Struct KeyVault 

pub struct KeyVault { /* private fields */ }

In-memory key vault.

The vault is the entry point for everything key-vault does. Application code constructs one via KeyVaultBuilder, hands it RawKey values to be fragmented, and (in later phases) receives KeyHandles in return. The vault itself is cheap to clone (it is Arc-backed internally) and safe to share across threads.

In Phase 0.3 the vault exposes KeyVault::fragment and KeyVault::defragment convenience methods that route through the configured normalizer and StandardFragmenter. The full named-key registry arrives in Phase 0.9.

Implementations

impl KeyVault

pub fn is_locked_out(&self) -> bool

Returns true if the vault is in lock-out state.

Lock-out is triggered by the threshold detector when KeyVault::report_failure reports more failures than VaultConfig::max_failures_before_lockout within VaultConfig::failure_window. Once set, KeyVault::fragment and KeyVault::defragment refuse to proceed and return Error::LockedOut. Use KeyVault::clear_lockout to reset.

pub fn clear_lockout(&self)

Clear the lockout flag.

Use this after the operator has resolved the underlying cause — e.g. a rotated credential, an investigated alert. Also clears the failure tracker; subsequent failures start counting from zero.

pub fn report_failure(&self, key_name: &str, note: Option<&'static str>)

Report a key-access failure to the configured monitor and the threshold detector.

key_name identifies which key the failure pertains to (used for per-key threshold tracking and in the monitor event). note is an optional caller-supplied free-text label; pass None if you don’t have one. Do not include key bytes or other secrets in the note — it is forwarded verbatim to every configured monitor.

If the per-key failure count within VaultConfig::failure_window reaches VaultConfig::max_failures_before_lockout, the vault transitions to lock-out state and the monitor’s on_threshold_breach callback fires. A max_failures of 0 disables threshold lockout — only the per-failure callback runs in that case.

pub fn report_anomalous_access( &self, key_name: &str, note: Option<&'static str>, )

Report an anomalous (but successful) key access to the monitor.

Useful for “this access pattern looks weird, but we’re not going to refuse it” cases — unusual time of day, geographic anomaly, caller identity that hasn’t been seen before. The monitor receives an AccessContext; the vault state is unaffected.

pub fn config(&self) -> &VaultConfig

Snapshot of the vault’s configuration.

pub fn fragment(&self, key: &RawKey) -> Result<Fragments>

Fragment a raw key through the configured normalizer, codex, and fragmenter.

The returned Fragments is opaque; pass it back to KeyVault::defragment to recover the (normalized + codex-encoded) bytes inverse-transformed.

Pipeline

key → blake3_normalize (optional) → codex.encode (optional) → fragmenter.fragment → Fragments

Errors

Returns whatever the underlying FragmentStrategy surfaces — in practice an Error::Fragment for a zero-length input.

pub fn defragment(&self, fragments: &Fragments) -> Result<RawKey>

Reassemble fragments produced by KeyVault::fragment.

Inverts the codex transformation (if configured) so the recovered bytes are the normalized key (or the original raw key if normalization is off). Defragmentation itself is delegated to the configured FragmentStrategy.

Errors

Returns Error::Defragment when the supplied fragments do not match the configured fragmenter’s layout.

Trait Implementations

impl Clone for KeyVault

fn clone(&self) -> KeyVault

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyVault

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.