1/** 2 * Crypto helpers: AES-256-GCM (at-rest secret encryption), sha256, tokens. 3 * 4 * TASK-0130: the implementation now lives in `@factory/shared` 5 * (`packages/shared/src/crypto.ts`) — the single canonical envelope 6 * `base64(iv || tag || ciphertext)` with a single key derivation 7 * (64-hex-char master keys used raw, everything else SHA-256). The worker's 8 * `apps/worker/src/lib/encrypt.ts` delegates to the SAME functions, so the 9 * API's `webhooks.secretEncrypted` ciphertexts are decryptable by the 10 * delivery worker (C-13.8a). This module re-exports the shared API so the 11 * existing call sites are untouched. 12 */ 13export { 14 aes256gcmDecrypt, 15 aes256gcmEncrypt, 16 hmacSha256hex, 17 keyFromSecret, 18 randomToken, 19 safeEqual, 20 sha256hex 21} from "@factory/shared"; 22