Module barrier 

Structs

Barrier

Wraps a raw StorageBackend, transparently AEAD-encrypting/decrypting values. Paths are left in plaintext (same as Vault’s own barrier).

RewrapReport

What a rewrap pass did. unchanged is the steady state — everything is already on the active key — and contended counts values a concurrent write claimed first, which is benign: that write used the active key too.

Traits

KeyRotation

Re-encrypting the whole store under a new master key. Separate from StorageBackend because only the barrier knows about keys, and exposed as a trait so the server can hold it behind an Arc without naming the concrete backend.