Struct RunEncryption 

pub struct RunEncryption {
    pub cipher: Box<dyn Cipher>,
    pub nonce_prefix: [u8; 12],
    pub descriptor_bytes: Vec<u8>,
    pub mac_key: Option<[u8; 32]>,
}

Per-run encryption material assembled at write/read time: the page cipher (over the unwrapped DEK), the nonce prefix, and (write path only) the serialized descriptor to embed in the run. Carries only trait-object + primitive fields so it is constructible without the encryption feature’s concrete crypto types.

Fields

cipher: Box<dyn Cipher>

nonce_prefix: [u8; 12]

descriptor_bytes: Vec<u8>

mac_key: Option<[u8; 32]>

Run-metadata MAC key (write path only; None on the read path, where the reader re-derives it from the KEK). See [run_metadata_mac].