13. Transparent field encryption

Mark the stored bytes as sensitive in RSL so the schema records that the column holds protected data:

model EncryptedRecord {
  id     BigInt @id
  secret Bytes  @rent.sensitive

  @@map("encrypted_records")
}

Attach a codec once when building the generated client:

let client = Client::new(pool.clone()).with_encrypted_record_field_codec(
    encrypted_record::fields::SECRET,
    FieldCodec::bytes(
        move |value| encoder.encode(value),
        move |value| codec.decode(value),
    ),
);

The generated model continues to expose plaintext bytes. The runnable chapter reads the underlying SQL column separately and proves the stored ciphertext does not equal the original value.

The complete encrypted-record schema is crates/rent/examples/tutorial_12_encryption/schema.rsl. Run cargo run -p rent --example tutorial_12_encryption. The same program runs under nextest and verifies both plaintext application values and ciphertext-at-rest.