Module chain_secret

Chain secret decoding helpers shared across the CLI and any embedder that consumes the AGENTGUARD_CHAIN_SECRET file.

The chain secret on disk can be in one of three formats:

1. Hex: 64 ASCII hex characters (32 raw bytes).
2. Base64: standard base64 (with padding) of 32+ bytes.
3. Raw bytes: any other byte sequence is passed through as-is.

The CLI, the server, the doctor command, and the delegate command all used to inline this logic. The five copies drifted over time (one called base64::engine::general_purpose::URL_SAFE_NO_PAD, the others STANDARD); this module is the single source of truth.

Functions

decode

Decode a chain secret file. Tries hex (64 ASCII chars) and base64 (standard alphabet) in turn; falls back to raw bytes.