Module encryption 

chacha20poly1305 AEAD wrapper for token-at-rest encryption.

The cipher operations live in the shared crate-internal aead core (one implementation for both at-rest stacks); this module owns key loading from {PREFIX}_OAUTH_ENCRYPTION_KEY and the upstream error taxonomy.

Every seal() call generates a fresh random 12-byte nonce. Callers MUST store the returned nonce alongside the ciphertext and MUST NOT reuse it. The upsert path in store.rs always replaces the stored nonce with the one returned by seal().

Structs

EncryptionKey

A loaded 32-byte encryption key ready for seal / open. Wiped from memory on drop.

Enums

EncryptionError

Errors from encryption/decryption operations.

Functions

load_key

Load a 32-byte key from a base64-encoded string (e.g. {PREFIX}_OAUTH_ENCRYPTION_KEY).

open

Decrypt ciphertext using key and nonce.

open_with_aad

seal

Encrypt plaintext under key, returning (ciphertext, nonce).

seal_with_aad