# Encryptor v0.2.0 - Table of Contents

> Ergonomic envelope encryption for Elixir - vault module, pluggable key providers, per-tenant keys

## Pages

- [Encryptor](readme.md)
- [Changelog](changelog.md)

- Guides
  - [Getting started](getting-started.md)
  - [Rotation runbook](rotation-runbook.md)

## Modules

- [Encryptor](Encryptor.md): Ergonomic envelope encryption for Elixir - a vault module, pluggable key
providers, and per-tenant keys - on the
[aws_encryption_sdk](https://hex.pm/packages/aws_encryption_sdk) engine.
- [Encryptor.Context](Encryptor.Context.md): The encryption context: the canonical vocabulary, the four-layer
composition, and the bounds the engine does not check.
- [Encryptor.Envelope](Encryptor.Envelope.md): The level 1 to level 2 relationship: how a tenant master key comes into
existence, what protects it at rest, and how it gets back into memory.
- [Encryptor.Envelope.WrappedKey](Encryptor.Envelope.WrappedKey.md): One tenant master key, wrapped, plus the identity a store has to give back.
- [Encryptor.Kdf](Encryptor.Kdf.md): HKDF-SHA256 key derivation: the one place this package expands a key into a
labelled subkey.
- [Encryptor.Key](Encryptor.Key.md): The closed, package-owned set of key descriptors.
- [Encryptor.Key.Aes](Encryptor.Key.Aes.md): A raw AES wrapping key, named.
- [Encryptor.Key.Kms](Encryptor.Key.Kms.md): An AWS KMS key, referenced by id.
- [Encryptor.Message](Encryptor.Message.md): The one place this package reads the engine's message format.
- [Encryptor.Message.Info](Encryptor.Message.Info.md): What a message says about itself.
- [Encryptor.Provider](Encryptor.Provider.md): The key-provider behaviour: a selector in, key descriptors out.
- [Encryptor.Provider.Conformance](Encryptor.Provider.Conformance.md): The shared test suite every `Encryptor.Provider` implementation is held to.
- [Encryptor.Provider.Function](Encryptor.Provider.Function.md): A provider built from a host-supplied pair of closures.
- [Encryptor.Provider.Static](Encryptor.Provider.Static.md): A provider that holds its keys in configuration.
- [Encryptor.Vault](Encryptor.Vault.md): The vault: a host-owned module that wraps the engine completely.
- [Encryptor.Vault.CacheRecycler](Encryptor.Vault.CacheRecycler.md): Bounds a vault's materials cache by throwing the whole table away, on an
interval.
- [Encryptor.Vault.Config](Encryptor.Vault.Config.md): A vault's resolved configuration: the five-layer precedence chain, every
check that runs at start, and the `:persistent_term` freeze the hot path
reads.
- [Encryptor.Vault.Lifecycle](Encryptor.Vault.Lifecycle.md): Owns the lifetime of a vault's frozen configuration.
- [Encryptor.Vault.Partition](Encryptor.Vault.Partition.md): Derives the fixed-width cache partition id a vault hands the caching CMM.
- [Encryptor.Vault.Supervisor](Encryptor.Vault.Supervisor.md): The supervisor a vault starts, and the only place a vault has processes.

- Exceptions
  - [Encryptor.Error](Encryptor.Error.md): The one error struct this package returns, and the closed vocabulary of
reasons it carries.

