/**
 * apps/worker — symmetric encryption for secrets at rest (webhook signing
 * secrets).
 *
 * TASK-0130: this now DELEGATES to the single canonical implementation in
 * `@factory/shared` (`packages/shared/src/crypto.ts`). The API WRITES
 * `webhooks.secretEncrypted` with the shared `aes256gcmEncrypt`
 * (base64(iv || tag || ciphertext), 64-hex master keys used raw) and the
 * worker READS it here for delivery signing — one format, one key
 * derivation (C-13.8a). `MASTER_KEY_MISSING` is re-exported so the
 * dispatcher can surface a clean error when MASTER_ENCRYPTION_KEY is
 * unset (it refuses to sign without a master key).
 */
export {
  aes256gcmDecrypt,
  aes256gcmEncrypt,
  hmacSha256hex,
  keyFromSecret,
  safeEqual,
  sha256hex
} from "@factory/shared";

export class MasterKeyMissingError extends Error {
  constructor() {
    super("MASTER_ENCRYPTION_KEY is not configured — refusing to sign deliveries");
    this.name = "MasterKeyMissingError";
  }
}

/** Throw {@link MasterKeyMissingError} when the master key is blank. */
export function requireMasterKey(master: string): string {
  if (!master) throw new MasterKeyMissingError();
  return master;
}