lib/crypto.ts

Purpose

AES‑256‑GCM encrypt/decrypt helpers for BYOK secrets.

Public Surface

• encryptAesGcm(plaintext: Buffer|string, aad?: Buffer): Buffer
• decryptAesGcm(blob: Buffer, aad?: Buffer): Buffer

Behavior & Invariants

• RUNFORGE_MASTER_KEY must be 32 bytes (base64 or 64‑hex). Throws otherwise.
• Output format: [12B IV][16B TAG][CIPHERTEXT...].

Security & Privacy

• Use distinct AAD per record when possible (e.g., orgId).
• Store only ciphertext in Postgres.

Example Usage

const enc = encryptAesGcm(Buffer.from('secret'), Buffer.from(orgId))
const dec = decryptAesGcm(enc, Buffer.from(orgId))