Module secret_envelope 

Versioned authenticated encryption for product-owned persisted secrets.

Functions

decrypt_secret

Decrypts a strict v1:<base64url nonce>:<base64url ciphertext> secret envelope.

encrypt_secret

Encrypts bytes into a versioned AES-256-GCM secret envelope.