()
| 26 | * In production, rejects the all-zero default. |
| 27 | */ |
| 28 | export function validateEncryptionKey(): void { |
| 29 | const key = env.ENCRYPTION_KEY |
| 30 | if (key?.length !== 64 || !/^[0-9a-fA-F]+$/.test(key)) |
| 31 | throw new Error('ENCRYPTION_KEY must be a 64-character hex string (32 bytes)') |
| 32 | |
| 33 | if (env.NODE_ENV === 'production' && key === weakEncryptionKey) |
| 34 | throw new Error('ENCRYPTION_KEY must not be the all-zero default in production') |
| 35 | } |
| 36 | |
| 37 | /** |
| 38 | * Encrypts plaintext using AES-256-GCM |