/**
 * Crypto helpers: AES-256-GCM (at-rest secret encryption), sha256, tokens.
 *
 * TASK-0130: the implementation now lives in `@factory/shared`
 * (`packages/shared/src/crypto.ts`) — the single canonical envelope
 * `base64(iv || tag || ciphertext)` with a single key derivation
 * (64-hex-char master keys used raw, everything else SHA-256). The worker's
 * `apps/worker/src/lib/encrypt.ts` delegates to the SAME functions, so the
 * API's `webhooks.secretEncrypted` ciphertexts are decryptable by the
 * delivery worker (C-13.8a). This module re-exports the shared API so the
 * existing call sites are untouched.
 */
export {
  aes256gcmDecrypt,
  aes256gcmEncrypt,
  hmacSha256hex,
  keyFromSecret,
  randomToken,
  safeEqual,
  sha256hex
} from "@factory/shared";