@turboenv/customer-crypto

The browser-and-Node WebCrypto protocol used by customer-managed turboEnv projects. It is an internal implementation package rather than a general purpose cryptography library.

Customer keys and plaintext stay in the calling process. The turboEnv API receives only wrapped project keys and authenticated ciphertext.

• generateCustomerKey() creates canonical tenv_key_v1_… keys.
• ProjectCipher.create() creates and wraps a project DEK.
• ProjectCipher.unlock() verifies a key and unwraps the DEK locally.
• encryptVariables() / decryptVariables() bind values to the project context, environment ID, version, key name and secrecy flag.
• rewrapCustomerEncryption() rotates the customer key without rewriting historical values.

CUSTOMER_CRYPTO_TEST_VECTOR is the deterministic AES-GCM wrapping vector for implementations in other runtimes.