//! Seal/unseal error types.

use thiserror::Error;

#[derive(Debug, Error)]
pub enum SealError {
    #[error("encryption failed: {0}")]
    EncryptionFailed(String),

    #[error("decryption failed: {0}")]
    DecryptionFailed(String),

    #[error("signature verification failed — artifact may be tampered")]
    SignatureInvalid,

    #[error("invalid magic header: expected ENGRAM01, got {0:?}")]
    InvalidMagic([u8; 8]),

    #[error("unsupported algorithm version: {0}")]
    UnsupportedAlgorithm(String),

    #[error("deployment binding mismatch — wrong key or wrong machine")]
    BindingMismatch,

    #[error("serialization error: {0}")]
    Serialization(String),

    #[error("environment variable {0} not set — cannot unseal")]
    MissingEnvKey(String),

    #[error("crypto engine error: {0}")]
    CryptoEngine(String),
}

pub type SealResult<T> = Result<T, SealError>;