package mailstore

import (
	"crypto/sha256"
	"encoding/hex"
)

// CredentialEnvelopeDigest binds a capability fact to one exact encrypted
// credential generation without exposing plaintext credential material.
func CredentialEnvelopeDigest(encrypted []byte) string {
	digest := sha256.Sum256(encrypted)
	return "sha256:" + hex.EncodeToString(digest[:])
}