Struct CryptoVault 

pub struct CryptoVault { /* private fields */ }

Process-wide encryption service. Provide once via ctx.provide(CryptoVault::bootstrap(source).await?), resolve anywhere with Inject<CryptoVault> / ctx.inject::<CryptoVault>().

Implementations

impl CryptoVault

pub async fn bootstrap(source: Arc<dyn KekSource>) -> Result<Self, CryptoError>

Load every DEK from the KEK source and build the initial ring.

pub fn encrypt( &self, key: &KeyId, plaintext: &[u8], ) -> Result<EncryptedField, CryptoError>

Hot path: seal plaintext under the active version of key. One atomic load + one hash probe + AES-256-GCM. No locks, no I/O.

pub fn decrypt( &self, field: &EncryptedField, ) -> Result<Secret<Vec<u8>>, CryptoError>

Hot path: open a sealed field with the exact version that sealed it. Returns Shredded when the key (or version) is gone — by design.

pub fn has_key(&self, key: &KeyId) -> bool

true when an active DEK exists for key.

pub async fn ensure_key(&self, key: &KeyId) -> Result<(), CryptoError>

Control plane: provision the key if absent (idempotent). Use for per-subject keys minted on first write.

pub async fn rotate(&self, key: &KeyId) -> Result<u32, CryptoError>

Control plane: add a new active version. Old versions keep decrypting existing ciphertext; new writes seal under the new version. Returns the new active version number.

pub async fn shred(&self, key: &KeyId) -> Result<(), CryptoError>

Control plane: crypto-shredding. Destroys the wrapped DEK at the KEK source, then drops it from the ring. Every ciphertext sealed under key — in the DB, outbox, idempotency cache, DLQ, audit chain — is permanently unreadable the moment this returns.