Token Encryption Utility (lib/token-encryption.ts)

Encrypts and decrypts tokens using AES‑256‑GCM with a base64 key from environment variables, adding a prefix for detection. Reuse for secure storage of API keys or session tokens.

// Source: https://github.com/mperkins0155/giselle | License: Apache-2.0 | Copyright 2024 ROUTE06, Inc
// Provided via justclaw.it.com; keep this notice with the code.
import {
	type CipherGCMTypes,
	createCipheriv,
	createDecipheriv,
	randomBytes,
} from "node:crypto";
import invariant from "tiny-invariant";

const ALGORITHM: CipherGCMTypes = "aes-256-gcm";
const IV_LENGTH = 12; // GCM recommended IV length
const AUTH_TAG_LENGTH = 16;
const ENCRYPTED_PREFIX = "enc:"; // Prefix to identify encrypted tokens

function getEncryptionKey(): Buffer {
	const key = process.env.TOKEN_ENCRYPTION_KEY;
	invariant(key, "TOKEN_ENCRYPTION_KEY is not set");
	const buffer = Buffer.from(key, "base64");
	invariant(buffer.length === 32, "TOKEN_ENCRYPTION_KEY must be 32 bytes");
	return buffer;
}

function isE

... (truncated -- full source via MCP)