Function encrypt_secret 

pub fn encrypt_secret(
    master_key: &[u8],
    context: &[u8],
    aad: &[u8],
    plaintext: &[u8],
) -> Result<String>

Encrypts bytes into a versioned AES-256-GCM secret envelope.

context is used as HKDF info and must be a stable, non-empty product-owned purpose string. aad is authenticated but not stored in the envelope. Both values are persistence contracts: changing either one makes existing ciphertext fail authentication.

Errors

Returns an error when context is empty, key derivation fails, or authenticated encryption fails. Error values never contain the master key, context, AAD, plaintext, or ciphertext.