Module at_rest 

Local Encryption at-rest sweep: enable, disable and rekey every encrypted column inside one transaction, so a crash leaves the store on one key.

Adding an encrypted column is a two-place change: the save_* writer that wraps it and migrate_community_in_tx here. A column the sweep misses stays under the old key after a rekey and garbles on the next read.

Structs

MigrationProgress

Payload of the encryption_migration_progress event.

Constants

NIP55_PIN_CANARY

Known plaintext for the NIP-55 PIN verification canary. Encrypted under the derived key at setup (and when Local Encryption is toggled on) and re-decrypted at boot to reject a wrong PIN (a keyless account has no pkey whose failed decrypt would otherwise do this).

Functions

backfill_community_at_rest

One-time backfill for an account that already had Local Encryption ON before Concord at-rest encryption shipped: its community rows are still plaintext. Wrap them once, gated by a per-account settings flag. Idempotent (the field discriminators skip already-wrapped rows), so a crash mid-pass re-runs next login. No-op when encryption is off, the key vault is empty, or the flag is set. Best-effort at the call site — a failure leaves the flag unset and retries, never blocks login.

disable

Disable encryption inside a single SQLite transaction.

enable

Enable encryption inside a single SQLite transaction.

key_matches_account

Does key provably decrypt this account’s material? Checks whichever anchor the account shape has: the pkey ciphertext (local/bunker) or the canary (keyless NIP-55). No anchor (plaintext pkey, no canary) = nothing to contradict, so accept — matching every other credential check in the app.

rekey

Perform the entire re-key operation inside a single SQLite transaction.