Rulvar API reference / @rulvar/core / EnvelopeEncryptionOptions
Interface: EnvelopeEncryptionOptions
Defined in: packages/core/src/l0/encryption.ts:240
Properties
| Property | Type | Description | Defined in |
|---|---|---|---|
historicalWrappedKeys? | readonly Bytes[] | Wrapped data keys from earlier sessions or rotations that this process must still read. Unwrapped once at creation; an envelope carrying an UNREGISTERED wrapped key fails typed at read, naming this list. | packages/core/src/l0/encryption.ts:248 |
plaintextReads? | "reject" | "passthrough" | What a NON-enveloped stored entry or blob means at read: 'reject' (default, fail closed) or 'passthrough' (explicit migration mode for stores with pre-encryption history). | packages/core/src/l0/encryption.ts:254 |
provider | DataKeyProvider | - | packages/core/src/l0/encryption.ts:241 |