feat(core): attachments and credential encryption

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/core/test/crypto.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from "bun:test";
+import { decryptJson, encryptJson } from "../src/crypto.ts";
+import { CryptoError } from "../src/errors.ts";
+
+describe("crypto", () => {
+  test("round-trips JSON", async () => {
+    const value = { token: "abc", n: [1, 2, { x: null }] };
+    const blob = await encryptJson("s3cret", value);
+    expect(blob).toMatch(/^v1\.[A-Za-z0-9+/=]+\.[A-Za-z0-9+/=]+$/);
+    expect(await decryptJson("s3cret", blob)).toEqual(value);
+  });
+
+  test("uses a fresh IV each time", async () => {
+    expect(await encryptJson("k", 1)).not.toBe(await encryptJson("k", 1));
+  });
+
+  test("wrong secret throws CryptoError", async () => {
+    const blob = await encryptJson("right", { a: 1 });
+    await expect(decryptJson("wrong", blob)).rejects.toBeInstanceOf(CryptoError);
+  });
+
+  test("malformed blob throws CryptoError", async () => {
+    await expect(decryptJson("k", "garbage")).rejects.toBeInstanceOf(CryptoError);
+    await expect(decryptJson("k", "v2.AA==.AA==")).rejects.toBeInstanceOf(CryptoError);
+  });
+});