Struct KeyManifest 

pub struct KeyManifest {
    pub format_version: u32,
    pub kek: KeyId,
    pub storage_keys: Vec<StorageKey>,
    pub classes: Vec<ProtectionClassKey>,
}

The keys:<db> root record.

Fields

format_version: u32

Manifest format version. Readers reject manifests from newer formats.

kek: KeyId

Key-encryption key, recorded per database rather than per deployment so per-tenant key isolation needs no format change. A deployment-wide KEK is the case where every database names the same one.

storage_keys: Vec<StorageKey>

Storage data keys, ascending by epoch.

classes: Vec<ProtectionClassKey>

Protection-class key identities, ascending by class entity id.

Implementations

impl KeyManifest

pub async fn create( keyring: &dyn Keyring, kek: KeyId, created_at_unix_ms: i64, ) -> Result<Self, StoreError>

Mints a database’s first storage key and returns its manifest.

Errors

Returns StoreError::Keyring when the KEK cannot be resolved or the fresh data key cannot be wrapped, and StoreError::Encryption when the platform has no usable random source. A database is created empty, so its first epoch opens at t 0 and covers every transaction until the first rotation.

pub fn active_storage_epoch(&self) -> Option<u32>

Returns the epoch new writes use, if any epoch is active.

Self::validate admits at most one active epoch, so the max below is a tie-break that a decoded manifest never needs; it keeps a manifest assembled in memory from silently writing under a superseded key.

pub fn storage_key(&self, epoch: u32) -> Option<&StorageKey>

Returns the entry for one storage epoch.

pub async fn unwrap_storage_keys( &self, keyring: &dyn Keyring, ) -> Result<BTreeMap<u32, SecretKey>, StoreError>

Unwraps every storage epoch the manifest carries.

The result is the immutable key snapshot EncryptedBlobStore and the log cipher hold: KMS access happens here, at open and on manifest reload, never on a blob read or a log append. Retired epochs are included while their material still resolves — a live object may still carry one, and reading it must not depend on when the mark pass last ran.

Errors

Returns StoreError::Keyring when an epoch cannot be unwrapped. A misconfigured process therefore fails at open, naming the epoch, rather than at its first read.

pub fn log_records_sealed(&self, epoch: u32, current_t: u64) -> Option<u64>

Log records sealed under one epoch as of basis current_t.

An epoch covers t from where it opened to where its successor did, or to the current basis if it is the newest. The log seals one record per transaction, so that span is the number of nonces drawn under the epoch’s key — see LOG_RECORDS_PER_EPOCH_LIMIT.

Returns None for an epoch the manifest does not carry.

pub fn storage_rotation_due(&self, current_t: u64) -> bool

Reports whether the active epoch has drawn enough nonces to want a rotation, at LOG_RECORDS_PER_EPOCH_WARN.

pub async fn rotate_storage_key( &mut self, keyring: &dyn Keyring, created_at_unix_ms: i64, current_t: u64, ) -> Result<u32, StoreError>

Opens a new storage epoch that new writes will use, from basis current_t.

Rotation is layered and cheap: no stored object is rewritten. The previous active epoch becomes Retiring and stays readable until ordinary re-indexing drains it. current_t closes the outgoing epoch’s nonce budget and opens the new one’s, so it must be the basis the rotation commits at.

Errors

Returns StoreError::Keyring when the new key cannot be wrapped, StoreError::Encryption when randomness is unavailable, and StoreError::InvalidKeyManifest when current_t precedes the newest epoch’s opening, which would leave the epochs unordered in t.

pub async fn rewrap( &mut self, keyring: &dyn Keyring, kek: KeyId, ) -> Result<(), StoreError>

Re-wraps every storage key under kek, touching no stored data.

keyring must resolve both the outgoing and incoming KEK: the manifest’s own KEK to unwrap, and kek to wrap again.

Errors

Returns StoreError::Keyring when either KEK cannot be resolved. The manifest is left untouched unless every key re-wraps.

pub fn encode(&self) -> Vec<u8>

Encodes the manifest for the root store.

pub fn decode(bytes: &[u8]) -> Result<Self, StoreError>

Decodes stored manifest bytes.

Errors

Returns StoreError::InvalidKeyManifest for malformed bytes and StoreError::UnsupportedKeyManifest for a manifest written by a newer release, which a reader must refuse rather than half-understand.

pub fn validate(&self) -> Result<(), StoreError>

Rejects a manifest that is well-formed but structurally impossible.

This record bootstraps every storage access a process makes, and it is cleartext, so “it parsed” is not the bar. A manifest that names an epoch twice, or none to write under, or two, describes a database that cannot exist — and each of those would surface much later as a wrong key, a failed open, or a silent choice between two active epochs.

Errors

Returns StoreError::InvalidKeyManifest naming the violated invariant.

Trait Implementations

impl Clone for KeyManifest

fn clone(&self) -> KeyManifest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyManifest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for KeyManifest

impl PartialEq for KeyManifest

fn eq(&self, other: &KeyManifest) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for KeyManifest