identity and trustpackages/iam/vault
vault package
Application-layer envelope encryption for customer secrets — AES-256-GCM, per-tenant DEK, KMS-wrapped. Audit-logged read/decrypt, zero plaintext at rest.
- Stability
- Stable
- Scope
- Tenant-scoped
- Boundary
- packages/iam/vault
secrets12 secrets · 3 tenants
rotation policyOpenAI API Key
sk-•••••••••••8847acme-prodkms/9f2arotated 3 days ago
Stripe Webhook Secret
whsec_•••••••••••1c4dacme-prodkms/9f2arotated 12 days ago
Database Password
pg://•••••••••••a31flumen-devkms/4b7erotated 27 days ago
PlaintextDEKKEK (KMS)
AES-256-GCM · per-tenant DEK · KMS-wrapped
Usagevault.ts
typescriptvault.ts
1import { getVault } from "@nebutra/vault";
2
3const vault = await getVault();
4
5// Envelope encryption — AWS KMS unwraps the DEK per-record.
6const encrypted = await vault.encrypt(secretKey, {
7 tenantId: org.id,
8 name: "OpenAI API Key",
9});
10
11const plaintext = await vault.decrypt(encrypted);