# Credentials Module

Organization credentials management with AES-256-GCM encryption.

## Import Patterns

### Server/Backend (API)
```typescript
// Import server-side functions (uses Node.js crypto and process.env)
import {
  prepareCredentialForInsert,
  decryptCredentialValue,
  encryptCredential,
  decryptCredential,
  type CreateCredentialParams
} from '@elevasis/core/server'
```

### Browser/Frontend

Credential encryption helpers are server-only. Browser code should not import this module or its helper types directly.

## Architecture

- **`index.ts`**: Type-only re-exports for internal source usage
- **`server.ts`**: Server-only exports (encryption functions, service helpers)
- **`encryption.ts`**: AES-256-GCM encryption/decryption (Node.js only)
- **`service.ts`**: Helper functions for credential operations (Node.js only)

## Published Surface Note

This directory is source-adjacent. Published app code should import credential helpers from `@elevasis/core/server`, while browser-safe code should treat credentials as an internal server concern.

## Why the Split?

The encryption module uses Node.js `crypto` and `process.env`, which don't exist in the browser.
By separating server-only exports into `@elevasis/core/server`, we prevent these Node.js dependencies
from being bundled into the browser application.
