { clear:0 encrypted:2048 }]
return response bytes:encrypted contentType:"video/mp4"

Subsamples

Each entry declares a clear byte count and an encrypted byte count for the current sample.

Migration

Replace let encrypted = crypto.cencAesCtr with crypto encrypted encryption:"cencAesCtr". Legacy expression forms are rejected.