Module inspect 

Available on crate features boring and crypto and inspect and std only.

Authenticated encryption layered over any record storage service.

Records are encoded as independently authenticated 64 KiB chunks followed by an authenticated terminator. Readers authenticate each chunk before exposing plaintext. Neither direction buffers the whole record. Range reads address plaintext and currently scan/authenticate the preceding chunks. Partial reads authenticate the chunks they expose; detection of a missing terminator or trailing data requires consuming the record to EOF. A preview is not proof of whole-record integrity.

Available with both inspect and boring; enabling inspection does not select a cryptographic backend for the application.

Structs

EncryptStorageLayer

Per-instance AES-256-GCM key. Debug output never reveals the key.

EncryptStore

Storage service produced by EncryptStorageLayer.