"""``mgf.auth._svix`` — Svix/Clerk webhook-secret codec seam (vendor-neutral).

A thin wrapper over :func:`mgf.common.webhooks.decode_svix_secret`, the single
shared home for the Svix ``whsec_<base64>`` codec (PAPER-26). It lives in its
own module (NOT in ``clerk_webhook``) so the generic core — including the mocks
— can decode a secret the SAME way the production verifier does, WITHOUT the
import-linter ``forbidden`` contract (generic core ↛ Clerk adapter) being
violated (DP-01).
"""

from __future__ import annotations

from mgf.common.webhooks import decode_svix_secret

__all__ = ["_decode_svix_secret"]


def _decode_svix_secret(secret: bytes | str) -> bytes:
    """Return the raw HMAC key from a Svix/Clerk ``whsec_<base64>`` secret.

    Thin wrapper over :func:`mgf.common.webhooks.decode_svix_secret`; kept as
    the mgf-auth-owned seam (see module docstring). Behaviour is identical:
    strip the ``whsec_`` prefix, base64-decode to the raw HMAC key, and fall
    back to raw bytes for non-base64 dev/test secrets (e.g. ``whsec_test``).
    """
    return decode_svix_secret(secret)
