# encrypt

> **encrypt**(`options`): `ReadableWritablePair`\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array)\<`ArrayBufferLike`\>, [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array)\<`ArrayBufferLike`\>\>

Defined in: [packages/filecoin-encryption-envelope/src/aes-gcm-stream.ts:72](https://github.com/FilOzone/synapse-sdk/blob/e853a1d93da8c983371ffce4424cdb8996cc06ff/packages/filecoin-encryption-envelope/src/aes-gcm-stream.ts#L72)

Encrypt a plaintext stream using scheme 2 (chunked AES-256-GCM STREAM) and
a direct CEK.

Returns a `{ writable, readable }` pair for
`source.pipeThrough(encrypt(options))`. Plaintext goes in; the FEE envelope
followed by one encrypted chunk at a time comes out.

- Invalid options throw synchronously. Key work happens on the first read:
  importing the CEK and, with `recipients`, wrapping it. With recipients the
  `contentLength` total-size check also waits for that read (the envelope
  size isn't known before), but still fails before any output.
- Every buffer in `options` (the CEK, recipient KEKs and kids, metadata) is
  borrowed and read as late as the first read: don't change or clear it
  until `readable` closes or errors. Input blocks may be reused once their
  `write()` resolves.
- The base nonce is always generated internally.
- The final chunk is emitted only after `writable` closes.
- If the stream errors, any output already read is incomplete and must be discarded.

## Parameters

| Parameter | Type |
| ------ | ------ |
| `options` | [`ChunkedEncryptOptions`](/reference/filoz/filecoin-encryption-envelope/interfaces/chunkedencryptoptions/) |

## Returns

`ReadableWritablePair`\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array)\<`ArrayBufferLike`\>, [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array)\<`ArrayBufferLike`\>\>