encrypt

type FieldProvider interface {
	EncryptField(plaintext []byte, domain, identity string) ([]byte, error)
	DecryptField(ciphertext []byte, domain, identity string) ([]byte, error)
}

type Header struct {
	Version    uint32
	ProviderID string
	Nonce      []byte
}

type Plugin struct {
	Name   string
	Loader func(ctx context.Context, cfg *config.Config) (Provider, error)
	Flags  func(cfg *config.Config) []cli.Flag
	Apply  func(cfg *config.Config, cmd *cli.Command)
}

type Provider interface {
	// ID returns the provider identifier written into the MSEH header (e.g. "plain", "dek", "vault").
	ID() string

	// Encrypt returns MSEH-wrapped ciphertext (or plaintext for the plain provider).
	Encrypt(plaintext []byte) ([]byte, error)

	// Decrypt accepts MSEH-wrapped ciphertext, legacy bare nonce||ciphertext, or plaintext.
	Decrypt(ciphertext []byte) ([]byte, error)

	// EncryptStream writes the MSEH header to dst then returns a WriteCloser that
	// encrypts written bytes for streaming storage.
	EncryptStream(dst io.Writer) (io.WriteCloser, error)

	// DecryptStream returns a Reader that decrypts bytes from src.
	// header is the already-parsed MSEH header (read by DataEncryptionService).
	DecryptStream(src io.Reader, header *Header) (io.Reader, error)

	// AttachmentSigningKeys returns the ordered set of HMAC keys for attachment
	// download URL signing (primary first, legacy rotation keys after).
	// Returns nil if this provider does not support signed URLs.
	AttachmentSigningKeys(ctx context.Context) ([][]byte, error)
}