namespace DXPBLL.Kyc;

// AES-GCM encryption for GSTIN/PAN at rest, key resolved from Vault via IDXPSecretResolver —
// deliberately NOT GB5Shared.EncryptionHelper.LoginEncryption (hardcoded key baked into source,
// unsuitable for regulated PII) nor PasswordEncryption (no matching Decrypt method — this data
// must be readable back for compliance submission, unlike a password).
public interface IDXPKycEncryption
{
    Task<string> EncryptAsync(string plaintext, CancellationToken ct);
    Task<string> DecryptAsync(string ciphertext, CancellationToken ct);
    string Hash(string normalizedValue); // one-way SHA-256, lookup/audit only
}