Struct LogCipher 

pub struct LogCipher { /* private fields */ }

Encrypts and decrypts transaction-log record payloads for one database.

Frame lengths and CRC32C checksums stay cleartext, as do each record’s key epoch and transaction number, so frame scanning, range reads, and recovery truncation need no key. The payload — the transaction’s datoms — does not.

The key set is an immutable snapshot of already-unwrapped storage keys, the same shape EncryptedBlobStore holds: KMS access belongs on database open and key-manifest reload, not on the append path. A rotation replaces the cipher rather than mutating it.

Implementations

impl LogCipher

pub fn new( lineage: impl Into<Vec<u8>>, current_epoch: u32, keys: impl IntoIterator<Item = (u32, SecretKey)>, ) -> Result<Self, LogError>

Creates a cipher over every readable epoch, writing under current_epoch.

lineage identifies the database and is authenticated into every record, so a record cannot be moved between databases.

Errors

Returns LogError::MissingKeyEpoch when current_epoch has no key.

pub fn with_key(lineage: impl Into<Vec<u8>>, epoch: u32, key: SecretKey) -> Self

Creates a single-epoch cipher.

pub fn install( &self, current_epoch: u32, keys: impl IntoIterator<Item = (u32, SecretKey)>, ) -> Result<(), LogError>

Installs a new key snapshot, so new records seal under current_epoch.

A storage-key rotation opens an epoch that new writes must use immediately — that is the whole point of the log-record nonce budget it resets. The append path holds this cipher through the open log, so the snapshot is replaced here rather than the cipher being rebuilt: a rotation needs no restart and no log reopen. The swap is atomic and every record is self-describing about its epoch, so a record sealed on either side of it opens under the snapshot that follows.

Errors

Returns LogError::MissingKeyEpoch when current_epoch has no key, leaving the installed snapshot untouched.

pub fn current_epoch(&self) -> u32

Returns the epoch new records are written under.