Module cipher 

The vault side of a rotation attempt: the pre-flight dry run and the cipher write (including the 409 re-check), plus fetching, checking and re-encrypting the cipher. The stage fixes how a rejection is reported.

Macros

stage_reason 🔒

Picks the stage’s 'static reason string for $suffix.

Enums

Stage 🔒

Where a cipher is checked, which fixes the sync state and the reason strings.

Constants

PRE_FLIGHT_PLACEHOLDER_PASSWORD 🔒

Stands in for the new password in the pre-flight dry run.

Functions

cipher_halt 🔒

Maps a cipher error to the stage’s halt, with a fixed, content-free reason. A write-invalid error only gets its own reason at pre-flight; at pre-write it is CipherEncryptFailed.

cipher_write_landed 🔒

Whether the vault’s cipher already holds new_password, so a rejected write did land. Any failure to tell counts as not landed; only an abort is an error.

fetch_checked_cipher 🔒

Fetches the cipher and checks that it is the claim’s.

fetch_cipher 🔒

Fetches the cipher with retries. Callers handle failure, since the sync state differs.

rotate_cipher 🔒

Re-encrypts cipher with new_password, mapping a failure to the stage’s halt.