Module encryption 

Structs

EncryptionConfig

Encryption configuration

EncryptionEngine

Encryption engine using AES-256-GCM SECURITY: Uses atomic counter to guarantee nonce uniqueness

EncryptionKey

Secure encryption key with automatic zeroization

EncryptionManager

Encryption manager for repository

Functions

cache_passphrase

Store passphrase in cache with timeout SECURITY: Passphrase stored in Zeroizing wrapper for automatic memory clearing

clear_cached_passphrase

Clear cached passphrase for specific repository

clear_derived_key_cache

Forget every key derived so far in this process.

clear_passphrase_cache

Clear all cached passphrases

default_key_file

The key file a repository gets when encryption.toml does not name one.

get_cached_passphrase

Retrieve cached passphrase if valid SECURITY: Returns clone of Zeroizing-wrapped passphrase

prompt_for_passphrase

Prompt user for passphrase securely via CLI

prompt_for_passphrase_confirmation

Prompt for passphrase confirmation (for new passphrases)