stable

env

Seals the managed-secret vault key with a base64-encoded AES-256-GCM key read from an environment variable.

@noy-db/at-env · pnpm add @noy-db/at-env Zero-infrastructure sealing — the key lives in NOYDB_SEALING_KEY (or a custom env var).

What it does

atEnv() reads a base64-encoded 32-byte AES-256-GCM key from an environment variable (default NOYDB_SEALING_KEY, override with { envVar }) and uses it to seal/unseal the hub-generated managed-mode secret. It validates the key at construction — throwing when the variable is unset, not valid base64, or not exactly 32 bytes — and caches the imported CryptoKey for the provider instance's lifetime. Sealed output is [12-byte IV][ciphertext + 16-byte GCM tag]. Its pid is env:<envVar> (e.g. env:NOYDB_SEALING_KEY), stored next to the sealed bytes as audit metadata.

The env var is the security boundary: anyone who can read your process's environment can decrypt every secret sealed under it. Fine for platform-managed secrets (Kubernetes Secrets, Heroku config, systemd env); avoid it on shared machines and multi-tenant hosts.

Usage

import { atEnv } from '@noy-db/at-env'

const sealingKey = atEnv() // reads NOYDB_SEALING_KEY by default
sealingKey.id // → 'env:NOYDB_SEALING_KEY'

export NOYDB_SEALING_KEY=$(openssl rand -base64 32)

env

What it does

Usage

See also