Module crypto 

Enums

DecryptOrigin

Which key successfully decrypted a stored secret.

Functions

decrypt_secret

Decrypt a stored secret. Thin wrapper over decrypt_secret_with_origin that discards the key-generation signal.

decrypt_secret_with_origin

Decrypt a stored secret, also reporting which key generation succeeded.

encrypt_secret

sha256_block_hex

SHA-256 a byte slice and return it as the prefixed digest string "sha256:<lowercase-hex>". Used by difflore-cli’s MCP install manifest (item ⑤b) to hash the exact DiffLore config block we render, so a later agents update can tell “unchanged since DiffLore wrote it” (safe to upgrade) from “the human edited it” (must not clobber). Keeping the hashing here lets the CLI reuse the workspace sha2 dep instead of pulling in a second hashing crate, and pins the algorithm choice to one place. The helper is pure — it never reads files, the keyring, or any repo-scoped state.