Class SecretBox

Seals a run's meeting url at rest under the current 32-byte key, with the library's AES-256-GCM sealing (sealSecret, openSecret). Previous keys open older texts. Every seal uses a fresh nonce and the stored form remains v1.box.<base64url(nonce | ciphertext | tag)>. The run's id is bound as context, so moving a text to another row fails.

Constructors

constructor

Methods

toJSON [custom] seal open

Constructors

constructor

  • new SecretBox(key, options?): SecretBox

  • Parameters

    • key: Buffer<ArrayBufferLike>

      The current 32-byte key, copied so later buffer changes cannot change the box.

    • options: {
          previousKeys?: readonly Buffer<ArrayBufferLike>[];
      } = {}

      Previous 32-byte keys, copied and tried in order on open; never used to seal new text.

      • Optional previousKeys?: readonly Buffer<ArrayBufferLike>[]

    Returns SecretBox

    Throws

    RangeError when any key is not 32 bytes.

Methods

toJSON

[custom]

  • [custom](): string

  • What util.inspect, and so console.log and loggers built on it, print: the same redacted marker, never key bytes.

    Returns string

seal

  • seal(plain, context?): string

  • Seals with the current key and a fresh nonce.

    Parameters

    • plain: string

      The text to seal.

    • context: string = ''

      The run's id, bound as additional authenticated data; empty when absent.

    Returns string

open

  • open(sealed, context?): string

  • Opens with the current key, then each previous key in order.

    Parameters

    • sealed: string

      The sealed text, including an older v1.box text.

    • context: string = ''

      The context used to seal; empty when absent.

    Returns string

    Throws

    SealedSecretError when the format, key, context or authentication fails for every candidate.

Settings

Member Visibility

Theme

On This Page

constructortoJSON[custom]sealopen