reencrypt-inplace

Overview ¶

Package main demonstrates in-place stream re-encryption — the historical backfill for a store that enabled field encryption AFTER it already had plaintext data.

It shows:

• appending events as plaintext (encryption not yet configured)
• turning encryption on and calling store.ReEncryptStreamInPlace to seal the existing rows in place (same stream id / version / global position)
• the events decrypting transparently afterwards
• crypto-shredding the now-encrypted history by revoking the key

Unlike ReEncryptStream (which copies to a NEW stream, for key rotation), this rewrites the SAME rows, so it fits aggregates that read a fixed stream id.