MasterKeyRingEntry

MasterKeyRingEntry = object

Defined in: src/persistence/PersistenceOptions.ts:62

One entry in a versioned master-key ring used by client-side AES-256-GCM (#8 — master-key rotation). Versions are 0..255 — a single byte of version travels in the body’s manifest so decrypt can pick the matching master at read time.

Why versions? Rotation is a fact of life — the operator wants to retire an old key without re-encrypting every blob in the bucket at once. The keyring lets a deployment carry the new key (active) plus every old key (retired) it might still need to decrypt; new writes use active, reads dispatch on the version byte the manifest carries. Once every blob has been re-encrypted at the new version (e.g. via a re-encryption sweep), the corresponding retired entry can be dropped.

Properties

key

readonly key: Uint8Array

Defined in: src/persistence/PersistenceOptions.ts:66

32 bytes (AES-256).

---

version

readonly version: number

Defined in: src/persistence/PersistenceOptions.ts:64

0..255 — embedded in the body manifest by BodyCodec.