/**
 * @bytelyst/client-encrypt — Types
 *
 * Shared type definitions for client-side field encryption.
 * Wire-compatible with @bytelyst/field-encrypt (server) and
 * BLFieldEncrypt (Swift/Kotlin native SDKs).
 */

/** Encrypted field stored in Cosmos DB or API responses. */
export interface EncryptedField {
  /** Sentinel — always true for encrypted fields. */
  readonly __encrypted: true;
  /** Schema version for future algorithm changes. */
  readonly v: 1;
  /** Algorithm identifier. */
  readonly alg: 'aes-256-gcm';
  /** Ciphertext (hex-encoded). */
  readonly ct: string;
  /** Initialization vector (hex-encoded, 12 bytes / 24 hex chars). */
  readonly iv: string;
  /** GCM authentication tag (hex-encoded, 16 bytes / 32 hex chars). */
  readonly tag: string;
  /** DEK identifier — identifies which key to use for decryption. */
  readonly dekId: string;
}

/** Options for encrypt/decrypt operations. */
export interface ClientEncryptContext {
  /** Scope for DEK isolation (typically userId). */
  readonly userId: string;
  /** Additional context for DEK naming and AAD (e.g., 'transcripts', 'notes'). */
  readonly context: string;
}
