Function decode_vault_key_bytes 

pub fn decode_vault_key_bytes(b64_key: &str) -> Result<[u8; 32], CipherKeyError>

Decode a base64-encoded 32-byte vault key value into raw key bytes.

Shared by XChaCha20Poly1305Cipher::from_vault_b64_with_id and callers that need to register a previous key for XChaCha20Poly1305Cipher::with_previous directly — e.g. zeph durable rotate-key’s load_durable_cipher chokepoint decoding ZEPH_DURABLE_KEY_PREVIOUS (#6447) — so the base64 decode path is not duplicated outside this module.

Errors

Returns CipherKeyError::MalformedEncoding when b64_key is not valid base64, or CipherKeyError::InvalidKeyLength when the decoded key is not exactly 32 bytes.

Examples

use zeph_core::durable::{decode_vault_key_bytes, generate_durable_key_b64};

let key = generate_durable_key_b64();
assert_eq!(decode_vault_key_bytes(&key).unwrap().len(), 32);
assert!(decode_vault_key_bytes("not base64!").is_err());