chore: import upstream snapshot with attribution

apps/sim/lib/data-drains/encryption.ts

@@ -0,0 +1,21 @@
+import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
+
+/**
+ * Encrypts an arbitrary JSON-serializable credentials object into a single
+ * `iv:ciphertext:authTag` string suitable for storage in
+ * `data_drains.destination_credentials`. Wraps the shared AES-256-GCM helper.
+ */
+export async function encryptCredentials<T>(plaintext: T): Promise<string> {
+  const { encrypted } = await encryptSecret(JSON.stringify(plaintext))
+  return encrypted
+}
+
+/**
+ * Decrypts the inverse of `encryptCredentials`. The caller is expected to run
+ * the destination's `credentialsSchema` on the result to defend against
+ * encryption-format drift.
+ */
+export async function decryptCredentials<T>(ciphertext: string): Promise<T> {
+  const { decrypted } = await decryptSecret(ciphertext)
+  return JSON.parse(decrypted) as T
+}