Modules
Encrypted Ecto types for the Encryptor
vault - cloak_ecto-shaped field encryption for Ecto schemas.
An encrypted :binary field, declared the way cloak_ecto declares one.
Declares a keyed blind index on an encrypted field (ADR-0003 decisions 4, 3c and 6's declaration half).
One blind_index/3 declaration, and the single source of truth the write
side and the read side both read (ADR-0003 decisions 4, 5 and 6's
declaration half).
The blind index's key derivation: ADR-0003 decisions 2 and 3a, as amended on 2026-08-27 and reworked onto the vault's salted derivation surface on 2026-08-28.
Raised when a blind index's key cannot be derived (ADR-0003's exception table, the "key derivation fails upstream" row).
Raised when a field's declared normalizer could not produce a normalized value (ADR-0003's exception table, the "a host normalizer raises or returns a non-binary" row).
The normalizers a blind index declares, and the guarantee that applying one is total (ADR-0003 decision 4).
The index value itself: ADR-0003 decision 1, over a declaration.
The declared encryption contexts a host's schemas carry, and the check that no two of them are the same (ADR-0001 decision 4, acceptance amendment 5).
Raised when stored bytes fail to decrypt (ADR-0001 decision 6), whether because the vault rejected them or because they are not a well-formed message at all.
Raised when the vault returns an error encrypting a value (ADR-0001 decision 6).
The shared shape, and the redaction rules, of the encrypted-field exception family (ADR-0001 decision 6, acceptance amendment 2).
An encrypted map field: Encryptor.Ecto.Binary over a serialized map
(ADR-0001 decisions 1 and 8).
The compile-time DSL for a migration plan (ADR-0002 decision 2).
Rewrites the ciphertext columns a plan names, against live traffic.
The SQL half of verification: what a plan's tables look like, read with no application and no key.
Where a pass records how far it got, and what it refuses to do about the table it records into.
Keyset pagination over one schema's table, below the schema layer.
One field's pass: batches of rows, probed, rewritten, checkpointed.
What a migration plan module compiles to.
What a pass did: one classification count per class, per-field cursors, and the failures it found.
The per-row tenant resolver the migrator installs in the params it builds.
How the migrator reads the pre-migration value of a column.
Adapts any module that can already read a column's bytes to
Encryptor.Ecto.Migrator.Source.
The source for a column that was never encrypted.
Raised when the vault reports that required encryption-context keys were not supplied (ADR-0001 decision 6, acceptance amendment 2).
Raised when a field declared tenant: :scope is dumped or loaded with no
tenant in the process scope (ADR-0001 decision 6).
Raised when the serializer behind Encryptor.Ecto.Map fails on a value
(ADR-0001 decision 6).
An encrypted text field: Encryptor.Ecto.Binary with a String.t/0 cast
arm (ADR-0001 decision 1).
The current tenant, scoped to the calling process.
Resolves the tenant identifier for an encrypted field.
The tenant: :scope strategy, as an ordinary Encryptor.Ecto.TenantContext.
Scopes an ExUnit case, or one describe block, to a tenant.
Raised when a field declared tenant: :none names a :tenant-profile vault
(ADR-0001 decision 5e, acceptance amendment 3).
Mix Tasks
Generates the Ecto migration that creates the migrator's checkpoint table.
Generates a Encryptor.Ecto.Migration plan skeleton from the host's schemas.
Runs a migration plan, in exactly one of the two modes.
Classifies a plan's rows without writing anything.